Problems Pinging the Internet w/this script

Here's a script I'm using to create some tables which will only allow in on ports I'm running services. One of the problems I'm havng is that I can't ping the Internet with a DNS address from this machine. I've allowed everything in the OUTPUT table and can ping the Internet when using a straight IP, but when I type in "ping google.com" the machine hangs for a few seconds and gives me a server request error. I know it's something with my rules because when I flush them all I can ping google.com just fine. Any ideas would be greatly appreciated. I'm guessing it's something trivial but can't put my finger on it yet.

thanks

#!/bin/bash
########## Beginning ###########################################################

# Define Interfaces/Networks

# Inside/Intranet Interface

     INSIDEIP="192.168.7.55"
     INSIDEINT="eth0"

# External/Internet Interface
# OUTSIDEIP=
# OUTSIDEINT=

# LAN Network

     LAN="192.168.7.0/24"

# Admin Host

     ADMIN="192.168.7.51"

# Define other Variables

RULE="/usr/sbin/iptables"

# Flushing All rules/chains
$RULE -A INPUT LOG
$RULE -A OUTPUT LOG
$RULE -A FORWARD LOG
$RULE -P INPUT DROP
$RULE -P OUTPUT DROP
$RULE -P FORWARD DROP
$RULE -F INPUT
$RULE -F OUTPUT
$RULE -F FORWARD

# Adding Permittable Network/Hosts/Ports to Input Table on Internal Interface

# Allowing DNS,FTP,SSH,Webmin,HTTP,SWAT,and Samba to Server

$RULE -A INPUT -i $INSIDEINT --proto icmp --icmp-type any -j ACCEPT $RULE -A INPUT -i $INSIDEINT --proto tcp --dport 21 -d $INSIDEIP -j ACCEPT $RULE -A INPUT -i $INSIDEINT --proto tcp -s $ADMIN --dport 22 -d
$INSIDEIP -j ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp --dport 53 -d $INSIDEIP -j ACCEPT $RULE -A INPUT -i $INSIDEINT --proto tcp --dport 80 -d $INSIDEIP -j ACCEPT $RULE -A INPUT -i $INSIDEINT --proto tcp --dport 137 -d $INSIDEIP -j
ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp --dport 138 -d $INSIDEIP -j
ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp --dport 139 -d $INSIDEIP -j
ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp --dport 445 -d $INSIDEIP -j
ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp -s $ADMIN --dport 901 -d
$INSIDEIP -j ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp -s $ADMIN --dport 10000 -d
$INSIDEIP -j ACCEPT

# Denying Everything on Local Network

# Adding entry to allow everything originating from Internal Interface out

$RULE -A OUTPUT -j ACCEPT

########## END ################################################################

........

.......

.......

One thing, at least, is that you have to allow DNS on both tcp and upd. So you also need a rule like this:

  $RULE -A INPUT -i $INSIDEINT --proto udp --dport 53 -d $INSIDEIP -j ACCEPT

HTH

Jim

um--any particular reason why you append 3 LOG rules (with incorrect syntax, btw...) 3 lines before you flush everything out? nevermind--i'm sure there's a fantastic reason behind it--so i'll just note, that they should be:

iptables -A INPUT -j LOG
iptables -A OUTPUT -j LOG
iptables -A FORWARD -j LOG

if this machine is a DNS server offering name resolution to hosts on $INSIDEINT--those requests are UDP, not TCP. TCP 53 is used for zone transfers between name servers.

ports 137 and 138, if being used in the "nmbd" sense--are UDP, not TCP. try "netstat -lntu" if you don't believe me.

stylistic note: you could reduce the number of rules you have by using the "-m multiport" match:

  iptables -A INPUT -i $INSIDEINT -p tcp -d $INSIDEIP \
    -m multiport --dports 21,80,139,445 -j ACCEPT

  iptables -A INPUT -i $INSIDEINT -p udp -d $INSIDEIP \
    -m multiport --dports 53,137,138 -j ACCEPT

the reason you can ping by IP is:

iptables -A OUTPUT -j ACCEPT

allows the ICMP echo-request out, and

  iptables -A INPUT -i $INSIDEINT --proto icmp --icmp-type any -j ACCEPT

allows the ICMP echo-reply back in.

the above does not hold true for a DNS request (UDP 53 out & in)

i might recommend investigating the use of:

  iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

as the first rule in your INPUT chain. and the use of:

iptables -A INPUT -j LOG --log-prefix "FW DROP IN: " iptables -A OUTPUT -j LOG --log-prefix "FW DROP OUT: "

as the last rules in your chains.

all this (and more) is covered in depth in:

http://iptables-tutorial.frozentux.net/iptables-tutorial.html

-j

Jason Opperisano <[email protected]>