Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If I leave out this line

    $IPT -I INPUT -i $WAN_NIC -j ACCEPT

from my firewall script below, then I can't SSH to the server.

The way I understand

    $IPT -I INPUT -i $WAN_NIC -j ACCEPT

is that it will allow all traffic from $WAN_NIC and make

$IPT -A INPUT -i $WAN_NIC -p icmp --icmp-type echo-request -j ACCEPT
$IPT -A INPUT -i $WAN_NIC -p tcp --dport ssh -j ACCEPT
$IPT -A INPUT -i $WAN_NIC -p tcp --dport www -j ACCEPT
$IPT -A INPUT -j REJECT

obsolete, which is not what I want.

What I am aiming for is that only SSH, WWW and ping is allowed on WAN_NIC.

Question

How should the rules look like, if I only want SSH, WWW, and ping on WAN_NIC?

script

$IPT -F
$IPT -X

# Allow all outgoing
$IPT -P OUTPUT ACCEPT

# Filter rules
$IPT -A INPUT -i lo -j ACCEPT
$IPT -I INPUT -i $WAN_NIC -j ACCEPT
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A INPUT -i $WAN_NIC -p icmp --icmp-type echo-request -j ACCEPT
$IPT -A INPUT -i $WAN_NIC -p tcp --dport ssh -j ACCEPT
$IPT -A INPUT -i $WAN_NIC -p tcp --dport www -j ACCEPT
$IPT -A INPUT -j REJECT

$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P INPUT ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

# Masquerade 192.168.245.8 - 192.168.245.255
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -A POSTROUTING -s $CLIENT_NET1 -o $WAN_NIC -j MASQUERADE
$IPT -t nat -A POSTROUTING -s $CLIENT_NET2 -o $WAN_NIC -j MASQUERADE
$IPT -t nat -A POSTROUTING -s $CLIENT_NET3 -o $WAN_NIC -j MASQUERADE
$IPT -t nat -A POSTROUTING -s $CLIENT_NET4 -o $WAN_NIC -j MASQUERADE
$IPT -t nat -A POSTROUTING -s $CLIENT_NET5 -o $WAN_NIC -j MASQUERADE

# Allow only IPs from LAN_NET to connect to LAN_NIC
$IPT -A FORWARD -i $LAN_NIC ! -s $LAN_NET -j DROP
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Forward 192.168.245.8 - 192.168.245.255. The first 7 IPs are reserved for failover etc
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET1 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET2 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET3 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET4 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET5 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -j REJECT

Update

Added my nat rules and the following output from iptables, when I can't SSH.

root@ts:~# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  192.168.245.0/24     anywhere            
ACCEPT     all  --  linuxterm2.local     anywhere            
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DROP       all  -- !192.168.245.0/24     anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  192.168.245.128/25   anywhere            state NEW 
ACCEPT     all  --  192.168.245.64/26    anywhere            state NEW 
ACCEPT     all  --  192.168.245.32/27    anywhere            state NEW 
ACCEPT     all  --  192.168.245.16/28    anywhere            state NEW 
ACCEPT     all  --  192.168.245.8/29     anywhere            state NEW 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
root@ts:~# 
share|improve this question
1  
Please when listing rules use iptables -L -n -v, otherwise we can't see what interface a particular rule applies to. –  MadHatter Oct 31 '11 at 11:34
    
@MadHatter Thanks a lot. Very useful command! I'll do that from now on. I just found the problem, so I posted the solution. –  Sandra Oct 31 '11 at 11:59
add comment

2 Answers

Your rules may be ordered incorrectly; if you are not using a default policy (why not?) then order matters.

Show what iptables -L outputs.

If you set a default policy of REJECT on the WAN interface, then you only need the rules for those 3 protocols, and the ESTABLISHED rule to allow responses to outgoing traffic.

Of course, if you have NAT rules, most of this goes out the window.

share|improve this answer
    
I have infact NAT rules, but I didn't think that would make a difference, so I left them out. They are now added aswell as iptables -L when I can't SSH. –  Sandra Oct 31 '11 at 11:33
add comment
up vote 0 down vote accepted

Problem found.

$IPT -A INPUT -j REJECT

should be

$IPT -i $WAN_NIC -A INPUT -j ACCEPT

or left completely out, as I start off by dropping everything, so REJECT have no effect.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.