Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to make a very secure iptables configuration. I had some problems with an old configuration. Specifically I used to block a lot more of ICMP and allow a few specific ICMP types, but this seemed to cause periodic DNS issues.

This one appears to work (mostly). I can traceroute the server just fine. I'm testing this all in a virtual machine first. It has to pass PCI Compliance.

*filter
:INPUT DROP [5:735]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 13 -j DROP
-A INPUT -p icmp -m icmp --icmp-type 14 -j DROP
-A INPUT -p udp -m udp --dport 33200:33500 -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 33200:33500 -j ACCEPT
COMMIT

Is there any problems with the above configuration?

I'm using CentOS 5.6. Also what is the best way to prevent brute-force attacks on the SSH port? (I'll be changing ssh to a random port)

share|improve this question

1 Answer 1

up vote 1 down vote accepted

To prevent brute-force attacks SSH you will likely want rate limit connections. There are also programs like fail2ban which can be used to blacklist the IPs from which brute-force attempts are originating.

If you want a secure firewall, I would suggest you use a firewall build tool to build the firewall. I use Shorewall which has lots of documentation on how to build firewall rules for various cases. In your case I would consider starting with the one interface example and build from there.

Be careful blocking ICMP as some codes are essential for network operations. Shorewall will ensure you have the needed types enabled. You have options to enable or disable echo requests as required.

EDIT: There are some ICMP types you may not want to allow. However, you need should enable at least destination-unreachable(3), source-quench(4) and time-exceeded(11). For ping and traceroute you want echo-request(8) enabled, possibly outgoing only.

share|improve this answer
    
Actually one of the best ways I have found to limit brute force attacks is to use fail2ban. That also works for a number of other services as well. –  Squidly Sep 22 '11 at 0:29
    
Shorewall seems a bit over my head at the moment. Would love to know which ICMP types are safe to block and which ones are not. For now I'm just blocking the timestamp ones for PCI. Would also like to see recommended configuration for rate limiting a port. –  Luke Sep 22 '11 at 5:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.