My application server is on a network protected by a organization wide firewall, and my server is also using fail2ban.  That said, I'd like to set up an additional layer of protection with iptables.  I'm having a little trouble with my configuration - specifically accessing external content from the application server.Requirements:Deny access to everyone, then allow to a specific IP range (4.3.2.*)  Ability to retrieve external content from application serverKnowns:The application server IP is 1.2.3.4My laptop's static IP is 4.3.2.1What I've tried:Starting with a vanilla iptables config that allows traffic over ports 22, 80 and 443, I added the following.# allow traffic from a specific IP rangeiptables -A INPUT -s 4.3.2.0/24 -j ACCEPT# allow traffic over LDAP portiptables -A INPUT -p tcp --dport 636 -j ACCEPT# keep existing trafficiptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT# deny all trafficiptables --policy INPUT DROPI save that config using service iptables save, then restart the service. Here is iptables -L -v -n --line-numbersChain INPUT (policy DROP 461 packets, 81259 bytes)num   pkts bytes target     prot opt in     out     source               destination         1    11835 1095K fail2ban-SSH  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22 2    2972K 1083M ACCEPT     all  --  *      *       4.3.2.0/24           0.0.0.0/0           3        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:636 4    3747K  436M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)num   pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy ACCEPT 89676 packets, 26M bytes)num   pkts bytes target     prot opt in     out     source               destination         Chain fail2ban-SSH (1 references)num   pkts bytes target     prot opt in     out     source               destination         1    11776 1092K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0       Problem:I'm unable to access external content with the ruleset above.  The default OUTPUT policy is ACCEPT, so I'm unsure what the problem could be.  I've tested this from the application itself, and from simply going to command and using lynx https://some.site.  If I change the default INPUT policy to ACCEPT, lynx is able to pull up the content.  What about the INPUT policy is preventing the content from loading? 
Unable to access external content with this IPTABLES ruleset
centos;iptables
Got this sorted out - was an easy solution.  I obtain data from a single external sytem (1.1.1.99), but that IP wasn't in my ruleset and was being blocked.So adding this and saving solves the problem:iptables -A INPUT -s 1.1.1.99 -j ACCEPT