Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to apply these firewall rules:

/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -Z
/sbin/iptables -P INPUT DROP
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -p tcp ! --syn -j REJECT --reject-with tcp-reset
/sbin/iptables -A INPUT -m state --state INVALID -j DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp ! --syn -j REJECT --reject-with tcp-reset
/sbin/iptables -A OUTPUT -m state --state INVALID -j DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp ! --syn -j REJECT --reject-with tcp-reset
/sbin/iptables -A FORWARD -m state --state INVALID -j DROP
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT
/sbin/iptables -A FORWARD -i lo -o lo -j ACCEPT
/sbin/iptables -t mangle -F
/sbin/iptables -t mangle -X
/sbin/iptables -t mangle -Z
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
/sbin/iptables -t nat -F
/sbin/iptables -t nat -X
/sbin/iptables -t nat -Z
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 12443 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 11443 -j DROP
/sbin/iptables -A INPUT -p tcp --dport 11444 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 8447 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 8443 -j DROP
/sbin/iptables -A INPUT -p tcp --dport 8880 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 443 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 21 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 22 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 587 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 25 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 465 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 110 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 995 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 143 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 993 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 106 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 3306 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 5432 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 9008 -j DROP
/sbin/iptables -A INPUT -p tcp --dport 9080 -j DROP

/sbin/iptables -A INPUT -p udp --dport 137 -j DROP
/sbin/iptables -A INPUT -p udp --dport 138 -j DROP
/sbin/iptables -A INPUT -p tcp --dport 139 -j DROP
/sbin/iptables -A INPUT -p tcp --dport 445 -j DROP

/sbin/iptables -A INPUT -p udp --dport 1194 -j DROP




/sbin/iptables -A INPUT -p tcp --dport 26 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 53 -j ACCEPT
/sbin/iptables -A INPUT -p udp --dport 53 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 2095 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 2096 -j ACCEPT

/sbin/iptables -A INPUT -p udp --dport 465 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 26 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 37 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 43 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 113 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 465 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 873 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 2089 -j ACCEPT

/sbin/iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

/sbin/iptables -A OUTPUT -p udp --dport 465 -j ACCEPT

/sbin/iptables -A OUTPUT -p udp --dport 873 -j ACCEPT




/sbin/iptables -A INPUT -p icmp --icmp-type 8/0 -j DROP

/sbin/iptables -A INPUT -j DROP

/sbin/iptables -A OUTPUT -j ACCEPT

/sbin/iptables -A FORWARD -j DROP

However, when I copy and paste them into the command line I get locked out of the server (of course since the rules are being applied line by line). How do I apply these rules all at once since /sbin/iptables -P INPUT DROP is executed first, but the line to allow shell access comes after (I have removed this to protect my IP.

share|improve this question
    
I'm not going to comment on the rules itself and/or wether they would work since my experience with iptables is limited. However, I've recently had a similar issue where I had in fact locked myself out of the server. One of the suggestions I received at the time was: make a cronjob to run every 5 minutes to stop iptabels (/etc/init.d/iptables stop). If you happen to lock yourself out, you'll be back in 5 minutes later. Not saying this is ideal either since stopping iptables will open your server up for everything you were trying to protect it from. –  Jannemans Aug 13 '11 at 17:49
add comment

5 Answers

up vote 4 down vote accepted

I wouldn't be trying to run them by pasting them into the terminal. I'd scp them over and run them from a single script (could just be a bash script with them all pasted in.

With just around the amount of data you have there, i've had situations where pasting that into an ssh terminal has actually led to some loss of data (as in a couple of lines are missed). in something like this, that really isn't such a good idea. Obviously the likelyhood of that happening depends on the link quality and bandwidth.

Also if you're playing around with iptables and are afraid you might lock yourself out, set up a script to clear iptables (or set them to something you're happy works) and then set either a cron job to execute it, or have another window open while you're applying the rules and just do "sleep 100 && ./cleariptables" or something to that affect. Ctrl+c it when new rules have been successful and you're sure you can still log in. Always attempt to make a new ssh connection has you may have blocked new ssh connections and the current one is only working as it's already established

share|improve this answer
add comment

Here is what I do:

1.) Never save iptables rules "service iptables save" so if you ever block yourself, a reboot will not load the same bad rules again before you have a chance to reconnect and correct the problem. This, of course, will require a manual load your rules after each reboot. An alternative approach would be to go ahead and save the rules, but not setting up the iptables service to start upon system start and then manually starting the service after each reboot.

2.) Add some rules near the top of the ruleset to always accept connections from a few host ranges that are semi-safe (your home/office) so any following rules added will never block you:

iptables -A INPUT -s 83.225.0.0/16 -j ACCEPT
iptables -A INPUT -s 75.102.0.0/16 -j ACCEPT
iptables -A INPUT -s 37.122.0.0/16 -j ACCEPT
share|improve this answer
add comment

Another way not to get locked out is to load your new rules, sleep for x seconds and test during the sleep, then load the old rules that worked in case your new rules don't work.

# load_new_rules; sleep 120; load_old_rules

Good way to not lock yourself out when working on a remote firewall that you don't have remote console access to.

share|improve this answer
add comment

On another linux box, configure via console all the iptables rules and policies. Save it to a file using iptables-save. Copy the file to your remote machine, and apply using:

iptables-apply -t 300 name-of-file

the 300 is the timeout. iptables-apply will apply all rules in the file, wait for your confirmation, and if no confirmation in 300 seconds, restores the previous rules and policies.

share|improve this answer
1  
iptables-apply isn't native to a CentOS system. –  Iain Aug 13 '11 at 20:02
add comment

Try moving the /sbin/iptables -P INPUT DROP to the end of the file. If that doesn't work then save the rules to a file and then use the iptables-restore command.

sudo iptables-restore </file/you/created

Once you've done that save your rules to /etc/sysconfig/iptables

sudo /sbin/service iptables save

so that they get loaded when your system starts next.

If the iptables-restore doesn't work then saving the rules manually to /etc/sysconfig/iptables and restarting the service will work

sudo /sbin/service iptables restart

The input file to iptables-restore might be

*filter
-F
-X
-Z
-P INPUT DROP
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp ! --syn -j REJECT --reject-with tcp-reset
-A INPUT -m state --state INVALID -j DROP
# Add the rest of your INPUT/OUTPUT/FORWARD rules before the commit
COMMIT
*mangle 
-X
-F
-Z
-P PREROUTING ACCEPT
#Add the rest of the mangle rules
COMMIT
*nat
-X
#add the rest of your nat rules
COMMIT
share|improve this answer
    
I copied the above rules into a file, but i get this message: iptables-restore: line 1 failed –  cappuccino Aug 13 '11 at 19:05
    
I gave you the format of the file at the end of the answer. If you just copied the whole lot into a file, add #!/bin/bash at the top of the file, save it, make it executable and then run it. –  Iain Aug 13 '11 at 19:13
    
@Iain iptables-restore by default performs -F and -X. Policies are set using a special construct. Try perusing the output of iptables-save –  pepoluan Aug 13 '11 at 19:35
    
@pepoluan: The format above also works and is easier to describe than the format used by iptables-save. –  Iain Aug 13 '11 at 19:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.