Server: Ubuntu 10.04 LTS x64 (cloud server at rackspace)
Trying to get a better handle on iptables. All traffic should be dropped coming in except SSH and HTTP. All outgoing is safe. no forwards. The code I have below is based on a sample I found however I can not find any docs to explain what the range is for filters, for example ":INPUT DROP [0:65536]" What is the 0:65536 suppose to set? I guessed port range so I gave it the full range, but then outgoing has it defaulting to much higher. It was different but changing it does not seem to effect anything. What does it do?
Second, while traffic is blocked a nmap scan with full connect "-sT" still shows some 20-30 ports as open but banner grabbing with netcat does not show anything. Is that normal?
My method for testings is (as root).
iptables -L (check its flushed)
iptables-restore < iptables.test.rules
*filter :INPUT DROP [0:65536] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1628:151823] -A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT #future use #-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT #-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT #-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT COMMIT