Dear experts and gurus,

I have a clean debian install with this rules configured:

*filter

# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j DROP

# Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allows all outbound traffic
# You could modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

# Allows HTTP and HTTPS connections from anywhere (the normal ports for websites)
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

# Allows SSH connections, use port number as specified in sshd_config file
-A INPUT -p tcp -m state --state NEW --dport 30000 -j ACCEPT

# Now you should read up on iptables rules and consider whether ssh access 
# for everyone is really desired. Most likely you will only allow access from certain IPs

# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

# log iptables denied calls (access via 'dmesg' command)
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j DROP
-A FORWARD -j DROP

COMMIT

I got it pretty much from here: http://wiki.debian.org/iptables
The idea is to close all ports excluding 80, 443, custom ssh port, and allowing icmp.

I checked the rules after applying it with iptables -L, and everything seems fine.

But when I did an nmap 127.0.0.1, I only see port 111 open.
I didn't even open port 111 according to the iptables rules.

Here's the output of the nmap:

Not shown: 999 closed ports
PORT    STATE SERVICE
111/tcp open  rpcbind

Maybe this is a silly question. But anyone knows what I did wrong?
I did reboot and re-applied the rules on boot-up. Same thing.


Cheers,
nux-noob

111 is open due to the rule about allowing all localhost traffic.

80 and 443 not showing up (as open OR filtered) could be due to the web server not listening on all interfaces (local and external). Or the server may not be started at all.

Thanks for the reply.

I did aware that I don't have anything listening on 80 or 443. I was expecting to see something like CLOSED or FILTERED on both 80 and 443.

Will test again with a webserver running.

You did, in the 'not shown, 999 closed ports' ;p