Ytdyklly

I tried to block all ports except 22(ssh), 80(http), 443(https). My current INPUT rules are these.

> iptables -L

Chain INPUT (policy ACCEPT)

target     prot opt source               destination         

ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh

ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https

ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http

DROP       all  --  anywhere             anywhere            

it should accept http and https port and then block everything else. but It's blocking everything. for example when I try to visit facebook which uses port 80 & 443, it doesn't work. I can't visit facebook. what should I do now?

I also tried like this. Allowed mentioned ports and made the policy DROP, though I'm not sure. the same happens.

> iptables -L

Chain INPUT (policy DROP)

target     prot opt source               destination         

ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh

ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https

ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http

The policy rules that you've created will allow outside hosts to connect to your TCP ports 22, 80 and 443, but not allow any other traffic, including your own! If you really want to prevent this host from accessing anything other than these three ports, and don't want outside hosts to access yours at all, you can put the rules on your OUTPUT rule chain instead of your INPUT one and then have a CONNTRACK rule on your input chain to prevent connections that you didn't initiate:

-P INPUT DROP

-P OUTPUT DROP

-A INPUT -i lo -j ACCEPT

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

-A INPUT -m udp -p udp --sport 53 -j ACCEPT

-A OUTPUT -i lo -j ACCEPT

-A OUTPUT -m tcp -p tcp --dport 22 -j ACCEPT

-A OUTPUT -m tcp -p tcp --dport 53 -j ACCEPT

-A OUTPUT -m udp -p udp --dport 53 -j ACCEPT

-A OUTPUT -m tcp -p tcp --dport 80 -j ACCEPT

-A OUTPUT -m tcp -p tcp --dport 443 -j ACCEPT

I usually allow the loopback adapter to work normally as some internal programs may need it; as well, I would allow DNS traffic, or else you won't be able to resolve domain names.

As others pointed out in the comments, you do not need INPUT rules like those to access websites. You would only need these rules if you were running services on these ports locally. If you did want to restrict outbound traffic instead, these rules would need to go in the OUTPUT chain.

Additionally, you are losing all connectivity because you are DROPping all inbound traffic. When you make a connection to a webserver, the returning data (specifically, the TCP 3 way handshake) will be DROPPed in the INPUT chain because of your catch-all drop. To fix this, you need to add a rule to allow these return connections:

iptables -I INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Try update-alternatives --config iptables and select the legacy version.
Worked for me for the time being.