Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is probably as basic as it gets but I'm a developer and really have no experience with iptbles.

The only connections I need opened are:

eth0 (outward facing)

  1. ssh
  2. ping
  3. SSL to tomcat (forward port 443 to 8443)

eth1(local subnet)

  1. connection to postgres server

Everything else should be blocked. My current attempts seem to be leaving all other ports open. I wonder what gives.

Thanks serverfault!

share|improve this question

6 Answers 6

Once you've put those rules in place you either have to put a rule that jumps to REJECT or DROP, or you have to change the chain's default policy (-P).

share|improve this answer
    
Do you have an example I could look at? Is there an easier way to configure something simple like this on centos? –  devnull May 23 '10 at 5:45
    
The built-in firewall tool (lokkit, or whatever it's called in 5.x) can set up the simple pass-through rules, and editing the file in /etc/sysconfig will allow you to tweak the rules to add the interface. You'll have to add the port remap rule yourself though. Or you could always try something like fwbuilder if you don't want to deal with the iptables command line. –  Ignacio Vazquez-Abrams May 23 '10 at 5:49

try the linux program ufw, it makes configuring iptables much easier

share|improve this answer
1  
I think UFW does not work with centOS--only ubuntu. –  devnull May 23 '10 at 16:29

We need to know what you already have.

And we aren't going to write out these rules for you. If you want someone to write iptables rules for you, hire a consultant.

So let's see what you have already.

If this is CentOS as I think you are suggesting, you could show us either /etc/sysconfig/iptables, or the output of both

iptables -L -vn

And

iptables -L -vn -t nat
share|improve this answer

Try this site for a clean startup configuration: http://www.mista.nu/iptables/

share|improve this answer
# Block incoming on eth0
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 8443 -j ACCEPT

# Block incoming on eth1
iptables -A INPUT -i eth1 -p tcp --dport 5432 -j ACCEPT

# Block everything by default
iptables -j INPUT -i eth0 -j DROP
iptables -j INPUT -i eth1 -j DROP

# NAT
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443

Note: I did what you said, but you may want to allow all icmp packets, they're sometimes useful.

Note 2: I assume "postgres server" is the same host.

share|improve this answer
    
I think you should add the state rules to track NEW, RELATED and ESTABLILISHED connections on this rules, and redirecting the port for SSL doesn't seem right to me, either run Tomcat on 443 or use something (nginx, pound, apache) to answer the answer the SSL on port 443 and reverse proxy Tomcat. –  coredump Sep 12 '10 at 14:26
    
You might want to add "iptables -A INPUT -i eth0 -p icmp --icmp-type fragmentation-needed -j ACCEPT". –  Gerald Combs Sep 12 '10 at 15:34
iptables -P INPUT DROP # drop will be default policy
iptables -i eth0 -A INPUT -p tcp --dport 22 -j ACCEPT # ssh
iptables -i eth0 -A INPUT -p tcp --dport 443 -j ACCEPT # delete this if prerouting works
iptables -i eth0 -A INPUT -p tcp --dport 8443 -j ACCEPT # 8443
iptables -i eth0 -A INPUT -p icmp --icmp-type 8 -j ACCEPT # ping
iptables -i eth1 -A INPUT -j ACCEPT # all from eth1

#route port 443 to 8443 from eth0

iptables -t nat -i eth0 -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443 
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.