Iptables -A OUTPUT -o eth0 -p tcp -sport 80 -m state -state ESTABLISHED -j ACCEPT Looking at these two rules you have iptables -A INPUT -i eth0 -p tcp -dport 80 -m state -state NEW,ESTABLISHED -j ACCEPT Which should allow any outbound connections to destination TCP port 80 where the traffic is routed through eth0, which is much more in line with what you want.Īnd then as has been pointed out, don't forget about HTTPS, DNS. Try instead: iptables -A OUTPUT -o eth0 -p tcp -dport 80 -j ACCEPT

Hence, in practice, nothing can match this rule. There is also no way to establish a connection, since the only outgoing traffic that is allowed must be related to an already established connection. You are more likely to see a high source port number going out, well above 30000 seems to be common. Source ports below 1024 are privileged, and generally aren't used for outgoing connections even when the socket owning process is running as root.

The connection must already have been established.

With a DROP policy on the OUTPUT chain requires two things which are highly relevant here: Because the rule iptables -A OUTPUT -o eth0 -p tcp -sport 80 -m state -state ESTABLISHED -j ACCEPT

Iptables input