IPTables configuration help

Question

I'm after some help with setting up IPTables. Mostly the configuration is working, but regardless of what I try I cannot allow localhost to access the local Apache only (i.e. localhost to access localhost:80 only).

Here is my script:

#!/bin/bash
# Allow root to access external web and ftp
iptables -t filter -A OUTPUT -p tcp --dport 21 --match owner --uid-owner 0 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 80 --match owner --uid-owner 0 -j ACCEPT

#Allow DNS queries
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT

# Allow in and outbound SSH to/from any server
iptables -A INPUT -p tcp -s 0/0 --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp -d 0/0 --sport 22 -j ACCEPT

# Accept ICMP requests
iptables -A INPUT -p icmp -s 0/0 -j ACCEPT
iptables -A OUTPUT -p icmp -d 0/0 -j ACCEPT

# Accept connections from any local machines but disallow localhost access to networked machines
iptables -A INPUT -s 10.0.1.0/24 -j ACCEPT
iptables -A OUTPUT -d 10.0.1.0/24 -j DROP

# Drop ALL other traffic
iptables -A OUTPUT -p tcp -d 0/0 -j DROP
iptables -A OUTPUT -p udp -d 0/0 -j DROP

Now I have tried many permutations and I'm obviously missing everything. I place them above the in/out bound SSH to/from, so it's not the precedence order.

If someone could give me the heads up on allowing only the local machine to access the local web server, that'd be great.

Also - when the above configuration is running, I can't (from a Windows box) ping the host by name - can by IP. What do I need to allow host resolution?

Cheers guys.

Answer 1

generic advice - at the beginning of your ruleset add:

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -F

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

after this append your rules. i dont really understand why you want to prevent localhost form accessing something. it'll cause lot of problems.. with dns, mysql and any other local services.