Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Just trying to make a simple script that will configure iptables to block all incoming and outgoing traffic except for ssh on default port 22 and udp on port 8888.

This is what i have:

#!/bin/sh
#
# Flush all current rules from iptables
#
iptables -F

#
# Set default policies for INPUT, FORWARD and OUTPUT chains
#
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

#
# Allow SSH connections on tcp port 22
#
iptables -A INPUT -i eto0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eto0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

#
# Set access for localhost
#
iptables -A INPUT -i lo -j ACCEPT

#
# Accept connections on 8888 for vpn access from client
#
iptables -A INPUT -i eth0 -p udp --dport 8888 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 8888 -m state --state ESTABLISHED -j ACCEPT

#
# Apply forwarding for OpenVPN Tunneling
#
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT     
iptables -t nat -A POSTROUTING -s 10.8.0.0./24 -o eth0 -j MASQUERADE   
iptables -A FORWARD -j REJECT

#
# Enable forwarding
# 
echo 1 > /proc/sys/net/ipv4/ip_forward

#
# List rules
#
iptables -L -v

But when i run it i get locked out of my vps and have to restart it in order to get back in. I really can't see where i am going wrong... also the vpn won't work after running this firewall.

I also wanted to block all pings to the public ip on all ports but have no idea how.

share|improve this question

1 Answer 1

up vote 4 down vote accepted

for you being locked out on the reason is "eto0!=eth0" , and configure the policies in the end after you have configured all of your rules and you have allowed all outgoing traffic on all interfaces.

for ping related rules do man iptables and read on icmp

Also, in future create a allow all rule something like

/sbin/iptables -P INPUT ALLOW and the same for OUTPUT and FORWARD and put it on your cron to run every 5/10 minutes that way you would get to login even if something goes out of hands.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.