up vote 2 down vote favorite
1
share [g+] share [fb]

This is probably as basic as it gets but I'm a developer and really have no experience with iptbles.

The only connections I need opened are:

eth0 (outward facing)

  1. ssh
  2. ping
  3. SSL to tomcat (forward port 443 to 8443)

eth1(local subnet)

  1. connection to postgres server

Everything else should be blocked. My current attempts seem to be leaving all other ports open. I wonder what gives.

Thanks serverfault!

link|improve this question
feedback

6 Answers

up vote 1 down vote 
# Block incoming on eth0
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 8443 -j ACCEPT

# Block incoming on eth1
iptables -A INPUT -i eth1 -p tcp --dport 5432 -j ACCEPT

# Block everything by default
iptables -j INPUT -i eth0 -j DROP
iptables -j INPUT -i eth1 -j DROP

# NAT
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443

Note: I did what you said, but you may want to allow all icmp packets, they're sometimes useful.

Note 2: I assume "postgres server" is the same host.

link|improve this answer
I think you should add the state rules to track NEW, RELATED and ESTABLILISHED connections on this rules, and redirecting the port for SSL doesn't seem right to me, either run Tomcat on 443 or use something (nginx, pound, apache) to answer the answer the SSL on port 443 and reverse proxy Tomcat. – coredump Sep 12 '10 at 14:26
You might want to add "iptables -A INPUT -i eth0 -p icmp --icmp-type fragmentation-needed -j ACCEPT". – Gerald Combs Sep 12 '10 at 15:34
feedback
up vote 0 down vote

Once you've put those rules in place you either have to put a rule that jumps to REJECT or DROP, or you have to change the chain's default policy (-P).

link|improve this answer
Do you have an example I could look at? Is there an easier way to configure something simple like this on centos? – Paperino May 23 '10 at 5:45
The built-in firewall tool (lokkit, or whatever it's called in 5.x) can set up the simple pass-through rules, and editing the file in /etc/sysconfig will allow you to tweak the rules to add the interface. You'll have to add the port remap rule yourself though. Or you could always try something like fwbuilder if you don't want to deal with the iptables command line. – Ignacio Vazquez-Abrams May 23 '10 at 5:49
feedback
up vote 0 down vote

try the linux program ufw, it makes configuring iptables much easier

link|improve this answer
1  
I think UFW does not work with centOS--only ubuntu. – Paperino May 23 '10 at 16:29
feedback
up vote 0 down vote

We need to know what you already have.

And we aren't going to write out these rules for you. If you want someone to write iptables rules for you, hire a consultant.

So let's see what you have already.

If this is CentOS as I think you are suggesting, you could show us either /etc/sysconfig/iptables, or the output of both

iptables -L -vn

And 

iptables -L -vn -t nat
link|improve this answer
feedback
up vote 0 down vote

Try this site for a clean startup configuration: http://www.mista.nu/iptables/

link|improve this answer
feedback
up vote 0 down vote 
iptables -P INPUT DROP # drop will be default policy
iptables -i eth0 -A INPUT -p tcp --dport 22 -j ACCEPT # ssh
iptables -i eth0 -A INPUT -p tcp --dport 443 -j ACCEPT # delete this if prerouting works
iptables -i eth0 -A INPUT -p tcp --dport 8443 -j ACCEPT # 8443
iptables -i eth0 -A INPUT -p icmp --icmp-type 8 -j ACCEPT # ping
iptables -i eth1 -A INPUT -j ACCEPT # all from eth1

#route port 443 to 8443 from eth0

iptables -t nat -i eth0 -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.