Solved

Help configuring IPTABLES

Posted on 2008-10-21
10
314 Views
Last Modified: 2013-12-16
I need some assistance configuring IPTABLES (haven't done it in ages).

I want to restrict all incoming connections on any port to "trusted" IPs.

I will have a local squid server running & want to make sure it isnt wide open... also some other services that I want to filter this way as well.

0
Comment
Question by:mcainc
  • 5
  • 4
10 Comments
 
LVL 9

Expert Comment

by:mgonullu
ID: 22773819
http://www.cae.wisc.edu/iptables-using#examples

Maybe this will be a good memory refreshment
0
 
LVL 29

Expert Comment

by:fosiul01
ID: 22774167
the tutorial mgonullu provided its quite good

basicaly,

start of with block every port ( incomming port)

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
then open one by one as you go and as you need

iptables -A INPUT  -p tcp --dport 22 -j ACCEPT    (ssh)

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


http://www.cyberciti.biz/tips/linux-iptables-6-how-to-block-outgoing-access-to-selectedspecific-ip-address.html
http://www.cyberciti.biz/tips/linux-iptables-4-block-all-incoming-traffic-but-allow-ssh.html
0
 

Author Comment

by:mcainc
ID: 22794046
i've been reading a bit and would like to know if this is valid, i want to allow ssh access & ftp access to my home ip ("ip.ip.ip.ip")

i'm not concerned with blocking the outgoing packets from the server, only preventing what is allowed in

before i run this i want to make sure it is accurate so i dont lock myself out!


# flushing rules

iptables -F
iptables -X

# blocking all ports

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# allowing loopback unrestricted access

iptables -A INPUT -i lo
iptables -A OUTPUT -o lo

# allowing trusted ips appropriate access

iptables -A INPUT -s ip.ip.ip.ip -j ACCEPT
iptables -A OUTPUT -d ip.ip.ip.ip -j ACCEPT

# allow incoming ssh

iptables -A INPUT -p tcp dport 22 -m state state NEW -j ACCEPT

# allow incoming ftp

iptables -A INPUT -p tcp dport 21 -m state state NEW -j ACCEPT

# nothing else gets into this box

iptables -A INPUT -j DROP
0
 

Author Comment

by:mcainc
ID: 22794049
hmm, i see some strange characters before -dport & -state... they should be the standard hyphen -
0
 
LVL 29

Expert Comment

by:fosiul01
ID: 22794095
its seems alright to me
but if you see, you system is resonding slowly to ssh connection to be established
then just add this 2 rules

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
0
Network it in WD Red

There's an industry-leading WD Red drive for every compatible NAS system to help fulfill your data storage needs. With drives up to 8TB, WD Red offers a wide array of solutions for customers looking to build the biggest, best-performing NAS storage solution.  

 
LVL 29

Expert Comment

by:fosiul01
ID: 22794112
I always use this command  to allow any port to come

iptables -A INPUT  -p tcp --dport 22 -j ACCEPT    (ssh)

but you have used this
iptables -A INPUT -p tcp dport 22 -m state state NEW -j ACCEPT


" -m state state " from which reference you got this one ??
0
 

Author Comment

by:mcainc
ID: 22794127
0
 

Author Comment

by:mcainc
ID: 22794156
if i am specifying trusted ip addresses to only be able to access the system, is it even necessary to block ports?

it seems pointless because the ips are trusted... so can this all just be simplified by

# flushing rules

iptables -F
iptables -X

# blocking all ports

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# allowing loopback unrestricted access

iptables -A INPUT -i lo
iptables -A OUTPUT -o lo

# allowing trusted ips appropriate access

iptables -A INPUT -s ip.ip.ip.ip -j ACCEPT
iptables -A OUTPUT -d ip.ip.ip.ip -j ACCEPT

# optimizing

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# nothing else gets into this box

iptables -A INPUT -j DROP
0
 
LVL 29

Accepted Solution

by:
fosiul01 earned 500 total points
ID: 22794219
yes its finej
iptables -F
iptables -X

# blocking all ports

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# allowing loopback unrestricted access

iptables -A INPUT -i lo
iptables -A OUTPUT -o lo

# allowing trusted ips appropriate access

iptables -A INPUT -s ip.ip.ip.ip -j ACCEPT
iptables -A OUTPUT -d ip.ip.ip.ip -j ACCEPT

# optimizing

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# nothing else gets into this box

iptables -A INPUT -j DROP


you just have to add the port such as 22, 80(web site) to allow to your box

thats it
how are you adding this rule ??
just add by hand, one by one command, then test it, if you are happy
then

service iptables save

it will automaticaly save all rules in iptables
0
 

Author Closing Comment

by:mcainc
ID: 31508640
thanks for the help!
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

UPDATE - 6/15/2011 Added support for Release Update 6 Maintenance Patch 2 Point Patch 1 (RU6 MP2 PP1). Fixed a defect in the username field that was hard-coded to look for a specific domain (left over code from testing). This release will be the …
I. Introduction There's an interesting discussion going on now in an Experts Exchange Group — Attachments with no extension (http://www.experts-exchange.com/discussions/210281/Attachments-with-no-extension.html). This reminded me of questions tha…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now