Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Having trouble getting my head around iptables rules

I need to:

  • Allow HTTP traffic to 80 and 443 from anywhere
  • Allow MySQL traffic 3306 internally
  • Allow SSH access from a specific list of IP addresss

Any ideas?

share|improve this question
    
I'd also recommend changing the SSH port if you haven't already. –  Ek0nomik Mar 5 '12 at 16:25

1 Answer 1

According to fwbuilder (recommended) and a quick inspection, the following do ricks 1 and 3. Doing (2) depends strongly on your definition of "internal" (on interface, two interfaces, etc.)

$IPTABLES -N RULE_0
$IPTABLES -A INPUT -p tcp -m tcp  -s 1.2.3.4   --dport 22  -m state --state NEW  -j RULE_0
$IPTABLES -A FORWARD -p tcp -m tcp  -s 1.2.3.4   --dport 22  -m state --state NEW  -j RULE_0
$IPTABLES -A RULE_0  -j LOG  --log-level info --log-prefix "RULE 0 -- ACCEPT "
$IPTABLES -A RULE_0  -j ACCEPT
# 
# Rule 1 (global)
# 
echo "Rule 1 (global)"
# 
$IPTABLES -N RULE_1
$IPTABLES -A OUTPUT -p tcp -m tcp  -m multiport  --dports 80,443  -m state --state NEW  -j RULE_1
$IPTABLES -A INPUT -p tcp -m tcp  -m multiport  --dports 80,443  -m state --state NEW  -j RULE_1
$IPTABLES -A FORWARD -p tcp -m tcp  -m multiport  --dports 80,443  -m state --state NEW  -j RULE_1
$IPTABLES -A RULE_1  -j LOG  --log-level info --log-prefix "RULE 1 -- ACCEPT "
$IPTABLES -A RULE_1  -j ACCEPT

E.g. for a 192.168.1.0/254 internal network:

   $IPTABLES -N In_RULE_0
   $IPTABLES -A INPUT  -i eth0:1  -p tcp -m tcp  -s 192.168.1.0/24   -d 192.168.1.0/24    --dport 3306  -m state --state NEW  -j In_RULE_0
   $IPTABLES -A FORWARD  -i eth0:1  -p tcp -m tcp  -s 192.168.1.0/24   -d 192.168.1.0/24   --dport 3306  -m state --state NEW  -j In_RULE_0
   $IPTABLES -A In_RULE_0  -j LOG  --log-level info --log-prefix "RULE 0 -- ACCEPT "
   $IPTABLES -A In_RULE_0  -j ACCEPT
   $IPTABLES -N Out_RULE_0
   $IPTABLES -A OUTPUT  -o eth0:1  -p tcp -m tcp  -s 192.168.1.0/24   -d 192.168.1.0/24   --dport 3306  -m state --state NEW  -j Out_RULE_0
   $IPTABLES -A FORWARD  -o eth0:1  -p tcp -m tcp  -s 192.168.1.0/24   -d 192.168.1.0/24   --dport 3306  -m state --state NEW  -j Out_RULE_0
   $IPTABLES -A Out_RULE_0  -j LOG  --log-level info --log-prefix "RULE 0 -- ACCEPT "
   $IPTABLES -A Out_RULE_0  -j ACCEPT
share|improve this answer
    
Sorry, internally means on the other ethernet interface. eth0 is publicly accessible, eth0:1 is the internal network with a separate subnet mask –  Tom Mar 5 '12 at 16:35
    
edited as per comment. –  Alien Life Form Mar 5 '12 at 17:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.