Any suggestions for my iptables config?

Question

I'm trying to make a very secure iptables configuration. I had some problems with an old configuration. Specifically I used to block a lot more of ICMP and allow a few specific ICMP types, but this seemed to cause periodic DNS issues.

This one appears to work (mostly). I can traceroute the server just fine. I'm testing this all in a virtual machine first. It has to pass PCI Compliance.

*filter
:INPUT DROP [5:735]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 13 -j DROP
-A INPUT -p icmp -m icmp --icmp-type 14 -j DROP
-A INPUT -p udp -m udp --dport 33200:33500 -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 33200:33500 -j ACCEPT
COMMIT

Is there any problems with the above configuration?

I'm using CentOS 5.6. Also what is the best way to prevent brute-force attacks on the SSH port? (I'll be changing ssh to a random port)

Answer 1

To prevent brute-force attacks SSH you will likely want rate limit connections. There are also programs like fail2ban which can be used to blacklist the IPs from which brute-force attempts are originating.

If you want a secure firewall, I would suggest you use a firewall build tool to build the firewall. I use Shorewall which has lots of documentation on how to build firewall rules for various cases. In your case I would consider starting with the one interface example and build from there.

Be careful blocking ICMP as some codes are essential for network operations. Shorewall will ensure you have the needed types enabled. You have options to enable or disable echo requests as required.

EDIT: There are some ICMP types you may not want to allow. However, you need should enable at least destination-unreachable(3), source-quench(4) and time-exceeded(11). For ping and traceroute you want echo-request(8) enabled, possibly outgoing only.