Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I wrote the following iptables rules. My main intention was to do these things

  • allow ssh traffic to any machine
  • allow web traffic(http,https, and some ssh) to a select number of websites(effectively a whitelist)
  • allow all traffic to 192.168.0.x (machines in my subnet)
  • allow all traffic with the loopback interface
  • don't mess up the current connections
  • drop any request that doesn't fit the above rules

So i wrote the following set of iptables rules. Which leads to not being able to access anything anymore, I messed up..:(

How do I fix this ? I'm not good at all with iptables, I'm reading documentation about it, but haven't been able to figure this out(never been good with networking).

Btw, I want to use this on my local machine.

--

#!/bin/bash

#Flush rules(deletes all existing chains)
iptables -F

#allow ssh
iptables -I INPUT  -p tcp --dport 22 -j ACCEPT
iptables -I OUTPUT -p tcp --sport 22 -j ACCEPT

#allow loopback
iptables -I INPUT 1 -i lo -j ACCEPT

# Allow DNS
iptables -A OUPUT -p udp --dport 53 -j ACCEPT

# Allow local network IN/OUT traffic
iptables -A INPUT  -i eth0 -s 192.168.1.0/24 -j ACCEPT
iptables -A OUTPUT -o eth0 -d 192.168.1.0/24 -j ACCEPT

# vagrant local IPs (TODO later)
# iptables -A INPUT  -i eth0 -s 10.0.1.0/24 -j ACCEPT
# iptables -A OUTPUT -o eth0 -d 10.0.1.0/24 -j ACCEPT


iptables -A OUTPUT -p tcp -d serverfault.com --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d serverfault.com --dport 443 -j ACCEPT

iptables -A OUTPUT -p tcp -d google.com --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d google.com --dport 443 -j ACCEPT

iptables -A OUTPUT -p tcp -d wikipedia.com --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d wikipedia.com --dport 443 -j ACCEPT

iptables -A OUTPUT -p tcp -d wikimedia.org --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d wikimedia.org --dport 443 -j ACCEPT

iptables -A OUTPUT -p tcp -d mediawiki.org --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d mediawiki.org --dport 443 -j ACCEPT

iptables -A OUTPUT -p tcp -d mathlinks.ro --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d mathlinks.ro --dport 443 -j ACCEPT

iptables -A OUTPUT -p tcp -d stackoverflow.com --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d stackoverflow.com --dport 443 -j ACCEPT

iptables -A OUTPUT -p tcp -d perlmonks.org --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d perlmonks.org --dport 443 -j ACCEPT

iptables -A OUTPUT -p tcp -d gmail.com --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d gmail.com --dport 443 -j ACCEPT

iptables -A OUTPUT -p tcp -d cyberciti.biz --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d cyberciti.biz --dport 443 -j ACCEPT


iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#drop everything else
iptables -P INPUT DROP
iptables -P OUTPUT DROP

@B14D3 Output of iptables -nL (before running the above):

$ sudo iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination   

@Raj Output of iptables -L default rules(without applying mine)

$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  

@Khaled Output of iptables -nL after running the script above

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22 
ACCEPT     all  --  192.168.1.0/24       0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           ctstate RELATED,ESTABLISHED 
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:22 
ACCEPT     all  --  0.0.0.0/0            192.168.1.0/24      
ACCEPT     tcp  --  0.0.0.0/0            64.34.119.12        tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            64.34.119.12        tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.249       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.212       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.214       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.217       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.219       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.222       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.224       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.227       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.229       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.232       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.234       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.237       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.239       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.242       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.244       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.247       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.247       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.249       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.212       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.214       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.217       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.219       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.222       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.224       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.227       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.229       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.232       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.234       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.237       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.239       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.242       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            62.231.75.244       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            208.80.152.201      tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            208.80.152.201      tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            208.80.152.200      tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            208.80.152.200      tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            208.80.152.208      tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            208.80.152.208      tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            76.12.70.149        tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            76.12.70.149        tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            64.34.119.12        tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            64.34.119.12        tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            216.92.34.251       tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            66.39.54.27         tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            209.197.123.153     tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            209.197.123.153     tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            216.92.34.251       tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            66.39.54.27         tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            173.194.39.150      tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            173.194.39.149      tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            173.194.39.149      tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            173.194.39.150      tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            75.126.153.206      tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            75.126.153.206      tcp dpt:443 
share|improve this question

closed as off topic by MDMarra, HopelessN00b, rnxrx, Tom O'Connor, Ward Sep 28 '12 at 16:29

