Iptables => blackout

[lamachine_fr]

Hi all.
I'm trying to set up the iptables on FC8 server.
I've opened the ports for ssh et apache
/sbin/iptables -A INPUT -i eth0 -p tcp --dport xxxx -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

and closed the rest
/sbin/iptables -A INPUT -i eth0 -j DROP

The problem is that nothing works any more. Firefox shows «*Failed to Connect*» and ssh «* connect to host xxxx.kimsufi.com port xxxx: No route to host*»

Evrything start to works when stop the iptables.

Here is my /sbin/iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:xxxx
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain RH-Firewall-1-INPUT (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT esp -- anywhere anywhere
ACCEPT ah -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Any hints are welcome.

[jvillain]

I have always found that very hard to follow. Every one I know that actually stops to work with their iptables rules gets rid of what the RedHat variants ships with and switches to setting the default policy for input and forward to drop and then just allowing in what you want. Both methods work just this one is a little simpler and easy to read. The RH way may be more flexable. As always before changing make sure you understand the implications.


Some thing like.

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s 192.168.0.1 -j DROP
-A INPUT -s 69.68.81.120 -j DROP
-A INPUT -s 192.168.0.0/24 -j ACCEPT
-A INPUT -s 0.0.0.0/0 -p tcp --dport 80 -j ACCEPT
-A INPUT -s 0.0.0.0/0 -p tcp --dport 443 -j ACCEPT
COMMIT

[lamachine_fr]

Thanks for the replay jvillain.
By the time I've solved the problem by reseting => /sbin/iptables -F .
And after I wrote the new rules.
Now it works.