Welcome to the Linux Foundation Forum!
iptables is blocking wget [SOLVED]
5slight
Posts: 10
I got an issue with my linux from scratch system. I have managed to get it all runnning fine with networking and ssh. My problem has come when setting up a firewall with IpTables. This my first time using IpTables as im use to using the simple UFW tool in ubuntu.
It was all going well until i tried to use wget.
when i try and use wget this is what happens:
[someone@somewhere:~]# wget http://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz
--2011-04-02 10:11:30-- http://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz
Resolving ftp.mozilla.org... 63.245.209.125
Connecting to ftp.mozilla.org|63.245.209.125|:80...
--2011-04-02 10:11:30-- http://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz
Resolving ftp.mozilla.org... 63.245.209.125
Connecting to ftp.mozilla.org|63.245.209.125|:80...
this is my iptables script:
# message
echo -n ">>Applying firewall rules... "
# flush current rules
$ip -F
$ip -X
$ip -Z
# Accept packets belonging to established and related connections
$ip -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow FTP connections @ port 21
$ip -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
# Allow Active FTP Connections
$ip -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
$ip -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
# Allow Passive FTP Connections
$ip -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
#Enable DNS
$ip -A INPUT -p tcp -m tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$ip -A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
# Enable SSH
$ip -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
$ip -A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT
# Enable HTTP and HTTPS
$ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 80 -j ACCEPT
$ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 443 -j ACCEPT
# Enable PING
$ip -A INPUT -p icmp -m icmp -j ACCEPT
$ip -A OUTPUT -p icmp -m icmp -j ACCEPT
# Default to DROP all
$ip -P INPUT DROP
$ip -P OUTPUT DROP
$ip -P FORWARD DROP
#Allow Loop Back
$ip -A INPUT -i lo -j ACCEPT
$ip -A OUTPUT -o lo -j ACCEPT
echo "Done!"
echo -n ">>Applying firewall rules... "
# flush current rules
$ip -F
$ip -X
$ip -Z
# Accept packets belonging to established and related connections
$ip -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow FTP connections @ port 21
$ip -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
# Allow Active FTP Connections
$ip -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
$ip -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
# Allow Passive FTP Connections
$ip -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
#Enable DNS
$ip -A INPUT -p tcp -m tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$ip -A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
# Enable SSH
$ip -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
$ip -A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT
# Enable HTTP and HTTPS
$ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 80 -j ACCEPT
$ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 443 -j ACCEPT
# Enable PING
$ip -A INPUT -p icmp -m icmp -j ACCEPT
$ip -A OUTPUT -p icmp -m icmp -j ACCEPT
# Default to DROP all
$ip -P INPUT DROP
$ip -P OUTPUT DROP
$ip -P FORWARD DROP
#Allow Loop Back
$ip -A INPUT -i lo -j ACCEPT
$ip -A OUTPUT -o lo -j ACCEPT
echo "Done!"
I have checked my kernel configuration and all the nessersery networking bits have been compiled into it.
If i set the Pollicy to
INPUT ALLOW
OUTPUT ALLOW
FORWARD DROP
wget works then.
thanks in advance!
0
Comments
-
It seems like you've only allowed HTTP input, but not output; so the outgoing connection to mozilla.org cannot be initiated. Try adding something like this to your configuration file in order to allow outgoing HTTP and HTTPS connections:
$ip -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT $ip -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
If you intended to download the file using FTP, which should work fine with your iptables ruleset, use:wget ftp://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz
By the way, is there a reason why you're choosing to block outgoing traffic by default, instead of allowing all outgoing traffic and just filtering the incoming traffic? Are you e.g. planning to use the machine as some sort of server?0 -
yep that's exactly what i'm planning to do with it. I will try putting the output rules in. I did have them before but then i read that you can set output to accept on established connections. Which is what i have got but on second though that wont work for this as i need to output the request before a connection can be established.0
-
Ok I have added the Output rules and still nothing for HTTP but i tried the ftp and that worked fine. Really confused as to why this isn't working.0
-
I fixed it completely now
I replaced$ip -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
with$ip -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
thanks for your help0 -
Would you mind adding [SOLVED] to the topic for future reference? Thanks
By the way, for the next time, you could have a look into wireshark to find out where the problem is
Regards0 -
Hey thanks, this is just what I was after, thank god for the search features. One of my students was asking me something similar and I've been looking for something to lay it out for him to understand it better and this has done just that, thanks again!:laugh:
5slight wrote:I got an issue with my linux from scratch system. I have managed to get it all runnning fine with networking and ssh. My problem has come when setting up a firewall with IpTables. This my first time using IpTables as im use to using the simple UFW tool in ubuntu.
