Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm reading examples for iptables, and I've got a pre-written file I'm using for the server that meets most of my needs. The format it uses to accept traffic on port 80 (for apache) is:

-A INPUT -p tcp --dport 80 -j ACCEPT

Another webpage I've read uses the following format to accept traffic for SMTP

-A INPUT -p tcp -s 0/0 --sport 1024:65535 -d server.ip.address.here --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT

Which seems a lot more complex? Is it necessary, or could I simply do:

-A INPUT -p tcp --dport 25 -j ACCEPT
share|improve this question

1 Answer 1

up vote 2 down vote accepted

This rule is more specific, thus theorically allowing less connections :

-A INPUT -p tcp -s 0/0 --sport 1024:65535 -d server.ip.address.here --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT

With this rule the connection needs to be initiated by a client (port>=1024), on a specific IP (therefore a single interface), and the client can only initiate a new connection or use an already established one.

But this simpler rule, since less specific, allow any kind of connection, from any port, to any interface on the port 25.

-A INPUT -p tcp --dport 25 -j ACCEPT

Keep in mind that if you do not reinforce your firewall by using specific DROP rules, or iptables' policies (-P) to DROP all packets that aren't explicitely allowed, any ACCEPT rule will be useless.

share|improve this answer
    
The basic IP tables ruleset I'm using denies anything not explicitly allowed so I think I'm okay on the DROP rules. You'd recommend the more specific rule, I'm assuming? –  ESW Jun 24 '10 at 10:00
    
Well that depends on whether your server is really "at risk" or not. But let's face it, the specific rule isn't that complicated :p So yes, I would recommend it instead of the simpler one :-) –  Nicolas Bazire Jun 24 '10 at 15:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.