Solved

Help configuring IPTABLES

Posted on 2008-10-21
10
317 Views
Last Modified: 2013-12-16
I need some assistance configuring IPTABLES (haven't done it in ages).

I want to restrict all incoming connections on any port to "trusted" IPs.

I will have a local squid server running & want to make sure it isnt wide open... also some other services that I want to filter this way as well.

0
Comment
Question by:mcainc
  • 5
  • 4
10 Comments
 
LVL 9

Expert Comment

by:mgonullu
ID: 22773819
http://www.cae.wisc.edu/iptables-using#examples

Maybe this will be a good memory refreshment
0
 
LVL 29

Expert Comment

by:fosiul01
ID: 22774167
the tutorial mgonullu provided its quite good

basicaly,

start of with block every port ( incomming port)

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
then open one by one as you go and as you need

iptables -A INPUT  -p tcp --dport 22 -j ACCEPT    (ssh)

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


http://www.cyberciti.biz/tips/linux-iptables-6-how-to-block-outgoing-access-to-selectedspecific-ip-address.html
http://www.cyberciti.biz/tips/linux-iptables-4-block-all-incoming-traffic-but-allow-ssh.html
0
 

Author Comment

by:mcainc
ID: 22794046
i've been reading a bit and would like to know if this is valid, i want to allow ssh access & ftp access to my home ip ("ip.ip.ip.ip")

i'm not concerned with blocking the outgoing packets from the server, only preventing what is allowed in

before i run this i want to make sure it is accurate so i dont lock myself out!


# flushing rules

iptables -F
iptables -X

# blocking all ports

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# allowing loopback unrestricted access

iptables -A INPUT -i lo
iptables -A OUTPUT -o lo

# allowing trusted ips appropriate access

iptables -A INPUT -s ip.ip.ip.ip -j ACCEPT
iptables -A OUTPUT -d ip.ip.ip.ip -j ACCEPT

# allow incoming ssh

iptables -A INPUT -p tcp dport 22 -m state state NEW -j ACCEPT

# allow incoming ftp

iptables -A INPUT -p tcp dport 21 -m state state NEW -j ACCEPT

# nothing else gets into this box

iptables -A INPUT -j DROP
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 

Author Comment

by:mcainc
ID: 22794049
hmm, i see some strange characters before -dport & -state... they should be the standard hyphen -
0
 
LVL 29

Expert Comment

by:fosiul01
ID: 22794095
its seems alright to me
but if you see, you system is resonding slowly to ssh connection to be established
then just add this 2 rules

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
0
 
LVL 29

Expert Comment

by:fosiul01
ID: 22794112
I always use this command  to allow any port to come

iptables -A INPUT  -p tcp --dport 22 -j ACCEPT    (ssh)

but you have used this
iptables -A INPUT -p tcp dport 22 -m state state NEW -j ACCEPT


" -m state state " from which reference you got this one ??
0
 

Author Comment

by:mcainc
ID: 22794127
0
 

Author Comment

by:mcainc
ID: 22794156
if i am specifying trusted ip addresses to only be able to access the system, is it even necessary to block ports?

it seems pointless because the ips are trusted... so can this all just be simplified by

# flushing rules

iptables -F
iptables -X

# blocking all ports

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# allowing loopback unrestricted access

iptables -A INPUT -i lo
iptables -A OUTPUT -o lo

# allowing trusted ips appropriate access

iptables -A INPUT -s ip.ip.ip.ip -j ACCEPT
iptables -A OUTPUT -d ip.ip.ip.ip -j ACCEPT

# optimizing

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# nothing else gets into this box

iptables -A INPUT -j DROP
0
 
LVL 29

Accepted Solution

by:
fosiul01 earned 500 total points
ID: 22794219
yes its finej
iptables -F
iptables -X

# blocking all ports

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# allowing loopback unrestricted access

iptables -A INPUT -i lo
iptables -A OUTPUT -o lo

# allowing trusted ips appropriate access

iptables -A INPUT -s ip.ip.ip.ip -j ACCEPT
iptables -A OUTPUT -d ip.ip.ip.ip -j ACCEPT

# optimizing

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# nothing else gets into this box

iptables -A INPUT -j DROP


you just have to add the port such as 22, 80(web site) to allow to your box

thats it
how are you adding this rule ??
just add by hand, one by one command, then test it, if you are happy
then

service iptables save

it will automaticaly save all rules in iptables
0
 

Author Closing Comment

by:mcainc
ID: 31508640
thanks for the help!
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

By the time you finish reading this article, you may have already lost all your money because you don't know the simple steps to securing your BitCoin wallet. BitCoin is an incredible invention. It is a decentralized currency system, which is the…
Ransomware continues to be a growing problem for both personal and business users alike and Antivirus companies are still struggling to find a reliable way to protect you from this dangerous threat.
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…

792 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question