Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm after some help with setting up IPTables. Mostly the configuration is working, but regardless of what I try I cannot allow localhost to access the local Apache only (i.e. localhost to access localhost:80 only).

Here is my script:

#!/bin/bash
# Allow root to access external web and ftp
iptables -t filter -A OUTPUT -p tcp --dport 21 --match owner --uid-owner 0 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 80 --match owner --uid-owner 0 -j ACCEPT

#Allow DNS queries
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT

# Allow in and outbound SSH to/from any server
iptables -A INPUT -p tcp -s 0/0 --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp -d 0/0 --sport 22 -j ACCEPT

# Accept ICMP requests
iptables -A INPUT -p icmp -s 0/0 -j ACCEPT
iptables -A OUTPUT -p icmp -d 0/0 -j ACCEPT

# Accept connections from any local machines but disallow localhost access to networked machines
iptables -A INPUT -s 10.0.1.0/24 -j ACCEPT
iptables -A OUTPUT -d 10.0.1.0/24 -j DROP

# Drop ALL other traffic
iptables -A OUTPUT -p tcp -d 0/0 -j DROP
iptables -A OUTPUT -p udp -d 0/0 -j DROP

Now I have tried many permutations and I'm obviously missing everything. I place them above the in/out bound SSH to/from, so it's not the precedence order.

If someone could give me the heads up on allowing only the local machine to access the local web server, that'd be great.

Also - when the above configuration is running, I can't (from a Windows box) ping the host by name - can by IP. What do I need to allow host resolution?

Cheers guys.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

generic advice - at the beginning of your ruleset add:

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -F

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

after this append your rules. i dont really understand why you want to prevent localhost form accessing something. it'll cause lot of problems.. with dns, mysql and any other local services.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.