Outgoing connections time out behind a DROP firewall

Likely causes

1. A default DROP policy with rules that accept only what comes from the inside, and no conntrack --ctstate ESTABLISHED,RELATED rule.
2. That rule exists but sits below a rule that drops first.

Diagnose

Run these in order. The output is what each printed on a lab's real Linux machines.

firewall:~# iptables -A FORWARD -i insideNetwork -j ACCEPT

The rule set: accept what comes in on the inside card…

firewall:~# iptables -S FORWARD
-P FORWARD ACCEPT
-A FORWARD -j NETLAB-FORWARD
-A FORWARD -i insideNetwork -j ACCEPT

firewall:~# iptables -P FORWARD DROP

…and drop everything else, replies included.

firewall:~# iptables -S FORWARD
-P FORWARD DROP
-A FORWARD -j NETLAB-FORWARD
-A FORWARD -i insideNetwork -j ACCEPT

insideClient:~# curl -sS -m 4 http://outsideServer.lab/

The inside client's request goes out, and the reply is dropped on the way back: a timeout.

curl: (28) Connection timed out after 4008 milliseconds

Fix

firewall:~# iptables -I FORWARD 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Accept packets of connections the firewall already allowed, at the top of the chain.

firewall:~# iptables -S FORWARD
-P FORWARD DROP
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j NETLAB-FORWARD
-A FORWARD -i insideNetwork -j ACCEPT

insideClient:~# curl -sS -m 4 http://outsideServer.lab/

The page loads.

outside server: public

firewall:~# conntrack -L -p tcp --dport 80

conntrack lists the connection it let out, so its replies match.

conntrack v1.4.8 (conntrack-tools): 1 flow entries have been shown.
tcp      6 119 TIME_WAIT src=10.0.1.10 dst=10.0.2.10 sport=37178 dport=80 src=10.0.2.10 dst=10.0.1.10 sport=80 dport=37178 [ASSURED] mark=0 use=1

outsideClient:~# curl -sS -m 4 http://insideServer.lab/

The outside still cannot open connections in.

curl: (28) Connection timed out after 4006 milliseconds

Break it and fix it yourself

Each lab is a small network of real Linux machines in your browser, where this fault happens.

• A stateful firewall: replies come home, nothing new gets in Pro: its challenge "Requests leave, replies never arrive" set the fault for you to find and fix.

Open A stateful firewall: replies come home, nothing new gets in