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
show output from iptables -nL ... Should you add firs default policy after iptables -F and then add other rules ? –  B14D3 Sep 27 '12 at 11:06
    
Do you want to visit only those websites nothing else ? –  B14D3 Sep 27 '12 at 11:07
    
@B14D3 Yes, I want to add more things to it overtime.. but not too many :) You know how it goes, it's not easy, but I want to impose myself to not lose time on other stuff. –  average Sep 27 '12 at 11:10
    
@B14D3 added the output of iptables -nL –  average Sep 27 '12 at 11:13

2 Answers 2

Here are some points that can be considered to help you:

The related/established rule is better to be at the top of your firewall rules instead of being the at bottom. This is because it will be hit most of the time (performance reason).

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

You did not say explicitly whether you are configuring the firewall on your own machine or on your network gateway. In the former case, it is OK to add rules in INPUT/OUTPUT chains. However, you need to consider adding ACCEPT rules to the FORWARD chain in the later case.

Also, using DNS names in firewall rules to allow specific domains is not a good idea. Instead, you can use a proxy server with blacklist/whitelist to deny/allow whatever you want from any domain/URL, etc. Iptables will not be able to detect DNS-IP change later.

Update: When looking at your ruleset, I can not see any rule allowing DNS traffic in the OUTPUT chain. You can add a rule like:

-A OUTPUT -p udp --dport 53
share|improve this answer
    
Why won't it be able to detect DNS-IP changes ? Does it have a cache and it stores there the IP for each domain name ? Can't I refresh that cache somehow ? But still, my main problem at this moment is not performance, it is that I can't access anything after I run the script I wrote(I can't access any website, not even ping them, nothing) –  average Sep 27 '12 at 11:31
    
@jojomodjo: Yes, it will translate the name to IP. When the name-IP mapping change, you need re-run your scripts rule. –  Khaled Sep 27 '12 at 11:59
    
I don't mind re-running my script weekly for example.. But at the moment if I run the script that I wrote above, everything stops working(I can't access any website) –  average Sep 27 '12 at 12:12
    
@jojomodjo: Is this firewall running on your machine or on your network gateway? Also, the posted output of iptables -n -L is empty. You need to post it after running your script. –  Khaled Sep 27 '12 at 12:22
    
I added the output in the post. I am running this on my machine, not the network gateway. –  average Sep 27 '12 at 14:03

@jojo The best and simplest method is first load default policies which will resolve your four queries as below.

allow ssh traffic to any machine

allow all traffic with the loopback interface

don't mess up the current connections

drop any request that doesn't fit the above rules

because the default iptable rules allow all traffic to loopback and drop any request which is not allowed specifically and etc.

then insert the rules for http, https and other with state as a NEW

E.g. for port 80 or http as below

iptables -I INPUT 8 -m state --state NEW -p tcp --dport 80 -j ACCEPT

share|improve this answer
    
what does -I INPUT 8 mean ? is that a typo ? –  average Sep 27 '12 at 11:34
    
I don't understand what you wrote, can you please write bash that does this ? Thanks –  average Sep 27 '12 at 11:40
    
@jojo -I INPUT 8 stands for insert the current rule in INPUT chain at line number 8. If you do iptables -L, it will show all the rules for INPUT, OUTPUT and FoRWARD. 8 number stands for where to put the rule in INPUT chain. Or just count the no of lines before SSH rule and and insert your rule at that number. –  Raj Sep 27 '12 at 11:41
    
So why line number 8 ? Can you please give me an example of an iptables script that restrict access to anything but two websites ? –  average Sep 27 '12 at 11:42
    
it is just example. –  Raj Sep 27 '12 at 11:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.