If I leave out this line
$IPT -I INPUT -i $WAN_NIC -j ACCEPT
from my firewall script below, then I can't SSH to the server.
The way I understand
$IPT -I INPUT -i $WAN_NIC -j ACCEPT
is that it will allow all traffic from $WAN_NIC and make
$IPT -A INPUT -i $WAN_NIC -p icmp --icmp-type echo-request -j ACCEPT
$IPT -A INPUT -i $WAN_NIC -p tcp --dport ssh -j ACCEPT
$IPT -A INPUT -i $WAN_NIC -p tcp --dport www -j ACCEPT
$IPT -A INPUT -j REJECT
obsolete, which is not what I want.
What I am aiming for is that only SSH, WWW and ping is allowed on WAN_NIC
.
Question
How should the rules look like, if I only want SSH, WWW, and ping on WAN_NIC
?
script
$IPT -F
$IPT -X
# Allow all outgoing
$IPT -P OUTPUT ACCEPT
# Filter rules
$IPT -A INPUT -i lo -j ACCEPT
$IPT -I INPUT -i $WAN_NIC -j ACCEPT
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -i $WAN_NIC -p icmp --icmp-type echo-request -j ACCEPT
$IPT -A INPUT -i $WAN_NIC -p tcp --dport ssh -j ACCEPT
$IPT -A INPUT -i $WAN_NIC -p tcp --dport www -j ACCEPT
$IPT -A INPUT -j REJECT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P INPUT ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
# Masquerade 192.168.245.8 - 192.168.245.255
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -A POSTROUTING -s $CLIENT_NET1 -o $WAN_NIC -j MASQUERADE
$IPT -t nat -A POSTROUTING -s $CLIENT_NET2 -o $WAN_NIC -j MASQUERADE
$IPT -t nat -A POSTROUTING -s $CLIENT_NET3 -o $WAN_NIC -j MASQUERADE
$IPT -t nat -A POSTROUTING -s $CLIENT_NET4 -o $WAN_NIC -j MASQUERADE
$IPT -t nat -A POSTROUTING -s $CLIENT_NET5 -o $WAN_NIC -j MASQUERADE
# Allow only IPs from LAN_NET to connect to LAN_NIC
$IPT -A FORWARD -i $LAN_NIC ! -s $LAN_NET -j DROP
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Forward 192.168.245.8 - 192.168.245.255. The first 7 IPs are reserved for failover etc
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET1 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET2 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET3 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET4 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET5 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -j REJECT
Update
Added my nat rules and the following output from iptables, when I can't SSH.
root@ts:~# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- 192.168.245.0/24 anywhere
ACCEPT all -- linuxterm2.local anywhere
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:www
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain FORWARD (policy DROP)
target prot opt source destination
DROP all -- !192.168.245.0/24 anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- 192.168.245.128/25 anywhere state NEW
ACCEPT all -- 192.168.245.64/26 anywhere state NEW
ACCEPT all -- 192.168.245.32/27 anywhere state NEW
ACCEPT all -- 192.168.245.16/28 anywhere state NEW
ACCEPT all -- 192.168.245.8/29 anywhere state NEW
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
root@ts:~#
iptables -L -n -v
, otherwise we can't see what interface a particular rule applies to.