iptables is blocking wget [SOLVED]

Link to this post 02 Apr 11

I got an issue with my linux from scratch system. I have managed to get it all runnning fine with networking and ssh. My problem has come when setting up a firewall with IpTables. This my first time using IpTables as im use to using the simple UFW tool in ubuntu.

It was all going well until i tried to use wget.

when i try and use wget this is what happens:

[someone@somewhere:~]# wget
--2011-04-02 10:11:30--
Connecting to||:80...

this is my iptables script:

# message
echo -n ">>Applying firewall rules... "

# flush current rules
$ip -F
$ip -X
$ip -Z

# Accept packets belonging to established and related connections

# Allow FTP connections @ port 21
$ip -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT

# Allow Active FTP Connections
$ip -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
$ip -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT

# Allow Passive FTP Connections
$ip -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT

#Enable DNS
$ip -A INPUT -p tcp -m tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$ip -A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
$ip -A OUTPUT -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

# Enable SSH
$ip -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
$ip -A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT

# Enable HTTP and HTTPS
$ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 80 -j ACCEPT

$ip -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 443 -j ACCEPT

# Enable PING
$ip -A INPUT -p icmp -m icmp -j ACCEPT
$ip -A OUTPUT -p icmp -m icmp -j ACCEPT

# Default to DROP all

#Allow Loop Back
$ip -A INPUT -i lo -j ACCEPT
$ip -A OUTPUT -o lo -j ACCEPT
echo "Done!"

I have checked my kernel configuration and all the nessersery networking bits have been compiled into it.

If i set the Pollicy to

wget works then.

thanks in advance!

Link to this post 02 Apr 11

It seems like you've only allowed HTTP input, but not output; so the outgoing connection to cannot be initiated. Try adding something like this to your configuration file in order to allow outgoing HTTP and HTTPS connections:

$ip -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT 
$ip -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT

If you intended to download the file using FTP, which should work fine with your iptables ruleset, use:

By the way, is there a reason why you're choosing to block outgoing traffic by default, instead of allowing all outgoing traffic and just filtering the incoming traffic? Are you e.g. planning to use the machine as some sort of server?

Link to this post 02 Apr 11

yep that's exactly what i'm planning to do with it. I will try putting the output rules in. I did have them before but then i read that you can set output to accept on established connections. Which is what i have got but on second though that wont work for this as i need to output the request before a connection can be established.

Link to this post 02 Apr 11

Ok I have added the Output rules and still nothing for HTTP but i tried the ftp and that worked fine. Really confused as to why this isn't working.

Link to this post 02 Apr 11

I fixed it completely now

I replaced



$ip -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

thanks for your help

Link to this post 03 Apr 11

Would you mind adding [SOLVED] to the topic for future reference? Thanks :)

By the way, for the next time, you could have a look into wireshark to find out where the problem is :)


Who we are ?

The Linux Foundation is a non-profit consortium dedicated to the growth of Linux.

More About the foundation...

Frequent Questions

Join / Linux Training / Board