# IP Tables allow 80 and 443 only for Management

**URL:** <https://discourse.pi-hole.net/t/ip-tables-allow-80-and-443-only-for-management/23160>\
**Category:** Help\
**Created:** [September 4, 2019, 12:41pm UTC](https://discourse.pi-hole.net/t/ip-tables-allow-80-and-443-only-for-management/23160 "2019-09-04T12:41:59Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bobbys](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/b/a9a28c/32.png) [@Bobbys](https://discourse.pi-hole.net/u/Bobbys)\
**Post date:** [September 4, 2019, 12:41pm UTC](https://discourse.pi-hole.net/t/ip-tables-allow-80-and-443-only-for-management/23160/1 "2019-09-04T12:41:59Z")

</div>

#### Please follow the below template, it will help us to help you!

## Expected Behaviour:

Allow ports 80 and 443 only for the PiHole Management interface.  
I would also like to keep the current iptables configuration that timeouts connection to speed up the process of ad blocking

```auto
cat /etc/iptables/rules.v4
# Generated by iptables-save v1.6.0 on Fri Sep 7 08:54:11 2018
*filter
:INPUT ACCEPT [8:512]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [6:1008]
-A INPUT -p tcp -m tcp --dport 443 -j REJECT --reject-with tcp-reset
-A INPUT -p udp -m udp --dport 80 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p udp -m udp --dport 443 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m tcp --dport 443 -j REJECT --reject-with tcp-reset
-A INPUT -p udp -m udp --dport 80 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p udp -m udp --dport 443 -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Fri Sep 7 08:54:11 2018

```

## Actual Behaviour:

I have setup my SSL certificate under lighttpd.conf. If I clear the iptables I am able to connect with https.  
But I don't really like the idea of clearing the iptables.

How can I keep the existing iptables but also allow 80,443 for the pi hole interface?

_/moderator (@mibere) edit: public debug token output removed_

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [September 4, 2019, 1:07pm UTC](https://discourse.pi-hole.net/t/ip-tables-allow-80-and-443-only-for-management/23160/3 "2019-09-04T13:07:33Z")

</div>

If you're serving your own content on 80 and 443 then you don't need iptables to block access to those ports.

---

<div class="post-metadata">

**Author:** ![Bobbys](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/b/a9a28c/32.png) [@Bobbys](https://discourse.pi-hole.net/u/Bobbys)\
**Post date:** [September 4, 2019, 1:15pm UTC](https://discourse.pi-hole.net/t/ip-tables-allow-80-and-443-only-for-management/23160/4 "2019-09-04T13:15:22Z")

</div>

The iptables you see there are by default.

[Check Section 2](https://discourse.pi-hole.net/t/why-do-some-sites-take-forever-to-load-when-using-pi-hole-for-versions-v4-0/3654)

I don't want to brake anything, since PiHole works fine over the last year

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [September 4, 2019, 1:17pm UTC](https://discourse.pi-hole.net/t/ip-tables-allow-80-and-443-only-for-management/23160/5 "2019-09-04T13:17:11Z")

</div>

Yes, I am familiar with the iptables rules. iptables will only open or close ports. If you want to have content served via 80 or 443 then you can not block those ports with iptables.

---

<div class="post-metadata">

**Author:** ![Bobbys](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/b/a9a28c/32.png) [@Bobbys](https://discourse.pi-hole.net/u/Bobbys)\
**Post date:** [September 4, 2019, 1:31pm UTC](https://discourse.pi-hole.net/t/ip-tables-allow-80-and-443-only-for-management/23160/6 "2019-09-04T13:31:19Z")

</div>

From what I understand, the iptables that are listed there have nothing to do with PiHole's functionality. Therefore I have flushed the iptables and added the following:

```auto
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -j ACCEPT
-A INPUT -p tcp -j DROP

```

Can you please confirm?

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [September 25, 2019, 1:41pm UTC](https://discourse.pi-hole.net/t/ip-tables-allow-80-and-443-only-for-management/23160/7 "2019-09-25T13:41:02Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.