Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I just had a simple question, well what should seem to be since I am very new to IP Tables. As far as questions I wanted to know if the rules I have set below are in the correct "order" because I heard that order counts, and I have a feeling something isn't quite right. If anybody can help me out with some organization, or if there is anything else you see, it would be greatly appreciated!

#!/usr/bin/bash

echo 1> /proc/sys/net/ipv4/ip_forward

ifconfig eth0 down
ifconfig eth0:1 down

iptables -F
iptables -F -t nat 

ifconfig eth0 192.168.10.59 netmask 255.255.255.0
ifconfig eth0:1 192.168.60.1 netmask 255.255.255.0
route add default gw 192.168.10.1
echo nameserver 192.168.10.1 > /etc/resolv.conf

iptables -t nat -A POSTROUTING -s 192.168.60.1/24 -j SNAT MASQUERADE 
(--to 192.168.10.59) not necessary

chmod 755 /etc/rc.d/rc.ip_forward
    /etc/rc.d/rc.ip_forward start

chmod 755 /etc/rc.d/rc.sshd
    /etc/rc.d/rc.sshd start

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -i lo -j ACCEPT
iptables -A FORWARD -i lo -j ACCEPT

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP


iptables -A INPUT -s 192.168.10.1/24 -p tcp --dport 22 -j DROP
iptables -A INPUT -s 192.168.10.85 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT 
iptables -A INPUT -i eth0 -p tcp --dport 20 -j ACCEPT 
iptables -A INPUT -i eth0 -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT 
iptables -A INPUT -i eth0 -p udp --sport 53 -j ACCEPT
iptables -A INPUT -m mac --mac-source xx:xx:xx:xx:xx:xx -p tcp --dport 20 -j ACCEPT  -Outside Comp Mac Address
iptables -A INPUT -m mac --mac-source xx:xx:xx:xx:xx:xx -p tcp --dport 21 -j ACCEPT  -Outside Comp Mac Address
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -p icmp --icmp-type echo-request -j DROP
iptables -A FORWARD -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


iptables -A OUTPUT -s 192.168.59.84 -p tcp --dport 22-j DROP
iptables -A OUTPUT -o eth0 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 20 -j ACCEPT 
iptables -A OUTPUT -o eth0 -p tcp --dport 21 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT - m mac --mac-source xx:xx:xx:xx:xx:xx -p tcp --dport 20 -j ACCEPT  -Inside Comp Mac Address
iptables -A OUTPUT - m mac --mac-source xx:xx:xx:xx:xx:xx -p tcp --dport 21 -j ACCEPT  Inside Comp Mac Address
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
share|improve this question

closed as not constructive by John Gardeniers, Khaled, EightBitTony, EEAA, HopelessN00b Oct 22 '12 at 13:17

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers 2

We can not tell you what is right and what is wrong simply by looking at your rules. Your rules need to be matched with your policy. A more accurate question can be written as: "I need to make sure that all inbound ports are closed except ...". However, I can say that you have a useless rule which will never match:

iptables -A INPUT -s 192.168.10.85 -p tcp --dport 22 -j ACCEPT

because it comes after this rule:

iptables -A INPUT -s 192.168.10.1/24 -p tcp --dport 22 -j DROP
share|improve this answer

It's good practice to set the policies first, then flush the chains, then create your new ruleset:

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -F
iptables -F -t nat

iptables -A INPUT ...
...

Otherwise your ruleset might inadvertently turn open (for however brief a time).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.