Welcome to the Linux Foundation Forum!

iptables is blocking wget [SOLVED]

5slight
5slight Posts: 10
in Linux Security

I got an issue with my linux from scratch system. I have managed to get it all runnning fine with networking and ssh. My problem has come when setting up a firewall with IpTables. This my first time using IpTables as im use to using the simple UFW tool in ubuntu.

It was all going well until i tried to use wget.

when i try and use wget this is what happens:

[[email protected]:~]# wget http://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz
--2011-04-02 10:11:30-- http://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz
Resolving ftp.mozilla.org... 63.245.209.125
Connecting to ftp.mozilla.org|63.245.209.125|:80...


this is my iptables script:

# message
echo -n ">>Applying firewall rules... "

# flush current rules
$ip -F
$ip -X
$ip -Z

# Accept packets belonging to established and related connections
$ip -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow FTP connections @ port 21
$ip -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT

# Allow Active FTP Connections
$ip -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
$ip -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT

# Allow Passive FTP Connections
$ip -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT


#Enable DNS
$ip -A INPUT -p tcp -m tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$ip -A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

# Enable SSH
$ip -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
$ip -A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT

# Enable HTTP and HTTPS
$ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 80 -j ACCEPT

$ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 443 -j ACCEPT

# Enable PING
$ip -A INPUT -p icmp -m icmp -j ACCEPT
$ip -A OUTPUT -p icmp -m icmp -j ACCEPT

# Default to DROP all
$ip -P INPUT DROP
$ip -P OUTPUT DROP
$ip -P FORWARD DROP

#Allow Loop Back
$ip -A INPUT -i lo -j ACCEPT
$ip -A OUTPUT -o lo -j ACCEPT
echo "Done!"


I have checked my kernel configuration and all the nessersery networking bits have been compiled into it.

If i set the Pollicy to

INPUT ALLOW

OUTPUT ALLOW

FORWARD DROP

wget works then.

thanks in advance!

Comments

  • jabirali
    jabirali Posts: 157
    It seems like you've only allowed HTTP input, but not output; so the outgoing connection to mozilla.org cannot be initiated. Try adding something like this to your configuration file in order to allow outgoing HTTP and HTTPS connections: 
    $ip -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT 
$ip -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
    If you intended to download the file using FTP, which should work fine with your iptables ruleset, use: 
    wget ftp://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz
    By the way, is there a reason why you're choosing to block outgoing traffic by default, instead of allowing all outgoing traffic and just filtering the incoming traffic? Are you e.g. planning to use the machine as some sort of server?
  • 5slight
    5slight Posts: 10
    yep that's exactly what i'm planning to do with it. I will try putting the output rules in. I did have them before but then i read that you can set output to accept on established connections. Which is what i have got but on second though that wont work for this as i need to output the request before a connection can be established.
  • 5slight
    5slight Posts: 10
    Ok I have added the Output rules and still nothing for HTTP but i tried the ftp and that worked fine. Really confused as to why this isn't working.
  • 5slight
    5slight Posts: 10
    I fixed it completely now

    I replaced 
    $ip -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    with 
    $ip -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

    thanks for your help
  • marc
    marc Posts: 647
    Would you mind adding [SOLVED] to the topic for future reference? Thanks :)

    By the way, for the next time, you could have a look into wireshark to find out where the problem is :)

    Regards
  • Ernestv
    Ernestv Posts: 2
    Hey thanks, this is just what I was after, thank god for the search features. One of my students was asking me something similar and I've been looking for something to lay it out for him to understand it better and this has done just that, thanks again!:laugh:

    5slight wrote:
    I got an issue with my linux from scratch system. I have managed to get it all runnning fine with networking and ssh. My problem has come when setting up a firewall with IpTables. This my first time using IpTables as im use to using the simple UFW tool in ubuntu.

    It was all going well until i tried to use wget.

    when i try and use wget this is what happens:
    [[email protected]:~]# wget http://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz
--2011-04-02 10:11:30--  http://ftp.mozilla.org/pub/mozilla.org/js/js185-1.0.0.tar.gz
Resolving ftp.mozilla.org... 63.245.209.125
Connecting to ftp.mozilla.org|63.245.209.125|:80...

    this is my iptables script: 
    # message
echo -n ">>Applying firewall rules...           "

# flush current rules
$ip -F
$ip -X
$ip -Z

# Accept packets belonging to established and related connections
$ip -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow FTP connections @ port 21
$ip -A INPUT  -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT

# Allow Active FTP Connections
$ip -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
$ip -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT

# Allow Passive FTP Connections
$ip -A INPUT -p tcp --sport 1024: --dport 1024:  -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp --sport 1024: --dport 1024:  -m state --state ESTABLISHED,RELATED -j ACCEPT


#Enable DNS
$ip -A INPUT -p tcp -m tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$ip -A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

# Enable SSH
$ip -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
$ip -A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT

# Enable HTTP and HTTPS
$ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 80 -j ACCEPT

$ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 443 -j ACCEPT

# Enable PING
$ip -A INPUT -p icmp -m icmp -j ACCEPT
$ip -A OUTPUT -p icmp -m icmp -j ACCEPT

# Default to DROP all
$ip -P INPUT DROP
$ip -P OUTPUT DROP
$ip -P FORWARD DROP

#Allow Loop Back
$ip -A INPUT -i lo -j ACCEPT
$ip -A OUTPUT -o lo -j ACCEPT
echo "Done!"

    I have checked my kernel configuration and all the nessersery networking bits have been compiled into it.

    If i set the Pollicy to
    INPUT ALLOW
    OUTPUT ALLOW
    FORWARD DROP

    wget works then.

    thanks in advance!
  • marc
    marc Posts: 647
    The problems doesn't seem to be in wget but in the ftp protocol ( FTP MUST DIE!!!)

    The problem is in the port that the client is asking for the data transfers and you, by default, had the outbound policy blocked (i guess). Whenever you change it to ALLOW it works

    That's not the *most* secure way though ;)

    Regards

Categories

Upcoming Training