Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Here's the iptables script:

echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

iptables -F
iptables -X
iptables -Z

iptables -P INPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -N TCPIN
iptables -N UDPIN
iptables -N TCPOUT
iptables -N UDPOUT
iptables -N VALIDTCP
iptables -N LOGDROP

iptables -A INPUT -p tcp -j VALIDTCP
iptables -A INPUT -p tcp -j TCPIN
iptables -A INPUT -p udp -j UDPIN
iptables -A OUTPUT -p tcp -j VALIDTCP
iptables -A OUTPUT -p tcp -j TCPOUT
iptables -A OUTPUT -p udp -j UDPOUT

iptables -A TCPIN -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A TCPIN -p tcp -m state --state NEW --dport 2122 -j ACCEPT
iptables -A TCPIN -p tcp -m state --state NEW --dport 80 -j ACCEPT
iptables -A TCPIN -p tcp -m state --state NEW --dport 443 -j ACCEPT

iptables -A UDPIN -p udp --dport 53 -j ACCEPT
iptables -A TCPIN -p tcp -m state --state NEW --dport 53 -j ACCEPT

iptables -A LOGDROP -j LOG --log-ip-options --log-tcp-options --log-level debug --log-prefix IPTABLES:
iptables -A LOGDROP -j DROP

iptables -A VALIDTCP -p tcp --tcp-flags ALL NONE -j LOGDROP
iptables -A VALIDTCP -p tcp --tcp-flags ACK,FIN FIN -j LOGDROP
iptables -A VALIDTCP -p tcp --tcp-flags ACK,PSH PSH -j LOGDROP
iptables -A VALIDTCP -p tcp --tcp-flags ACK,URG URG -j LOGDROP
iptables -A VALIDTCP -p tcp --tcp-flags SYN,RST SYN,RST -j LOGDROP
iptables -A VALIDTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOGDROP
iptables -A VALIDTCP -p tcp --tcp-flags FIN,RST FIN,RST -j LOGDROP

As soon as I apply that, my DNS lookups all fail... What's wrong with it? :/

share|improve this question
    
Where are the TCPOUT/UDPOUT rules? :-) –  Janne Pikkarainen Aug 27 '10 at 8:05
    
A guy I know from IRC wrote that script for me and it's been in use on my old server for quite some time. Haven't had any issues there. You're telling me it doesn't allow any outbound traffic? D: How do I fix this? –  steve Aug 27 '10 at 8:11
    
Does any outbound traffic really work with that iptables ruleset? For example, if you try to connect some web site by using its numerical ip address, does that work? –  Janne Pikkarainen Aug 27 '10 at 8:41
    
My guess is that OUTPUT defaults to ACCEPT since you never specified it, so outbound traffic should pass through unimpeded (pretty much nothing would work otherwise). As for the DNS lookup problem, at first glance your UDPIN rule looks correct (although I don't think you need a TCP rule for port 53). Your best bet may be to add a LOG rule to both the UDPIN and UDPOUT tables (before the ACCEPT) and see what happens when you issue a ping or host command to resolve a name. Even simpler, run iptables -nvL before and after a name resolve and see if the packet counts tell you where the query went. –  yukondude Sep 2 '10 at 15:53
    
If you really want to sink your teeth into netfilter/iptables, here's the definitive guide: frozentux.net/iptables-tutorial/chunkyhtml Might be overkill in this case though. –  yukondude Sep 2 '10 at 16:06

1 Answer 1

iptables -A INPUT -p tcp -j VALIDTCP

iptables -A INPUT -p tcp -j TCPIN

rules are compared in order, and the -j means "jump to" - so nothing will jump to the TCPIN chain, as all tcp packets just got redirected elsewhere.

also, this looks like a hugely overly complicated setup for such a small firewall. keep it simple :-)

this is untested, but would this not do essentially the same thing (i ditched the tcp flag checking, but feel free to re-add it)


echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

iptables -F
iptables -X
iptables -Z

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW --dport 2122 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW --dport 443 -j ACCEPT
iptables -A INPUT -j LOG --log-ip-options --log-tcp-options --log-level debug --log-prefix IPTABLES:

i.e: allow traffic outbound (including dns requests) - then allow that traffic back in via the "related, established" rule. And also allow new connections on ports 80,443,2122 (which then get matched on the same related from then on). Everything else is ditched by the default -P DROP rule.

share|improve this answer
    
Watch out, this will only work if the DNS server is elsewhere. If the box where this script is run, IS a DNS server, you must allow incoming connections on port 53. Also: DNS can use UDP and TCP! –  wolfgangsz Aug 27 '10 at 10:11
    
yes, both these points are true, you might want to add an accept of udp port 53 to the input chain. –  Sirex Aug 27 '10 at 10:31
    
You actually do return to the previous chain/table from a -j jump command unless you match a rule with an ACCEPT or DROP target, so both the VALIDTCP and TCPIN tables will be traversed in the questioner's example. You can also issue an explicit RETURN target in a rule, but that's not used as often. Here's the long explanation: frozentux.net/iptables-tutorial/chunkyhtml/c3965.html –  yukondude Sep 2 '10 at 16:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.