It was all going well until i tried to use wget.
when i try and use wget this is what happens:[someone@somewhere:~]# wget http://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz --2011-04-02 10:11:30-- http://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz Resolving ftp.mozilla.org... 63.245.209.125 Connecting to ftp.mozilla.org|63.245.209.125|:80...
this is my iptables script:# message echo -n ">>Applying firewall rules... " # flush current rules $ip -F $ip -X $ip -Z # Accept packets belonging to established and related connections $ip -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow FTP connections @ port 21 $ip -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT $ip -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT # Allow Active FTP Connections $ip -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT $ip -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT # Allow Passive FTP Connections $ip -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT $ip -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT #Enable DNS $ip -A INPUT -p tcp -m tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $ip -A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $ip -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT $ip -A OUTPUT -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT # Enable SSH $ip -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT $ip -A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT # Enable HTTP and HTTPS $ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 80 -j ACCEPT $ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 443 -j ACCEPT # Enable PING $ip -A INPUT -p icmp -m icmp -j ACCEPT $ip -A OUTPUT -p icmp -m icmp -j ACCEPT # Default to DROP all $ip -P INPUT DROP $ip -P OUTPUT DROP $ip -P FORWARD DROP #Allow Loop Back $ip -A INPUT -i lo -j ACCEPT $ip -A OUTPUT -o lo -j ACCEPT echo "Done!"
I have checked my kernel configuration and all the nessersery networking bits have been compiled into it.
If i set the Pollicy to
INPUT ALLOW
OUTPUT ALLOW
FORWARD DROP
wget works then.
thanks in advance!0 -
The problems doesn't seem to be in wget but in the ftp protocol ( FTP MUST DIE!!!)
The problem is in the port that the client is asking for the data transfers and you, by default, had the outbound policy blocked (i guess). Whenever you change it to ALLOW it works
That's not the *most* secure way though
Regards0
Categories
- All Categories
- 167 LFX Mentorship
- 219 LFX Mentorship: Linux Kernel
- 801 Linux Foundation IT Professional Programs
- 358 Cloud Engineer IT Professional Program
- 180 Advanced Cloud Engineer IT Professional Program
- 83 DevOps Engineer IT Professional Program
- 149 Cloud Native Developer IT Professional Program
- 112 Express Training Courses
- 138 Express Courses - Discussion Forum
- 6.2K Training Courses
- 48 LFC110 Class Forum - Discontinued
- 17 LFC131 Class Forum
- 42 LFD102 Class Forum
- 227 LFD103 Class Forum
- 19 LFD110 Class Forum
- 39 LFD121 Class Forum
- 15 LFD133 Class Forum
- 7 LFD134 Class Forum
- 17 LFD137 Class Forum
- 63 LFD201 Class Forum
- 3 LFD210 Class Forum
