Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to block all subnets outside the US. I've made a script that has all of the US subnets in it. I want to disallow or DROP all but my list. Can someone give me an example of how I can start by denying everything?


This is the output from -L

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp state NEW
DROP       icmp --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

And these are the rules

iptables --F
iptables --policy INPUT DROP
iptables --policy FORWARD DROP
iptables --policy OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 21 -m state --state NEW -j ACCEPT
iptables -A INPUT -p icmp -j DROP

Just for clarity, with these rules, I can still connect to port 21 without my subnet list. I want to block ALL subnets and just open those inside the US.

share|improve this question
add comment

4 Answers

Set your default policy to DROP, then add ACCEPT rules for all the US-based subnets.

Something like:

iptables -P INPUT DROP
iptables -A INPUT --src 1.2.3.4/24 -j ACCEPT
iptables -A INPUT --src 4.5.6.7/12 -j ACCEPT
iptables -A INPUT --src 8.9.1.2/31 -j ACCEPT
...
share|improve this answer
    
Thanks davr. I already have iptables -P INPUT DROP defined as my first rule however, without my implemented list, I can still connect. Wouldn't this indicate that anyone can connect from any subnet? –  Jim Mar 16 '10 at 4:07
    
Actually, my first rule is to flush the rules and then iptables -P INPUT DROP is listed second. –  Jim Mar 16 '10 at 4:10
    
Something's wrong with your rules. If you want help, post your iptables -L -n and iptables -t nat -L -n as well as the script that's specifying them. davr's recommendation is correct. –  Warner Mar 16 '10 at 4:17
    
Ok, will do.. Thanks. I'll post it up top. –  Jim Mar 16 '10 at 4:20
2  
People are voting up this answer but nobody is looking at my rules and telling me where I'm going wrong. If this is the right answer, tell me how to implement it so that it actually works. –  Jim Mar 16 '10 at 4:50
show 3 more comments

If the packet matches an 'ACCEPT' it is immediately accepted. If it matches a DROP it is immediately dropped.

It sounds like you want only hosts in the US to be able to make a connection to ftp. There are several ways you can accomplish this.


Make lots of complex rules like this.

iptables -P INPUT DROP
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT --src 1.2.3.4/24 -p tcp -i eth0 --dport 21 -m state --state NEW -j ACCEPT
iptables -A INPUT --src 4.5.6.7/12 -p tcp -i eth0 --dport 21 -m state --state NEW -j ACCEPT
iptables -A INPUT --src 8.9.1.2/31 -p tcp -i eth0 --dport 21 -m state --state NEW -j ACCEPT

Create a new chain, send all the traffic to the chain, use a RETURN for all US subnets and have your final rule in the chain DROP everything else. This should the better method since less checking of conditions will be done.

iptables -P INPUT DROP
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -N USNETS
iptables -A USNETS -s 1.2.3.4/24 -j RETURN
iptables -A USNETS -s 4.5.6.7/12 -j RETURN
iptables -A USNETS -s 8.9.1.2/31 -j RETURN
iptables -A USNETS -j DROP # drop everything that isnt in USNETS
iptables -A INPUT -j USNETS # send everything to USNETS
# PERMIT traffic that
iptables -A INPUT -p tcp -i eth0 --dport 21 -m state --state NEW -j ACCEPT

By using a separate change you can even add/remove things from the USNETS chain without resetting the entire firewall as new address space is allocated. I do seriously question if this idea is worth the effort. People outside will be able to get in, they will just use a proxy.


You could even do it the other way around and do all the port/service in the chain.

iptables -P INPUT DROP
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -N SRVCS
iptables -A SRVCS -p tcp -i eth0 --dport 21 -m state --state NEW -j RETURN
iptables -A SRVCS -j DROP # drop everything that isnt in allowed SRVCS
iptables -A INPUT -j SRVCS # send everything to SRVCS
# PERMIT traffic that has been returned from SRVCS
iptables -A INPUT --src 1.2.3.4/24 -j ACCEPT
iptables -A INPUT --src 4.5.6.7/12 -j ACCEPT
iptables -A INPUT --src 8.9.1.2/31 -j ACCEPT
share|improve this answer
add comment

I am the OP (Jim) and I came back to this thread to see if there were any new answers. I also came back to personally thank Zoredache for all of his help and the effort that he put into his answer. I have been around a UNIX environment for many, many years and have little to no experience with "Linux" packet filters but I knew that davr and Warner were incorrect and just concluded after all the time that I waited for them to come back and redeem themselves, that they didn't know what the right answer was.

So, thank you Zoredache again for all of your help! I tend to agree with you about blocking all countries in that it is not worth it; they can just proxy in if they want too.

share|improve this answer
add comment

If you, however, decide to make huge sets for blocking you should look into ipset which can handle very big lists at very fast speeds.

With ipset you can have a single iptable rule acting on one set. No need for rules for every subnet.

However, there is no support in the mainstream kernel for ipset. You need to compile the module yourself. Instructions can be found at the ipset site.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.