I have a RaspberryPi on my LAN with default policies of DENY for in/out/forward. I want to open outgoing to four IP-addresses and allow responses to come back, but not accept new connections from outside.
I don't understand why most outgoing connections are blocked while some are allowed a couple of seconds later. See this from the log:
[Sat Nov 24 15:37:56 2018] IPTABLES:DROP: IN= OUT=eth0 SRC=10.0.0.40 DST=104.24.15.89 LEN=176 TOS=0x00 PREC=0x00 TTL=64 ID=3938 DF PROTO=TCP SPT=36512 DPT=80 WINDOW=115 RES=0x00 ACK PSH FIN URGP=0
[Sat Nov 24 15:38:03 2018] IPTABLES:ACCEPT:IN= OUT=eth0 SRC=10.0.0.40 DST=104.24.15.89 LEN=48 TOS=0x00 PREC=0x00 TTL=64 ID=34819 DF PROTO=TCP SPT=36708 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0
[Sat Nov 24 15:38:03 2018] IPTABLES:ACCEPT:IN=eth0 OUT= MAC=b8:27:eb:c2:4a:fc:a4:2b:8c:96:76:e5:08:00:45:00:00:30:00:00:40:00:38:06:c1:2f SRC=104.24.15.89 DST=10.0.0.40 LEN=48 TOS=0x00 PREC=0x00 TTL=56 ID=0 DF PROTO=TCP SPT=80 DPT=36708 WINDOW=29200 RES=0x00 ACK SYN URGP=0
[Sat Nov 24 15:38:03 2018] IPTABLES:DROP: IN= OUT=eth0 SRC=10.0.0.40 DST=104.24.15.89 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=34820 DF PROTO=TCP SPT=36708 DPT=80 WINDOW=115 RES=0x00 ACK URGP=0
[Sat Nov 24 15:38:03 2018] IPTABLES:DROP: IN= OUT=eth0 SRC=10.0.0.40 DST=104.24.15.89 LEN=176 TOS=0x00 PREC=0x00 TTL=64 ID=34821 DF PROTO=TCP SPT=36708 DPT=80 WINDOW=115 RES=0x00 ACK PSH URGP=0
This is how I created the rules:
iptables -I OUTPUT 4 -d 104.24.14.89 -m conntrack --ctstate NEW -j LOG_ACCEPT
iptables -I OUTPUT 5 -d 104.24.15.89 -m conntrack --ctstate NEW -j LOG_ACCEPT
iptables -I OUTPUT 6 -d 107.170.105.41 -m conntrack --ctstate NEW -j LOG_ACCEPT
iptables -I OUTPUT 7 -d 64.30.224.206 -m conntrack --ctstate NEW -j LOG_ACCEPT
iptables -I INPUT 4 -s 104.24.14.89 -m conntrack --ctstate ESTABLISHED -j LOG_ACCEPT
iptables -I INPUT 5 -s 104.24.15.89 -m conntrack --ctstate ESTABLISHED -j LOG_ACCEPT
iptables -I INPUT 6 -s 107.170.105.41 -m conntrack --ctstate ESTABLISHED -j LOG_ACCEPT
iptables -I INPUT 7 -s 64.30.224.206 -m conntrack --ctstate ESTABLISHED -j LOG_ACCEPT
These are all the rules:
root@notremusique(rw):~# iptables -L --line-numbers
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT all -- 10.0.0.0/24 anywhere
2 ACCEPT all -- localhost anywhere
3 ACCEPT udp -- anywhere anywhere udp spt:ntp
4 LOG_ACCEPT all -- 104.24.14.89 anywhere ctstate ESTABLISHED
5 LOG_ACCEPT all -- 104.24.15.89 anywhere ctstate ESTABLISHED
6 LOG_ACCEPT all -- 107.170.105.41 anywhere ctstate ESTABLISHED
7 LOG_ACCEPT all -- lastfm-api-vip1.phx1.cbsig.net anywhere ctstate ESTABLISHED
8 LOG_DROP all -- anywhere anywhere
Chain FORWARD (policy DROP)
num target prot opt source destination
Chain OUTPUT (policy DROP)
num target prot opt source destination
1 ACCEPT all -- anywhere 10.0.0.0/24
2 ACCEPT all -- anywhere localhost
3 ACCEPT udp -- anywhere anywhere udp dpt:ntp
4 LOG_ACCEPT all -- anywhere 104.24.14.89 ctstate NEW
5 LOG_ACCEPT all -- anywhere 104.24.15.89 ctstate NEW
6 LOG_ACCEPT all -- anywhere 107.170.105.41 ctstate NEW
7 LOG_ACCEPT all -- anywhere lastfm-api-vip1.phx1.cbsig.net ctstate NEW
8 LOG_ACCEPT all -- anywhere 134.25.4.0/24
9 LOG_DROP all -- anywhere anywhere
Chain LOG_ACCEPT (9 references)
num target prot opt source destination
1 LOG all -- anywhere anywhere LOG level info prefix "IPTABLES:ACCEPT:"
2 ACCEPT all -- anywhere anywhere
Chain LOG_DROP (2 references)
num target prot opt source destination
1 LOG all -- anywhere anywhere LOG level info prefix "IPTABLES:DROP: "
2 DROP all -- anywhere anywhere
root@notremusique(rw):~#
