iptables block everything except http
Posted
by
arminb
on Super User
See other posts from Super User
or by arminb
Published on 2012-11-14T15:29:51Z
Indexed on
2012/11/14
17:07 UTC
Read the original article
Hit count: 211
I'm trying to configure my iptables to block any network traffic except HTTP:
iptables -P INPUT DROP #set policy of INPUT to DROP
iptables -P OUTPUT DROP #set policy of OUTPUT to DROP
iptables -A INPUT -p tcp --sport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
The iptables output (iptables -L -v
) gives me:
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
4 745 ACCEPT tcp -- any any anywhere anywhere tcp spt:http state RELATED,ESTABLISHED
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
2 330 ACCEPT tcp -- any any anywhere anywhere tcp dpt:http state NEW,ESTABLISHED
When I try to wget 127.0.0.1
(yes i do have a web server and it works fine) i get:
--2012-11-14 16:29:01-- http://127.0.0.1/
Connecting to 127.0.0.1:80...
The request never finishes. What am I doing wrong? I'm setting iptables to DROP everything by default and add a rule to ACCEPT HTTP.
© Super User or respective owner