Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to basically drop all packets, but still allow port 22, 80 and 52533. At the moment this firewall doesn't allow pinging, or for me to use yum update. How can I add that? Also, is there an easier way to open port 80? The current rule seems a bit verbose.

# Flush all current rules from iptables
iptables -F
iptables -t nat -F

# Allow SSH connections on tcp port 22 
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -j ACCEPT

# Open port 80
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s --sport 80 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

# Set access for localhost
iptables -A INPUT -i lo -j ACCEPT

# Accept connections on 1195 for vpn access from client
iptables -A INPUT -i eth0 -p udp --dport 1195 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 1195 -m state --state ESTABLISHED -j ACCEPT

# Apply forwarding
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s -j ACCEPT     
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to   
iptables -A FORWARD -j REJECT

# Enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# PREROUTE ports
iptables -t nat -A PREROUTING -p udp -m multiport --dports 10001:65535 -j REDIRECT --to-ports 52533

# Set default policies for INPUT, FORWARD and OUTPUT chains
iptables -P INPUT DROP              
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# IPv6 configuration 
ip6tables -F INPUT
ip6tables -F FORWARD
ip6tables -F OUTPUT
ip6tables -F 

echo -n "1" >/proc/sys/net/ipv6/conf/all/forwarding
echo -n "1" >/proc/sys/net/ipv6/conf/all/proxy_ndp
echo -n "0" >/proc/sys/net/ipv6/conf/all/autoconf
echo -n "0" >/proc/sys/net/ipv6/conf/all/accept_ra

ip6tables -A INPUT -p icmpv6 -j ACCEPT
ip6tables -A FORWARD -m state --state NEW -i tun0 -o eth0 -s 2607:f740:101:f::/64 -j ACCEPT
ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT   

ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT DROP
share|improve this question
Do you just want to allow access to 22, 80 and 52533 ports or is there anything else also you want to accomplish ? – GeekRide Dec 26 '12 at 7:56

Allow output HTTP connection:

first allow to establish connection to remote port:

iptables -A OUTPUT -p tcp --destination-port 80 -j ACCEPT

and accept established sessions:

iptables -A INPUT -p tcp --source-port 80 -m state --state ESTABLISHED,RELATED -j ACCEPT

Do not forget to allow DNS connection (ie

iptables -A INPUT -p udp --source-port 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -d -p udp --destination-port 53 -j ACCEPT

accept all ICMP:

iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.