iptables is blocking wget [SOLVED]

5slight

I got an issue with my linux from scratch system. I have managed to get it all runnning fine with networking and ssh. My problem has come when setting up a firewall with IpTables. This my first time using IpTables as im use to using the simple UFW tool in ubuntu.

It was all going well until i tried to use wget.

when i try and use wget this is what happens:

[someone@somewhere:~]# wget http://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz
--2011-04-02 10:11:30-- http://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz
Resolving ftp.mozilla.org... 63.245.209.125
Connecting to ftp.mozilla.org|63.245.209.125|:80...

this is my iptables script:

# message
echo -n ">>Applying firewall rules... "

# flush current rules
$ip -F
$ip -X
$ip -Z

# Accept packets belonging to established and related connections
$ip -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow FTP connections @ port 21
$ip -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT

# Allow Active FTP Connections
$ip -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
$ip -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT

# Allow Passive FTP Connections
$ip -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT


#Enable DNS
$ip -A INPUT -p tcp -m tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$ip -A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

# Enable SSH
$ip -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
$ip -A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT

# Enable HTTP and HTTPS
$ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 80 -j ACCEPT

$ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 443 -j ACCEPT

# Enable PING
$ip -A INPUT -p icmp -m icmp -j ACCEPT
$ip -A OUTPUT -p icmp -m icmp -j ACCEPT

# Default to DROP all
$ip -P INPUT DROP
$ip -P OUTPUT DROP
$ip -P FORWARD DROP

#Allow Loop Back
$ip -A INPUT -i lo -j ACCEPT
$ip -A OUTPUT -o lo -j ACCEPT
echo "Done!"

I have checked my kernel configuration and all the nessersery networking bits have been compiled into it.

If i set the Pollicy to

INPUT ALLOW

OUTPUT ALLOW

FORWARD DROP

wget works then.

thanks in advance!

jabirali

It seems like you've only allowed HTTP input, but not output; so the outgoing connection to mozilla.org cannot be initiated. Try adding something like this to your configuration file in order to allow outgoing HTTP and HTTPS connections:

$ip -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT 
$ip -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT

If you intended to download the file using FTP, which should work fine with your iptables ruleset, use:

wget ftp://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz

By the way, is there a reason why you're choosing to block outgoing traffic by default, instead of allowing all outgoing traffic and just filtering the incoming traffic? Are you e.g. planning to use the machine as some sort of server?

5slight

yep that's exactly what i'm planning to do with it. I will try putting the output rules in. I did have them before but then i read that you can set output to accept on established connections. Which is what i have got but on second though that wont work for this as i need to output the request before a connection can be established.

5slight

Ok I have added the Output rules and still nothing for HTTP but i tried the ftp and that worked fine. Really confused as to why this isn't working.

5slight

I fixed it completely now

I replaced

$ip -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

with

$ip -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

thanks for your help

marc

Would you mind adding [SOLVED] to the topic for future reference? Thanks

By the way, for the next time, you could have a look into wireshark to find out where the problem is

Regards

Ernestv

Hey thanks, this is just what I was after, thank god for the search features. One of my students was asking me something similar and I've been looking for something to lay it out for him to understand it better and this has done just that, thanks again!:laugh:

5slight wrote:

I got an issue with my linux from scratch system. I have managed to get it all runnning fine with networking and ssh. My problem has come when setting up a firewall with IpTables. This my first time using IpTables as im use to using the simple UFW tool in ubuntu.

It was all going well until i tried to use wget.

when i try and use wget this is what happens:

[someone@somewhere:~]# wget http://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz
--2011-04-02 10:11:30--  http://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz
Resolving ftp.mozilla.org... 63.245.209.125
Connecting to ftp.mozilla.org|63.245.209.125|:80...

this is my iptables script:

# message
echo -n ">>Applying firewall rules...           "
 
# flush current rules
$ip -F
$ip -X
$ip -Z
 
# Accept packets belonging to established and related connections
$ip -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 
# Allow FTP connections @ port 21
$ip -A INPUT  -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 
# Allow Active FTP Connections
$ip -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
$ip -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
 
# Allow Passive FTP Connections
$ip -A INPUT -p tcp --sport 1024: --dport 1024:  -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp --sport 1024: --dport 1024:  -m state --state ESTABLISHED,RELATED -j ACCEPT
 
 
#Enable DNS
$ip -A INPUT -p tcp -m tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$ip -A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
 
# Enable SSH
$ip -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
$ip -A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT
 
# Enable HTTP and HTTPS
$ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 80 -j ACCEPT
 
$ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 443 -j ACCEPT
 
# Enable PING
$ip -A INPUT -p icmp -m icmp -j ACCEPT
$ip -A OUTPUT -p icmp -m icmp -j ACCEPT
 
# Default to DROP all
$ip -P INPUT DROP
$ip -P OUTPUT DROP
$ip -P FORWARD DROP
 
#Allow Loop Back
$ip -A INPUT -i lo -j ACCEPT
$ip -A OUTPUT -o lo -j ACCEPT
echo "Done!"
 

I have checked my kernel configuration and all the nessersery networking bits have been compiled into it.

If i set the Pollicy to
INPUT ALLOW
OUTPUT ALLOW
FORWARD DROP

wget works then.

thanks in advance!

marc

The problems doesn't seem to be in wget but in the ftp protocol ( FTP MUST DIE!!!)

The problem is in the port that the client is asking for the data transfers and you, by default, had the outbound policy blocked (i guess). Whenever you change it to ALLOW it works

That's not the *most* secure way though

Regards