Newbie here. I've found the following rules to set a firewall, (from the book how Linux works)
iptables -P INPUT DROP # the default policy
iptables -A INPUT -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp '!' --syn -j ACCEPT # accepting incoming
connections from everywhere except those initiating a connection hence syn
So far so good (or it seems to be). The trouble comes when I try to add a rule for DNS, here's what I have tried and didn't seem to get it right(one at a time):
INPUT -p udp --dport 53 --sport 1024:65535 -j ACCEPT
iptables -A INPUT -p udp --source-port 53 -s 127.0.1.1 -j ACCEPT
iptables -A INPUT -p udp --source-port 53 -j ACCEPT
Desired result: Preventing any initialization of connections from outside (ssh, icmtp, ... ), enabling DNS lookup and web browsing (curl, wget, telnet ...), I don't think it is relevant that I may locally run a web server or a database server ...
Any help would be appreciated.
2 Answers
I suggest you create some Input rule that allows all established and related traffic like:
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Also you should always allow your loopback-device:
# Allow loopback interface to do anything. $IPTABLES -A INPUT -i lo -j ACCEPT $IPTABLES -A OUTPUT -o lo -j ACCEPT
If your default output policy is accept, most problems should be gone. Otherwise you should also add:
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
and open the ports for HTTP(s), DNS, ICMP or whatever you need.
Allowing Established Sessions We can allow established sessions to receive traffic:
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
If the line above doesn't work, you may be on a castrated VPS whose provider has not made available the extension, in which case an inferior version can be used as last resort:
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Allowing Incoming Traffic on Specific Ports
sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT
Blocking Traffic
sudo iptables -A INPUT -j DROP
Enabling loopback by editing iptables :
sudo iptables -I INPUT 1 -i lo -j ACCEPT
Logging of unwanted traffic:
sudo iptables -I INPUT 4 -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
To confirm that changes have been successfully made:
iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
LOG all -- anywhere anywhere limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
DROP all -- anywhere anywhere
Use iptables -L -v to get more details :
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo any anywhere anywhere
0 0 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 LOG all -- any any anywhere anywhere limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
0 0 DROP all -- any any anywhere anywhere
Empty iptables:
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
Saving iptables
If you were to reboot your machine right now, your iptables configuration would disappear. Rather than type this each time you reboot, however, you can save the configuration, and have it start up automatically.
Save your firewall rules to a file
sudo sh -c "iptables-save > /etc/iptables.rules"
The script /etc/network/if-pre-up.d/iptablesload will contain:
#!/bin/sh
iptables-restore < /etc/iptables.rules
exit 0
and /etc/network/if-post-down.d/iptablessave will contain:
#!/bin/sh
iptables-save -c > /etc/iptables.rules
if [ -f /etc/iptables.downrules ]; then
iptables-restore < /etc/iptables.downrules
fi
exit 0
Then be sure to give both scripts execute permissions:
sudo chmod +x /etc/network/if-post-down.d/iptablessave
sudo chmod +x /etc/network/if-pre-up.d/iptablesload
