Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite
1

Using iptables, I need to block all outbound traffic on my server, except:

  • SSH access to a small number of IP addresses
  • HTTPS access to the same small list of IP addresses

Can anybody show me a suitable set of rules?

Thank you.

share|improve this question
Do you mean you want the server to access those remote IP addresses, or that those remote addresses should have access to the server? – Cry Havok Nov 6 '10 at 19:24
To clarify, this is a secure server holding sensitive data. I want users who log in via SSH to be unable to send data from this machine. I have already blocked inbound traffic using iptables. Thank you – robw Nov 6 '10 at 22:38

3 Answers

up vote 2 down vote 
iptables -I OUTPUT -d <remote_ip> -p tcp --dport 22 -j ACCEPT
iptables -I INPUT -s <remote_ip> -p tcp --sport 22 -j ACCEPT
iptables -I OUTPUT -d <remote_ip> -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s <remote_ip> -p tcp --sport 443 -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP

You will need to put in the first 4 rules for each of the IPs. Be warned, though, because you will have to log in via the console on this machine; all other access to it will be blocked.

share|improve this answer
1  
Those rules won't parse correctly, because you've specified -o (output interface) without actually naming an interface. Do you want to edit the rules, and I'll delete this comment? You may want to consider adding "-m state --state ESTABLISHED" on the INPUT+ACCEPT rules, but that's a point of taste. – MadHatter Nov 6 '10 at 20:06
up vote 0 down vote

Now I understand the context of your quesiton, try:

iptables -P OUTPUT DROP
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s 8.8.8.8 --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp -s 8.8.8.8 --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp -s 10.11.12.13/24 --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp -s 10.11.12.13/24 --dport 443 -j ACCEPT

And so on. That will set the default policy to DROP and then only allow IP addresses (or ranges) listed access. The second line allows related traffic (eg outbound packets for an ongoing SSH session), the third and fourth examples for your DNS lookups.

Don't forget you'll need an INPUT rule similar to line 2.

share|improve this answer
Asker stated that he wanted to block all outbound traffic with a few exceptions; you block all inbound traffic with a few exceptions. – Kevin M Nov 6 '10 at 19:31
@Kevin M, given that the rules suggested applied are stateless nothing that you are making outbound connections to are going to be able to reply except what he has allowed. – Zoredache Nov 6 '10 at 20:38
@Kevin M, The question was vague enough it could be read either way, hence my request for clarification. The question as you pose it doesn't make much sense - how would you access this server except at the console? – Cry Havok Nov 6 '10 at 21:50
I've added a comment above which I hope clarifies, let me know if you need more information. – robw Nov 6 '10 at 22:39
up vote 0 down vote

The above posts will achieve to block all outgoing traffic except SSH and HTTPS, but they will not meet your above (in the comments) stated objective:

I want users who log in via SSH to be unable to send data from this machine.

Consider the following: If I would have SSH access to your box, I could simply upload any data to an untrusted location using an SSH tunnel and go via one of the destinations for which you allow outgoing traffic. Thus, I don't think the problem can be addressed just by iptable rules on your host containing the sensitive data if you want to sensitive data not to be copied outside of your network in any way.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.