2

I have a riak cluster that I need to only allow certain IP addresses access to the information. I am currently using, -A INPUT -s 192.168.10.200 -j ACCEPT, to allow this IP address and at the bottom of my rules I have -A INPUT -j REJECT and -A FORWARD -j REJECT, to reject other traffic. Can anyone advise where I am going wrong? Thanks!

The full rules:

-A INPUT -s 192.168.1.181 -j ACCEPT
-I INPUT -p tcp --dport 8098 -j ACCEPT
-I INPUT -p tcp --dport 8099 -j ACCEPT
-I INPUT -p tcp --dport 4369 -j ACCEPT
-I INPUT -p tcp --dport 5678:5679 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 2500 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j REJECT -A FORWARD -j REJECT

3 Answers 3

2

Netfilter has 5 main Chains. You can ignore PREROUTING and POSTROUTING for now, so the 3 you need to manipulate are INPUT, FORWARD and OUTPUT.

INPUT and OUTPUT control the traffic directed to the system itself, while FORWARD controls the traffic that passes through and is directed to another machine (the case of a gateway).

In your case, if you want to allow external users to connect to the system itself, you need the following set of rules:

# Rule 1: accept packets from established connections to enter and leave the system
iptables -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p udp -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp -m state --state ESTABLISHED -j ACCEPT

# Rule 2: accept new connections entering the system
iptables -A INPUT -i eth0 -p tcp -s 192.168.10.200 -m state --state NEW -j ACCEPT 



# Rule 3: block all connections entering and leaving the system (if not previously accepted)
iptables -A INPUT -i eth0 -j DROP

# note: only use the filtering on output if you want to control outgoing connection
# if you want to let all connections leave your system, just comment this out
iptables -A OUTPUT -o eth0 -j DROP 

Rules 1 and 3 are general, Rule 2 is connection specific. Just use that sample and add new Rule 2 when you need new connections.

If you want something more solid, take a look at this: http://1nw.eu/!MJ

6
  • I'm not sure my question was too clear...the iptable rules i have in place now still allows all ip address connections. How do I only allow certain ip addresses to access my server information with iptables? Thank you for your help. Feb 22, 2011 at 16:46
  • the set of rules I put above blocks all incoming and outgoing connections unless explicitely listed, which is what you are asking for. What do you call your 'server information' ? Feb 22, 2011 at 16:55
  • I am working on a riak node, and I currently can access a "buckets" information via the browser, which I am trying to prevent access from all ip addresses but what i specify. Thanks for your help. Feb 22, 2011 at 17:03
  • so use my ruleset above and add as many "rule 2" as you need, specifying the source IP everytime. Feb 22, 2011 at 17:22
  • I have used the rules you provides and it is still allowing all ip address access via the browser...not sure where I am going wrong. Feb 22, 2011 at 19:27
1

It is not enough to allow the incoming traffic using: -A INPUT -s 192.168.10.200, or forwarded traffic using: -A INPUT -s 192.168.10.200. You are missing the related traffic. You need to add:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

INPUT should be used for traffic destined to the firewall itself. FORWARD should be used for traffic destined to other machines. Also, make sure to enable IP forwarding in this case.

4
  • I have -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT in my table but it is still not working. Feb 22, 2011 at 15:20
  • -A INPUT -s 192.168.1.181 -j ACCEPT -I INPUT -p tcp --dport 8098 -j ACCEPT -I INPUT -p tcp --dport 8099 -j ACCEPT -I INPUT -p tcp --dport 4369 -j ACCEPT -I INPUT -p tcp --dport 5678:5679 -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A OUTPUT -j ACCEPT -A INPUT -p tcp -m state --state NEW --dport 2500 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 -A INPUT -j REJECT -A FORWARD -j REJECT Feb 22, 2011 at 15:31
  • Above is a copy of my iptalbe rules Feb 22, 2011 at 15:32
  • 1
    You can edit your question instead of adding more comments!
    – Khaled
    Feb 22, 2011 at 16:38
1

Okay, I've read your complete rules.

One important thing first: Please don't mix -A with -I.

  • -A appends rules to the end of the chain
  • -I inserts rules into the chain (if the position is not specified, it's inserted in the first place)

So, your iptables rules are actually:

-A INPUT -p tcp --dport 5678:5679 -j ACCEPT
-A INPUT -p tcp --dport 4369 -j ACCEPT
-A INPUT -p tcp --dport 8099 -j ACCEPT
-A INPUT -p tcp --dport 8098 -j ACCEPT
-A INPUT -s 192.168.1.181 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 2500 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j REJECT
-A FORWARD -j REJECT
-A OUTPUT -j ACCEPT

As you can see, the INPUT rules #1 through #4 does not limit any source address.

Now if you really want to limit access to those ports to 192.168.1.181, you'll have to do it like this:

# Established connections should just pass
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Loopbacks will not match 192.168.1.181, so we ACCEPT them here
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
# Other than 192.168.1.181, we reject
-A INPUT -s 192.168.1.181 -j in_allow
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j REJECT
# Allow only the following ports
-A in_allow -p tcp --dport 5678:5679 -j ACCEPT
-A in_allow -p tcp --dport 4369 -j ACCEPT
-A in_allow -p tcp --dport 8099 -j ACCEPT
-A in_allow -p tcp --dport 8098 -j ACCEPT
-A in_allow -p tcp -m state --state NEW --dport 2500 -j ACCEPT
-A in_allow -p icmp -m icmp --icmp-type 8 -j ACCEPT
#
-A FORWARD -j REJECT
-A OUTPUT -j ACCEPT

Only one question: why the -m state --state NEW for --dport 2500?

Important note: Don't forget to first FLUSH and ERASE the whole iptables rules before applying the above.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .