Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to setup generic iptables rules that I can distribute to my little 4 node cluster.

I want all servers to:

  1. accept any traffic on ports 22,80,443

  2. or all traffic if the source is 127.0.0.1

  3. or all traffic is the source is one of the servers in my cluster

  4. anything else I want dropped


iptables -F
iptables -A INPUT -p all -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p all -s <SERVER-A> -j ACCEPT
iptables -A INPUT -p all -s <SERVER-B> -j ACCEPT
iptables -A INPUT -p all -s <SERVER-C> -j ACCEPT
iptables -A INPUT -p all -s <SERVER-D> -j ACCEPT
iptables -A INPUT -j DROP

Does this look correct?

share|improve this question

3 Answers 3

up vote 1 down vote accepted
  1. Get rid of the final rule and make default policy DROP (iptables -P INPUT DROP)
  2. This ruleset won't handle the return packets from outgoing connections; add iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT at the top (unless you want to not allow outgoing connections, in which case some OUTPUT rules would make that clearer).
  3. Make the FORWARD chain policy DROP, just in case someone fat-fingers /proc/sys/net/ipv4/ip_forward.
share|improve this answer
    
Thankyou for the reply! 2 questions: I'm not sure how to make the default policy DROP like you mentioned. Also iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT doens't seem to work for me, I get this error message: "iptables: No chain/target/match by that name" –  rizen Jan 15 '10 at 0:28
    
I've added the command you need to set the policy to my answer; I don't know why the ESTABLISHED,RELATED command isn't working for you, it works fine for me. Double check you haven't typo'd it. –  womble Jan 15 '10 at 0:42
    
womble- i figured out it wasn't working because I'm trying to run it in an openvz container. when I run it on physical HW it works like a charm. Thanks again!! –  rizen Jan 15 '10 at 0:55

I would heartily recommend using a wrapper around IPtables. On its own it gets quite ugly past the simple rules that you need.

We use FireHOL with good results - there are Debian/Ubuntu packages in the default distro, and RHEL/CentOS ones via RPMForge (iirc).

A firehol config for the rules you describe would be along the lines of:

my_ips="<your server list>"
interface any world 
        protection strong 100/sec 50
        policy drop
        server ident reject with tcp-reset
        server ssh accept
        server http accept
        server https accept
        server all accept src "$my_ips"

It's not much harder to create full router rules too - the above example is for a local (non-routing) firewall, as you describe in your question.

FireHOL, and other IPtables wrappers, also tend to add (or make it easy to add) sensible defaults to your firewall rules that will filter known-bad packets - for example the 'protection' line above, which winds up creating many (10+) useful iptables rules.

Another reason I prefer FireHOL is that the configuration file is still just a bash script, allowing the full flexibility of any IPtables shell script that you'd otherwise end up writing.

share|improve this answer

For your last rule. It would be more internet friendly to REJECT the packet, rather than drop. Something such as...

iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.