Tightening up outgoing traffic

Tightening up outgoing traffic

[Neil Hodge]

All:

I am running directly off the firewall box.  I currently have the
following:

iptables -P OUTPUT ACCEPT

When I change to this:

iptables -P OUTPUT DROP
iptables -A OUTPUT -p tcp --destination-port http -j ACCEPT

I keep getting "domainname can not be found.  Please check the name and
try again" from my browser.  This only happens for new web sites (i.e.,
Yahoo works fine).  As this seems somewhat like a DNS issue, I tried
adding this:

iptables -A OUTPUT -p tcp --destination-port nameserver -j ACCEPT

but it didn't work.  Any ideas?  Thanks.

Neil Hodge

Re: Tightening up outgoing traffic

[Antony Stone]

On Tuesday 15 October 2002 1:47 pm, Neil Hodge wrote:

> All:
>
> I am running directly off the firewall box.  I currently have the
> following:
>
> iptables -P OUTPUT ACCEPT
>
> When I change to this:
>
> iptables -P OUTPUT DROP
> iptables -A OUTPUT -p tcp --destination-port http -j ACCEPT
>
> I keep getting "domainname can not be found.  Please check the name and
> try again" from my browser.  This only happens for new web sites (i.e.,
> Yahoo works fine).  As this seems somewhat like a DNS issue, I tried
> adding this:
>
> iptables -A OUTPUT -p tcp --destination-port nameserver -j ACCEPT
>
> but it didn't work.  Any ideas?  Thanks.

Yes.   Change the tcp to udp in the last command above :-)

By the way, I would recommend adding a LOGging rule to your OUTPUT chain, at 
the end just before packets get default DROPped, so you can see what you're 
blocking which you might not realise you want to allow....

There are things like some ICMP packets which you might not realise you 
should allow out of your machine in order to keep things running nicely.

Antony.

-- 

There are two possible outcomes.

If the result confirms the hypothesis, then you've made a measurement.
If the result is contrary to the hypothesis, then you've made a discovery.

 - Enrico Fermi

Re: Tightening up outgoing traffic

[Kjetil Andreas Laasby]

Problably because yahoo.com lies in your local DNS cache or on an cache
server behind your firewall.

add
iptables -A OUTPUT -p tcp --destination-port domain -j ACCEPT
iptables -A OUTPUT -p udp --destination-port domain -j ACCEPT

also.

You should also open up RELATED ICMP to minimize delay for errors.

hth,
Kjetil Laasby.

> All:
> 
> I am running directly off the firewall box.  I currently have the
> following:
> 
> iptables -P OUTPUT ACCEPT
> 
> When I change to this:
> 
> iptables -P OUTPUT DROP
> iptables -A OUTPUT -p tcp --destination-port http -j ACCEPT
> 
> I keep getting "domainname can not be found.  Please check the name and
> try again" from my browser.  This only happens for new web sites (i.e.,
> Yahoo works fine).  As this seems somewhat like a DNS issue, I tried
> adding this:
> 
> iptables -A OUTPUT -p tcp --destination-port nameserver -j ACCEPT
> 
> but it didn't work.  Any ideas?  Thanks.
> 
> Neil Hodge
> 
> 
> 

Re: Tightening up outgoing traffic

[Nick Drage]

On Tue, Oct 15, 2002 at 03:18:14PM +0200, Kjetil Andreas Laasby wrote:
> Problably because yahoo.com lies in your local DNS cache or on an cache
> server behind your firewall.
> 
> add
> iptables -A OUTPUT -p tcp --destination-port domain -j ACCEPT
> iptables -A OUTPUT -p udp --destination-port domain -j ACCEPT

Note the rules for tcp and udp here, it's worth opening both up in case your
DNS query needs a large reply.

> You should also open up RELATED ICMP to minimize delay for errors.

Seconded.

-- 
FunkyJesus System Administration Team

Re: Tightening up outgoing traffic

[Dan Searle]

Hi,

>
> I keep getting "domainname can not be found.  Please check the name and
> try again" from my browser.  This only happens for new web sites (i.e.,
> Yahoo works fine).  As this seems somewhat like a DNS issue, I tried
> adding this:
>

That'll be a DNS problem ;-)

> iptables -A OUTPUT -p tcp --destination-port nameserver -j ACCEPT
>
> but it didn't work.  Any ideas?  Thanks.

iptables -A OUTPUT -p tcp --dport domain -j ACCEPT
iptables -A OUTPUT -p udp --dport domain -j ACCEPT

You want to use the service name "domain", not "nameserver", also I think
domain lookups use the udp protocol also. (Don't quote me on that one :-)

Dan...

Re: Tightening up outgoing traffic

[Antony Stone]

On Tuesday 15 October 2002 3:32 pm, Dan Searle wrote:

> > I keep getting "domainname can not be found.  Please check the name and
> > try again" from my browser.  This only happens for new web sites (i.e.,
> > Yahoo works fine).  As this seems somewhat like a DNS issue, I tried
> > adding this:
> >
> > iptables -A OUTPUT -p tcp --destination-port nameserver -j ACCEPT
> >
> > but it didn't work.  Any ideas?  Thanks.
>
> iptables -A OUTPUT -p tcp --dport domain -j ACCEPT
> iptables -A OUTPUT -p udp --dport domain -j ACCEPT
>
> You want to use the service name "domain", not "nameserver",

In my version of /etc/services those are synonymous - 'domain' is the primary 
name of the service, and 'nameserver' is listed as an alias.

> also I think
> domain lookups use the udp protocol also. (Don't quote me on that one :-)

General rule for DNS is:

Client lookup on server uses UDP
Server to server transfers use TCP

Antony.

-- 

Documentation is like sex:
when it's good, it's very very good;
when it's bad, it's still better than nothing.

Re: Tightening up outgoing traffic

[Neil Hodge]

All:

On Tue, 2002-10-15 at 05:47, Neil Hodge wrote:
> All:
> 
> When I change to this:
> 
> iptables -P OUTPUT DROP
> iptables -A OUTPUT -p tcp --destination-port http -j ACCEPT
> 
> I keep getting "domainname can not be found.  Please check the name
and
> try again" from my browser.  This only happens for new web sites
(i.e.,
> Yahoo works fine).  As this seems somewhat like a DNS issue, I tried
> adding this:
> 
> iptables -A OUTPUT -p tcp --destination-port nameserver -j ACCEPT
> 
> but it didn't work.  Any ideas?  Thanks.
> 
> Neil Hodge
> 

Thanks for all of the information.  It worked well.  Although, when I
had to reboot (for another reason), X wouldn't start . . .  Alas, that's
a battle for another day.

Thanks!

Neil

Re: Tightening up outgoing traffic

[Alexandros Papadopoulos]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wednesday 16 October 2002 08:40, Neil Hodge wrote:
<snip>
> Thanks for all of the information.  It worked well.  Although, when I
> had to reboot (for another reason), X wouldn't start . . .  Alas, that's
> a battle for another day.
>
You need to enable all traffic on the loopback interface. X creates local 
connections for itself.

/sbin/iptables -A OUTPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT

should so the job

- -A
- -- 
http://www.andrew.cmu.edu/~apapadop/pub_key.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (GNU/Linux)

iD8DBQE9rYyZgmAMwQt1gmURAtspAJwJCiP8GGA5W6XEnm9d3cI6MgCi5ACeK+9+
4TmYKgGeik0f+eM5Csh+hB0=
=Pke4
-----END PGP SIGNATURE-----