Take the 2-minute tour ×

I am trying to set minimal rules to my Linux iptables rules file to just be able to surf the internet.

Here what I did:

* filter



With just those rules, I can't surf the web.

I noticed that when I put -A INPUT -j ACCEPT, it works but I don't understand why. So what Input/output port do I need to surf the internet?

Thanks a lot. Regards

EDIT: It still doesn't work.

here is my iptables -L

Chain INPUT (policy DROP)
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

Chain FORWARD (policy DROP)

Chain OUTPUT (Policy ACCEPT)
ACCEPT all -- anywhere anywhere

However, if I add -A INPUT -j ACCEPT, I can surf the internet. So there should be something else within INPUT that's preventing it.

share|improve this question
Does it still not work, now that you have changed "ACCEPTED" to "ACCEPT"? –  Skyhawk Jun 5 '12 at 17:18
Hi, I just edited the bottom of my post with the iptables -L. Thanks. Regards –  alexx0186 Jun 5 '12 at 18:20
You technically needn't set any at all (nor drop policies). Nonetheless, I fear this is off topic here, as it doesn't appear to be about professional system administration. –  Falcon Momot Oct 4 '13 at 2:51
add comment

closed as off-topic by Jenny D, mdpc, Falcon Momot, kce, John Oct 4 '13 at 19:42



3 Answers

up vote 10 down vote accepted

You need to allow traffic that's returning from the remote servers, as well. Your input chain needs to allow those responses; the connection state module can make sure those responses are allowed.

share|improve this answer
Hi, thanks for your response. I tried your way. It seems to have worked for a few seconds, then I still get the same problem. I used iptables-save to extract the rules as they appear. I put them at the end of my post. Thanks a lot if you could tell me what is wrong. Regards –  alexx0186 Jun 5 '12 at 4:16
@alexx0186 I'm not seeing your rules in the OUTPUT chain anymore? Those are still needed in order for the connection to be allowed in the first place. –  Shane Madden Jun 5 '12 at 4:33
Oh ok. Is there a reason why -P OUTPUT ACCEPT is not enough? I thought that I wouldn't need those OUTPUT rules, if I accept all OUTPUT packets. Thanks. –  alexx0186 Jun 5 '12 at 5:13
@alexx0186 Oh, yes - I didn't notice that you'd changed that; that should work fine. Though now that I look closer your new rule set says -j ACCEPTED instead of -j ACCEPT; typo? –  Shane Madden Jun 5 '12 at 5:19
Hi, sorry it was just a typo on my post. There seems to be something else as INPUT that should be set in addition to the state RELATED,ESTABLISHED rule, because if I add -A INPUT -j ACCEPT as a rule, I can surf the internet. Thanks a lot for your help. Regards –  alexx0186 Jun 5 '12 at 18:09
add comment

Why exactly do you feel the need to regulate outbound connections?

The OUTPUT table manages OUTBOUND packets, and the INPUT table manages inbound packets.

If you're looking to secure your workstation/server, you should focus on INPUT rules and use a default 'DROP' rule and a 'RELATED,ESTABLISHED' rule like this one:

 /sbin/iptables -P INPUT DROP

This will allow you to then open additional specific ports while keeping most traffic out.

share|improve this answer
add comment

try to add this line in /etc/sysconfig/iptables (your IPtables rule file)


Some time iptables-save didn't work for me,It shows that it is save by restarting iptables service returned it to previous stage

share|improve this answer
Hi Shariq, thanks for your answer. This question already has an almost identical answer to yours that was marked as being correct over a year ago. I'm also not seeing anything in this question to indicate that the OP is running a RedHat-derived system and hence even has an /etc/sysconfig/ directory. –  Ladadadada Oct 3 '13 at 14:50
add comment