- 5 LFD210-CN Class Forum
- 2 LFD213 Class Forum - Discontinued
- 128 LFD232 Class Forum - Discontinued
- 1 LFD233 Class Forum
- 2 LFD237 Class Forum
- 23 LFD254 Class Forum
- 697 LFD259 Class Forum
- 109 LFD272 Class Forum
- 3 LFD272-JP クラス フォーラム
- 10 LFD273 Class Forum
- 154 LFS101 Class Forum
- 1 LFS111 Class Forum
- 1 LFS112 Class Forum
- 1 LFS116 Class Forum
- 1 LFS118 Class Forum
- LFS120 Class Forum
- 7 LFS142 Class Forum
- 7 LFS144 Class Forum
- 3 LFS145 Class Forum
- 1 LFS146 Class Forum
- 3 LFS147 Class Forum
- 1 LFS148 Class Forum
- 15 LFS151 Class Forum
- 1 LFS157 Class Forum
- 34 LFS158 Class Forum
- 8 LFS162 Class Forum
- 1 LFS166 Class Forum
- 1 LFS167 Class Forum
- 3 LFS170 Class Forum
- 2 LFS171 Class Forum
- 1 LFS178 Class Forum
- 1 LFS180 Class Forum
- 1 LFS182 Class Forum
- 1 LFS183 Class Forum
- 29 LFS200 Class Forum
- 736 LFS201 Class Forum - Discontinued
- 2 LFS201-JP クラス フォーラム
- 14 LFS203 Class Forum
- 135 LFS207 Class Forum
- 1 LFS207-DE-Klassenforum
- 1 LFS207-JP クラス フォーラム
- 301 LFS211 Class Forum
- 55 LFS216 Class Forum
- 48 LFS241 Class Forum
- 48 LFS242 Class Forum
- 37 LFS243 Class Forum
- 15 LFS244 Class Forum
- LFS245 Class Forum
- LFS246 Class Forum
- 50 LFS250 Class Forum
- 1 LFS250-JP クラス フォーラム
- LFS251 Class Forum
- 155 LFS253 Class Forum
- LFS254 Class Forum
- LFS255 Class Forum
- 5 LFS256 Class Forum
- 1 LFS257 Class Forum
- 1.3K LFS258 Class Forum
- 10 LFS258-JP クラス フォーラム
- 122 LFS260 Class Forum
- 159 LFS261 Class Forum
- 42 LFS262 Class Forum
- 82 LFS263 Class Forum - Discontinued
- 15 LFS264 Class Forum - Discontinued
- 11 LFS266 Class Forum - Discontinued
- 20 LFS267 Class Forum
- 25 LFS268 Class Forum
- 31 LFS269 Class Forum
- 3 LFS270 Class Forum
- 199 LFS272 Class Forum
- 1 LFS272-JP クラス フォーラム
- LFS274 Class Forum
- 3 LFS281 Class Forum
- 10 LFW111 Class Forum
- 261 LFW211 Class Forum
- 182 LFW212 Class Forum
- 15 SKF100 Class Forum
- 1 SKF200 Class Forum
- 1 SKF201 Class Forum
- 782 Hardware
- 198 Drivers
- 68 I/O Devices
- 37 Monitors
- 96 Multimedia
- 174 Networking
- 91 Printers & Scanners
- 83 Storage
- 758 Linux Distributions
- 80 Debian
- 67 Fedora
- 15 Linux Mint
- 13 Mageia
- 23 openSUSE
- 143 Red Hat Enterprise
- 31 Slackware
- 13 SUSE Enterprise
- 348 Ubuntu
- 461 Linux System Administration
- 39 Cloud Computing
- 70 Command Line/Scripting
- Github systems admin projects
- 90 Linux Security
- 77 Network Management
- 101 System Management
- 46 Web Management
- 64 Mobile Computing
- 17 Android
- 34 Development
- 1.2K New to Linux
- 1K Getting Started with Linux
- 371 Off Topic
- 114 Introductions
- 174 Small Talk
- 19 Study Material
- 806 Programming and Development
- 304 Kernel Development
- 204 Software Development
- 1.8K Software
- 263 Applications
- 180 Command Line
- 3 Compiling/Installing
- 405 Games
- 309 Installation
- 97 All In Program
- 97 All In Forum
Upcoming Training
-
August 20, 2018
Kubernetes Administration (LFS458)
-
August 20, 2018
Linux System Administration (LFS301)
-
August 27, 2018
Open Source Virtualization (LFS462)
-
August 27, 2018
Linux Kernel Debugging and Security (LFD440)