Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to do the following, but I'm having a hard time doing so using iptables in CentOS:

  1. I would like to accept inbound only port 80,443,22, snmp, 3306 to my server
  2. I would like to be able to allow all outbound ports
  3. I would like all other inbound connection to be dropped
share|improve this question
    
You have given a list of ports, but not protocols. 80, 443, 22 and 3306 are normally used as TCP ports. However SNMP often uses UDP. Whenever giving ports it's good to get into the habit of saying "tcp/3306, udp/161, etc", then there is no confusion. –  Coops Aug 12 '11 at 21:05
    
You don't say what role the server will play (I presume a LAMP server given the incoming ports). However from a security perspective filtering your outgoing traffic can be as useful as filtering your incoming traffic. Many times I've seen a compromised server made redundant as the hack depends on being able to communicate outbound on a specific port (often the IRC port) in order to take remote control of the server -- but the FW only allows outward traffic on certain ports. –  Coops Aug 12 '11 at 21:10
add comment

4 Answers

up vote 5 down vote accepted

Open your iptables(/etc/sysconfig/iptables) and add the following lines below (-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT) line:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 161 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 161 -j ACCEPT

Restart the iptables:

service iptables restart

By default, your iptables allow all outbound ports.

share|improve this answer
    
errr...how do you know it's RH? –  Server Horror Jun 19 '11 at 20:54
    
It's in the title. :) –  garconcn Jun 19 '11 at 21:34
2  
doh! you mean the thing in bold letters at the top...I knew it means something. I'm so blind today! –  Server Horror Jun 19 '11 at 21:52
    
thanks but I stll can ftp to my server. I want to block everthing else –  edotan Jun 20 '11 at 9:20
    
@Elad, can you show your iptables with command "iptables -L"? You can delete INPUT line with --dport 21 or 20 –  garconcn Jun 20 '11 at 20:22
show 1 more comment

lokkit will give you a simple interface to configure iptables with.

share|improve this answer
add comment
  1. I would like to accept inbound only port 80,443,22, snmp, 3306 to my server.
  2. I would like to be able to allow all outbound ports
  3. I would like all other inbound connection to be dropped.

Put this rules in a shell script....

#!/bin/bash

# 3

iptables -P INPUT DROP

iptables -P FORWARD DROP

# 2

iptables -P OUTPUT ACCEPT

iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED

iptables -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED

# 1 (change eth0 for your interface)

iptables -A INPUT -j ACCEPT -i eth0 -p tcp -m multiport --dport 80,443,22,161,3306

share|improve this answer
add comment

The answers given already will definitely do what you need. But really, you should understand how your firewall works if you're going to administrate it. Surprisingly, the CentOS documentation for setting up IPTABLES is easy to understand and gives a good base for getting it set up. So instead of just taking these guys' word for it and sticking these firewall rules up, read a bit and find out what they are doing.

http://wiki.centos.org/HowTos/Network/IPTables

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.