Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I used an online tool to create an iptables firewall. Basically I just need port 22 and 1194 open to the outside world. But I noticed this bash script has input, forward and output chains as accept by default. Is it blocking all traffic but those two ports? Thanks.

IPTABLES=/sbin/iptables

# Flush, Init and Zero the 'built-in' chains

$IPTABLES -F INPUT; $IPTABLES -P INPUT ACCEPT; $IPTABLES -Z INPUT
$IPTABLES -F FORWARD; $IPTABLES -P FORWARD ACCEPT; $IPTABLES -Z FORWARD
$IPTABLES -F OUTPUT; $IPTABLES -P OUTPUT ACCEPT; $IPTABLES -Z OUTPUT
$IPTABLES -F -t nat;

# Setup user-defined chains

$IPTABLES -X
$IPTABLES -N LINWIZ-INPUT;
$IPTABLES -N REJECT-PKT;
$IPTABLES -N SYN-FLOOD;

$IPTABLES -A INPUT -j LINWIZ-INPUT

######################################################################
# Allow all loopback interface traffic

$IPTABLES -A LINWIZ-INPUT -i lo -j ACCEPT

# Block all attempts to spoof the loopback address

$IPTABLES -A LINWIZ-INPUT -s 127.0.0.0/8 -j LOG --log-prefix "SPOOFED-LOOPBACK: "
$IPTABLES -A LINWIZ-INPUT -s 127.0.0.0/8 -j DROP
$IPTABLES -A LINWIZ-INPUT -d 127.0.0.0/8 -j LOG --log-prefix "SPOOFED-LOOPBACK: "
$IPTABLES -A LINWIZ-INPUT -d 127.0.0.0/8 -j DROP

# Block all attempts to spoof the local IP address

$IPTABLES -A LINWIZ-INPUT -s 192.73.244.224 -j LOG --log-prefix "SPOOFED-IP: "
$IPTABLES -A LINWIZ-INPUT -s 192.73.244.224 -j DROP

# Block Syn Flood attacks

$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --syn -j SYN-FLOOD

# Ensure that TCP connections start with syn packets

$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp ! --syn -m state --state NEW -j LOG --log- prefix "SYN-EXPECTED: "
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp ! --syn -m state --state NEW -j DROP

# Allow session continuation traffic

$IPTABLES -A LINWIZ-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# Allow selected TCP/IP and/or UDP services

$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 22 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p udp -m udp --dport 1194 -j ACCEPT

# Block all other TCP/IP and UDP traffic

$IPTABLES -A LINWIZ-INPUT -j REJECT-PKT

######################################################################
# Syn flood filtering chain

$IPTABLES -A SYN-FLOOD -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A SYN-FLOOD -j LOG --log-prefix "SYN-FLOOD: "
$IPTABLES -A SYN-FLOOD -j DROP

######################################################################
# Chain used to reject all TCP/IP, UDP and ICMP/PING packets

$IPTABLES -A REJECT-PKT -p tcp -m tcp -j LOG
$IPTABLES -A REJECT-PKT -p tcp -m tcp -j REJECT --reject-with tcp-reset
$IPTABLES -A REJECT-PKT -p udp -m udp -j LOG
$IPTABLES -A REJECT-PKT -p udp -m udp -j REJECT --reject-with icmp-port-unreachable
$IPTABLES -A REJECT-PKT -p icmp -m icmp --icmp-type ping -j LOG
$IPTABLES -A REJECT-PKT -p icmp -m icmp --icmp-type ping -j REJECT --reject-with icmp-host-unreachable

######################################################################
# Forward, NAT and routing

$IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -s 10.8.0.0/24 -j ACCEPT    
$IPTABLES -A FORWARD -j REJECT
$IPTABLES -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to 192.73.244.224
$IPTABLES -t nat -A PREROUTING -p udp --dport 1004:65535 -j REDIRECT --to-port 1194
echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -L -nv:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1    18455 2290K LINWIZ-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1    40199   31M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
2      736 42865 ACCEPT     all  --  *      *       10.8.0.0/24          0.0.0.0/0           
3        0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT 27445 packets, 35M bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain LINWIZ-INPUT (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
2        0     0 LOG        all  --  *      *       127.0.0.0/8          0.0.0.0/0           LOG flags 0 level 4 prefix `SPOOFED-LOOPBACK: ' 
3        0     0 DROP       all  --  *      *       127.0.0.0/8          0.0.0.0/0           
4        0     0 LOG        all  --  *      *       0.0.0.0/0            127.0.0.0/8         LOG flags 0 level 4 prefix `SPOOFED-LOOPBACK: ' 
5        0     0 DROP       all  --  *      *       0.0.0.0/0            127.0.0.0/8         
6        0     0 LOG        all  --  *      *       192.73.244.224       0.0.0.0/0           LOG flags 0 level 4 prefix `SPOOFED-IP: ' 
7        0     0 DROP       all  --  *      *       192.73.244.224       0.0.0.0/0           
8     1160 69580 SYN-FLOOD  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x02 
9        0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:!0x17/0x02 state NEW LOG flags 0 level 4 prefix `SYN-EXPECTED: ' 
10       0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:!0x17/0x02 state NEW 
11   17245 2216K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
12       3   180 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22 
13      33  2330 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:1194 
14     771 47070 REJECT-PKT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain REJECT-PKT (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1      767 46830 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp LOG flags 0 level 4 
2      767 46830 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp reject-with tcp-reset 
3        0     0 LOG        udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp LOG flags 0 level 4 
4        0     0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp reject-with icmp-port-unreachable 
5        4   240 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 8 LOG flags 0 level 4 
6        4   240 REJECT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 8 reject-with icmp-host-unreachable 

Chain SYN-FLOOD (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1      758 45460 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           limit: avg 1/sec burst 4 
2      402 24120 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 prefix `SYN-FLOOD: ' 
3      402 24120 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0
share|improve this question
    
Wouldn't it make (more) sense to run the script and show us the output of iptables -L -nv --line-numbers? –  Hauke Laging Feb 20 '13 at 0:23
    
good point, moment –  dermovate Feb 20 '13 at 0:29

2 Answers 2

These types of auto-generation systems frequently create some pretty overly complex and scary output. This results in output that is both hard to read and hard to maintain. Unfortunately this may result in either a firewall config that is too difficult for you to maintain, resulting in stale configs, or even worse not doing what you think it should be doing.

You actually have some pretty simple requirements, two ports most certainly do not need 83 lines. So to get away from the cumbersome config that the program generated for you my advice would be to scrap it and build your own by hand. For your purposes iptables is actually quite simple and the resulting config will actually be understandable. In addition to the two ports you want I would recommend allowing ICMP. The Internet was designed with the idea of a fully functional ICMP in mind. Restrict ping if you want but blocking ICMP entirely can cause other problems.

Your output is actually a shell script that sets up the firewall from scratch, but for simplicity I'm just going to use what you might find in /etc/sysconfig/iptables on a RedHat derivative. It's very similar, but slightly cleaned up. If you require it to be a script you should be able to add the relevant $IPTABLES as needed. Here's what you should probably start with.

*filter
:INPUT ACCEPT
:FORWARD DROP
:OUTPUT ACCEPT

# Allow SSH from a couple of different addresses and address blocks.
# Remove '-s XXXXX' to allow access from everywhere
-A INPUT  -s 10.10.1.5 -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT  -s 10.10.50.0/24 -m tcp -p tcp --dport 22 -j ACCEPT

# Allow 1194 from the same hosts 
-A INPUT  -s 10.10.1.5 -m udp -p udp --dport 1194 -j ACCEPT
-A INPUT  -s 10.10.50.0/24 -m udp -p udp --dport 1194 -j ACCEPT

# Now we'll block ICMP echo request (ping) then allow all other ICMP
-A INPUT -p icmp --icmp-type 8 -j DROP  
-A INPUT -p icmp -j ACCEPT  

# Log everything else and drop it with no error code response.
-A INPUT -j LOG --log-level 7 --log-prefix "IPTABLES Dropped: "
-A INPUT -j DROP
COMMIT

There, a mere 22 lines, still includes comments for documentation, and does exactly what you need it to. I might also mention a fantastic blog post on the IT Security community blog Base Rulesets in IPTables

share|improve this answer

It seems braindead to me to react to a ping with icmp-host-unreachable (with the pinged IP as source address...).

To answer your question: This script blocks everything except tcp(22), udp(1194) and icmp(all but ping). It also does NAT for machines in 10.8.0.0/8 by fowarding packets received from the given range and putting its own public IP 192.73.244.224. Further, the script also redirects all requests coming to UDP ports in range 1024:6535 to port 1194(VPN). Whether it makes sense to block echo requests and leave all other ICMP packets through is another question...

share|improve this answer
    
It might be brain dead, I don't know, as i said it was generated by an online utility. I believe it does block ping as after running that script I can no longer ping the server. –  dermovate Feb 20 '13 at 0:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.