Many "connection reset" when iptables enabled.

[Steven Stern]

I've configured my system using system-config-firewall and have all
sorts of problems accessing Google and Facebook, often resulting in
either a hung page load or a connect reset message from Firefox. When I
turn off iptables, there are no problems.  What's wrong with my setup?


# Configuration file for system-config-firewall

--enabled
--port=17500:udp
--port=17500:tcp
--port=3689:tcp
--service=dns
--service=mdns
--service=ipp-client
--service=ipp
--service=samba
--service=samba-client
--service=https
--service=ssh
--service=http


# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state
RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            state NEW
tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere            state NEW
udp dpt:domain
ACCEPT     udp  --  anywhere             224.0.0.251         state NEW
udp dpt:mdns
ACCEPT     udp  --  anywhere             anywhere            state NEW
udp dpt:ipp
ACCEPT     tcp  --  anywhere             anywhere            state NEW
tcp dpt:ipp
ACCEPT     udp  --  anywhere             anywhere            state NEW
udp dpt:ipp
ACCEPT     udp  --  anywhere             anywhere            state NEW
udp dpt:netbios-ns
ACCEPT     udp  --  anywhere             anywhere            state NEW
udp dpt:netbios-dgm
ACCEPT     tcp  --  anywhere             anywhere            state NEW
tcp dpt:netbios-ssn
ACCEPT     tcp  --  anywhere             anywhere            state NEW
tcp dpt:microsoft-ds
ACCEPT     udp  --  anywhere             anywhere            state NEW
udp dpt:netbios-ns
ACCEPT     udp  --  anywhere             anywhere            state NEW
udp dpt:netbios-dgm
ACCEPT     tcp  --  anywhere             anywhere            state NEW
tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            state NEW
tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            state NEW
tcp dpt:http
ACCEPT     udp  --  anywhere             anywhere            state NEW
udp dpt:db-lsp-disc
ACCEPT     tcp  --  anywhere             anywhere            state NEW
tcp dpt:db-lsp
ACCEPT     tcp  --  anywhere             anywhere            state NEW
tcp dpt:daap
REJECT     all  --  anywhere             anywhere            reject-with
icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  anywhere             anywhere            reject-with
icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

-- 
-- Steve