0

If I leave out this line

    $IPT -I INPUT -i $WAN_NIC -j ACCEPT

from my firewall script below, then I can't SSH to the server.

The way I understand

    $IPT -I INPUT -i $WAN_NIC -j ACCEPT

is that it will allow all traffic from $WAN_NIC and make

$IPT -A INPUT -i $WAN_NIC -p icmp --icmp-type echo-request -j ACCEPT
$IPT -A INPUT -i $WAN_NIC -p tcp --dport ssh -j ACCEPT
$IPT -A INPUT -i $WAN_NIC -p tcp --dport www -j ACCEPT
$IPT -A INPUT -j REJECT

obsolete, which is not what I want.

What I am aiming for is that only SSH, WWW and ping is allowed on WAN_NIC.

Question

How should the rules look like, if I only want SSH, WWW, and ping on WAN_NIC?

script

$IPT -F
$IPT -X

# Allow all outgoing
$IPT -P OUTPUT ACCEPT

# Filter rules
$IPT -A INPUT -i lo -j ACCEPT
$IPT -I INPUT -i $WAN_NIC -j ACCEPT
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A INPUT -i $WAN_NIC -p icmp --icmp-type echo-request -j ACCEPT
$IPT -A INPUT -i $WAN_NIC -p tcp --dport ssh -j ACCEPT
$IPT -A INPUT -i $WAN_NIC -p tcp --dport www -j ACCEPT
$IPT -A INPUT -j REJECT

$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P INPUT ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

# Masquerade 192.168.245.8 - 192.168.245.255
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -A POSTROUTING -s $CLIENT_NET1 -o $WAN_NIC -j MASQUERADE
$IPT -t nat -A POSTROUTING -s $CLIENT_NET2 -o $WAN_NIC -j MASQUERADE
$IPT -t nat -A POSTROUTING -s $CLIENT_NET3 -o $WAN_NIC -j MASQUERADE
$IPT -t nat -A POSTROUTING -s $CLIENT_NET4 -o $WAN_NIC -j MASQUERADE
$IPT -t nat -A POSTROUTING -s $CLIENT_NET5 -o $WAN_NIC -j MASQUERADE

# Allow only IPs from LAN_NET to connect to LAN_NIC
$IPT -A FORWARD -i $LAN_NIC ! -s $LAN_NET -j DROP
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Forward 192.168.245.8 - 192.168.245.255. The first 7 IPs are reserved for failover etc
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET1 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET2 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET3 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET4 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET5 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -j REJECT

Update

Added my nat rules and the following output from iptables, when I can't SSH.

root@ts:~# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  192.168.245.0/24     anywhere            
ACCEPT     all  --  linuxterm2.local     anywhere            
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DROP       all  -- !192.168.245.0/24     anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  192.168.245.128/25   anywhere            state NEW 
ACCEPT     all  --  192.168.245.64/26    anywhere            state NEW 
ACCEPT     all  --  192.168.245.32/27    anywhere            state NEW 
ACCEPT     all  --  192.168.245.16/28    anywhere            state NEW 
ACCEPT     all  --  192.168.245.8/29     anywhere            state NEW 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
root@ts:~# 
2
  • 1
    Please when listing rules use iptables -L -n -v, otherwise we can't see what interface a particular rule applies to.
    – MadHatter
    Oct 31, 2011 at 11:34
  • @MadHatter Thanks a lot. Very useful command! I'll do that from now on. I just found the problem, so I posted the solution.
    – Sandra
    Oct 31, 2011 at 11:59

2 Answers 2

2

Your rules may be ordered incorrectly; if you are not using a default policy (why not?) then order matters.

Show what iptables -L outputs.

If you set a default policy of REJECT on the WAN interface, then you only need the rules for those 3 protocols, and the ESTABLISHED rule to allow responses to outgoing traffic.

Of course, if you have NAT rules, most of this goes out the window.

1
  • I have infact NAT rules, but I didn't think that would make a difference, so I left them out. They are now added aswell as iptables -L when I can't SSH.
    – Sandra
    Oct 31, 2011 at 11:33
0

Problem found.

$IPT -A INPUT -j REJECT

should be

$IPT -i $WAN_NIC -A INPUT -j ACCEPT

or left completely out, as I start off by dropping everything, so REJECT have no effect.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .