Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 280
  • Last Modified:

I'd like to understand this rule.


This rule is correct?
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST -m limit --limit 1/s -j ACCEPT

For what do you use it?

Sorry, I'm starting in Iptables

0
ipsystems
Asked:
ipsystems
1 Solution
 
net_sec_guruCommented:
iptables -A FORWARD (the FORWARD chain) used for ip forwarding / nat'ing

-p tcp (protocol)

--tcp-flags:
Match when the TCP flags are as specified. The first argument is the flags which we should examine, written as a comma-separated list, and the second argument is a comma-separated list of flags which must be set. Flags are: SYN ACK FIN RST URG PSH ALL NONE. Hence the command

iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN - will only match packets with the SYN flag set, and the ACK, FIN and RST flags unset.

-m limit (mark limit)
--limit rate
Maximum average matching rate: specified as a number, with an optional `/second', `/minute', `/hour', or `/day' suffix; the default is 3/hour.

-j ACCEPT (Jump -specifies target of the rule or action to take - in this case accept)

I believe this is correct.
0
 
ipsystemsAuthor Commented:

is this correct?
I need to close ALL ports and open only 25, 80 and 100

the final rule is problematic or can i use it ?  iptables -I INPUT 11 -i eth0 -j DROP

iptables -I INPUT 3 -m unclean -j DROP
iptables -I INPUT 4 -p icmp --icmp-type echo-request -j DROP
iptables -I INPUT 5 -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -I INPUT 6 -p tcp -m limit --limit 1/s -j ACCEPT
iptables -I INPUT 7 -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -I INPUT 8 -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT 9 -i eth0 -p tcp --dport 110 -j ACCEPT
iptables -I INPUT 10 -i eth0 -p tcp --dport 25 -j ACCEPT
iptables -I INPUT 11 -i eth0 -j DROP
0
 
admin0Commented:
For just 25,80 and 100, you can use something like:


iptables -F INPUT
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 100 -j ACCEPT
iptables -A INPUT -j DROP
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Build your data science skills into a career

Are you ready to take your data science career to the next step, or break into data science? With Springboard’s Data Science Career Track, you’ll master data science topics, have personalized career guidance, weekly calls with a data science expert, and a job guarantee.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now