Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a riak cluster that I need to only allow certain IP addresses access to the information. I am currently using, -A INPUT -s 192.168.10.200 -j ACCEPT, to allow this IP address and at the bottom of my rules I have -A INPUT -j REJECT and -A FORWARD -j REJECT, to reject other traffic. Can anyone advise where I am going wrong? Thanks!

The full rules:

-A INPUT -s 192.168.1.181 -j ACCEPT
-I INPUT -p tcp --dport 8098 -j ACCEPT
-I INPUT -p tcp --dport 8099 -j ACCEPT
-I INPUT -p tcp --dport 4369 -j ACCEPT
-I INPUT -p tcp --dport 5678:5679 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 2500 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j REJECT -A FORWARD -j REJECT
share|improve this question

3 Answers 3

It is not enough to allow the incoming traffic using: -A INPUT -s 192.168.10.200, or forwarded traffic using: -A INPUT -s 192.168.10.200. You are missing the related traffic. You need to add:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

INPUT should be used for traffic destined to the firewall itself. FORWARD should be used for traffic destined to other machines. Also, make sure to enable IP forwarding in this case.

share|improve this answer
    
I have -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT in my table but it is still not working. –  Queencity13 Feb 22 '11 at 15:20
    
-A INPUT -s 192.168.1.181 -j ACCEPT -I INPUT -p tcp --dport 8098 -j ACCEPT -I INPUT -p tcp --dport 8099 -j ACCEPT -I INPUT -p tcp --dport 4369 -j ACCEPT -I INPUT -p tcp --dport 5678:5679 -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A OUTPUT -j ACCEPT -A INPUT -p tcp -m state --state NEW --dport 2500 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 -A INPUT -j REJECT -A FORWARD -j REJECT –  Queencity13 Feb 22 '11 at 15:31
    
Above is a copy of my iptalbe rules –  Queencity13 Feb 22 '11 at 15:32
1  
You can edit your question instead of adding more comments! –  Khaled Feb 22 '11 at 16:38

Netfilter has 5 main Chains. You can ignore PREROUTING and POSTROUTING for now, so the 3 you need to manipulate are INPUT, FORWARD and OUTPUT.

INPUT and OUTPUT control the traffic directed to the system itself, while FORWARD controls the traffic that passes through and is directed to another machine (the case of a gateway).

In your case, if you want to allow external users to connect to the system itself, you need the following set of rules:

# Rule 1: accept packets from established connections to enter and leave the system
iptables -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p udp -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp -m state --state ESTABLISHED -j ACCEPT

# Rule 2: accept new connections entering the system
iptables -A INPUT -i eth0 -p tcp -s 192.168.10.200 -m state --state NEW -j ACCEPT 



# Rule 3: block all connections entering and leaving the system (if not previously accepted)
iptables -A INPUT -i eth0 -j DROP

# note: only use the filtering on output if you want to control outgoing connection
# if you want to let all connections leave your system, just comment this out
iptables -A OUTPUT -o eth0 -j DROP 

Rules 1 and 3 are general, Rule 2 is connection specific. Just use that sample and add new Rule 2 when you need new connections.

If you want something more solid, take a look at this: http://1nw.eu/!MJ

share|improve this answer
    
I'm not sure my question was too clear...the iptable rules i have in place now still allows all ip address connections. How do I only allow certain ip addresses to access my server information with iptables? Thank you for your help. –  Queencity13 Feb 22 '11 at 16:46
    
the set of rules I put above blocks all incoming and outgoing connections unless explicitely listed, which is what you are asking for. What do you call your 'server information' ? –  Julien Vehent Feb 22 '11 at 16:55
    
I am working on a riak node, and I currently can access a "buckets" information via the browser, which I am trying to prevent access from all ip addresses but what i specify. Thanks for your help. –  Queencity13 Feb 22 '11 at 17:03
    
so use my ruleset above and add as many "rule 2" as you need, specifying the source IP everytime. –  Julien Vehent Feb 22 '11 at 17:22
    
I have used the rules you provides and it is still allowing all ip address access via the browser...not sure where I am going wrong. –  Queencity13 Feb 22 '11 at 19:27

Okay, I've read your complete rules.

One important thing first: Please don't mix -A with -I.

  • -A appends rules to the end of the chain
  • -I inserts rules into the chain (if the position is not specified, it's inserted in the first place)

So, your iptables rules are actually:

-A INPUT -p tcp --dport 5678:5679 -j ACCEPT
-A INPUT -p tcp --dport 4369 -j ACCEPT
-A INPUT -p tcp --dport 8099 -j ACCEPT
-A INPUT -p tcp --dport 8098 -j ACCEPT
-A INPUT -s 192.168.1.181 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 2500 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j REJECT
-A FORWARD -j REJECT
-A OUTPUT -j ACCEPT

As you can see, the INPUT rules #1 through #4 does not limit any source address.

Now if you really want to limit access to those ports to 192.168.1.181, you'll have to do it like this:

# Established connections should just pass
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Loopbacks will not match 192.168.1.181, so we ACCEPT them here
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
# Other than 192.168.1.181, we reject
-A INPUT -s 192.168.1.181 -j in_allow
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j REJECT
# Allow only the following ports
-A in_allow -p tcp --dport 5678:5679 -j ACCEPT
-A in_allow -p tcp --dport 4369 -j ACCEPT
-A in_allow -p tcp --dport 8099 -j ACCEPT
-A in_allow -p tcp --dport 8098 -j ACCEPT
-A in_allow -p tcp -m state --state NEW --dport 2500 -j ACCEPT
-A in_allow -p icmp -m icmp --icmp-type 8 -j ACCEPT
#
-A FORWARD -j REJECT
-A OUTPUT -j ACCEPT

Only one question: why the -m state --state NEW for --dport 2500?

Important note: Don't forget to first FLUSH and ERASE the whole iptables rules before applying the above.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.