Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to basically drop all packets, but still allow port 22, 80 and 52533. At the moment this firewall doesn't allow pinging, or for me to use yum update. How can I add that? Also, is there an easier way to open port 80? The current rule seems a bit verbose.

#!/bin/sh    
#
# Flush all current rules from iptables
#
iptables -F
iptables -t nat -F

#
# Allow SSH connections on tcp port 22 
#
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -j ACCEPT

#
# Open port 80
#    
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 209.177.156.154 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s 209.177.156.154 --sport 80 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

#
# Set access for localhost
#
iptables -A INPUT -i lo -j ACCEPT

#
# Accept connections on 1195 for vpn access from client
#
iptables -A INPUT -i eth0 -p udp --dport 1195 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 1195 -m state --state ESTABLISHED -j ACCEPT

#
# Apply forwarding
#
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT     
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 209.177.156.154   
iptables -A FORWARD -j REJECT

#
# Enable forwarding
# 
echo 1 > /proc/sys/net/ipv4/ip_forward

#
# PREROUTE ports
#    
iptables -t nat -A PREROUTING -p udp -m multiport --dports 10001:65535 -j REDIRECT --to-ports 52533

#
# Set default policies for INPUT, FORWARD and OUTPUT chains
#
iptables -P INPUT DROP              
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

#
# IPv6 configuration 
#
ip6tables -F INPUT
ip6tables -F FORWARD
ip6tables -F OUTPUT
ip6tables -F 

echo -n "1" >/proc/sys/net/ipv6/conf/all/forwarding
echo -n "1" >/proc/sys/net/ipv6/conf/all/proxy_ndp
echo -n "0" >/proc/sys/net/ipv6/conf/all/autoconf
echo -n "0" >/proc/sys/net/ipv6/conf/all/accept_ra

ip6tables -A INPUT -p icmpv6 -j ACCEPT
ip6tables -A FORWARD -m state --state NEW -i tun0 -o eth0 -s 2607:f740:101:f::/64 -j ACCEPT
ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT   

ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT DROP
share|improve this question
    
Do you just want to allow access to 22, 80 and 52533 ports or is there anything else also you want to accomplish ? –  GeekRide Dec 26 '12 at 7:56
add comment

1 Answer

Allow output HTTP connection:

first allow to establish connection to remote port:

iptables -A OUTPUT -p tcp --destination-port 80 -j ACCEPT

and accept established sessions:

iptables -A INPUT -p tcp --source-port 80 -m state --state ESTABLISHED,RELATED -j ACCEPT

Do not forget to allow DNS connection (ie 8.8.8.8):

iptables -A INPUT -p udp --source-port 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -d 8.8.8.8 -p udp --destination-port 53 -j ACCEPT

accept all ICMP:

iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.