0

I am trying to only allow certain IPs to access port 8209. I have tried a few different methods that I read on ServerFault. This method is the most recent one I have tried.

I manually edited my configuration file by adding follow lines:

-N xxx # create a new chain
-A xxx --src 50.88.183.6 -j ACCEPT  # allow 20.88.183.6
-A xxx --src 97.68.205.177 -j ACCEPT  # allow 87.68.205.177 
-A xxx --src 38.103.14.231 -j ACCEPT  # allow 49.103.14.231
-A xxx -j DROP  # drop everyone else
-I INPUT -m tcp -p tcp --dport 8209 -j xxx  # use chain xxx for packets coming to TCP port 8209

After adding the lines, I restarted Iptables and it did not work, I could still access it from any IP. I am not sure if it is just the wrong configuration or placement in the files matters.

Incase placement in the file matters, I placed it near the top of the configuration directly below these lines

:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [302211:210610546]
:RH-Firewall-1-INPUT - [0:0]
:acctboth - [0:0]
:cP-Firewall-1-INPUT - [0:0]

And above this line:

-A INPUT -p tcp -m tcp --dport 49152:65534 -j ACCEPT 
-A INPUT -j cP-Firewall-1-INPUT 
-A INPUT -j acctboth 
-A INPUT -j RH-Firewall-1-INPUT 

Here is the output for command iptables -L -n -v

Chain INPUT (policy ACCEPT 63019 packets, 7491K bytes)
 pkts bytes target     prot opt in     out     source               destination         
60060 6425K acctboth   all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 44033 packets, 85M bytes)
 pkts bytes target     prot opt in     out     source               destination         
41960   82M acctboth   all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain acctboth (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0            tcp  --  !lo    *       23.253.74.239        0.0.0.0/0           tcp dpt:80 
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.74.239       tcp spt:80 
    0     0            tcp  --  !lo    *       23.253.74.239        0.0.0.0/0           tcp dpt:25 
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.74.239       tcp spt:25 
    0     0            tcp  --  !lo    *       23.253.74.239        0.0.0.0/0           tcp dpt:110 
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.74.239       tcp spt:110 
    0     0            icmp --  !lo    *       23.253.74.239        0.0.0.0/0           
    0     0            icmp --  !lo    *       0.0.0.0/0            23.253.74.239       
    2   216            tcp  --  !lo    *       23.253.74.239        0.0.0.0/0           
    3   268            tcp  --  !lo    *       0.0.0.0/0            23.253.74.239       
    0     0            udp  --  !lo    *       23.253.74.239        0.0.0.0/0           
    0     0            udp  --  !lo    *       0.0.0.0/0            23.253.74.239       
    2   216            all  --  !lo    *       23.253.74.239        0.0.0.0/0           
    3   268            all  --  !lo    *       0.0.0.0/0            23.253.74.239       
    0     0            tcp  --  !lo    *       23.253.72.112        0.0.0.0/0           tcp dpt:80 
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.72.112       tcp spt:80 
    0     0            tcp  --  !lo    *       23.253.72.112        0.0.0.0/0           tcp dpt:25 
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.72.112       tcp spt:25 
    0     0            tcp  --  !lo    *       23.253.72.112        0.0.0.0/0           tcp dpt:110 
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.72.112       tcp spt:110 
    0     0            icmp --  !lo    *       23.253.72.112        0.0.0.0/0           
    0     0            icmp --  !lo    *       0.0.0.0/0            23.253.72.112       
    0     0            tcp  --  !lo    *       23.253.72.112        0.0.0.0/0           
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.72.112       
    0     0            udp  --  !lo    *       23.253.72.112        0.0.0.0/0           
    0     0            udp  --  !lo    *       0.0.0.0/0            23.253.72.112       
    0     0            all  --  !lo    *       23.253.72.112        0.0.0.0/0           
    0     0            all  --  !lo    *       0.0.0.0/0            23.253.72.112       
    0     0            tcp  --  !lo    *       23.253.72.149        0.0.0.0/0           tcp dpt:80 
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.72.149       tcp spt:80 
    0     0            tcp  --  !lo    *       23.253.72.149        0.0.0.0/0           tcp dpt:25 
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.72.149       tcp spt:25 
    0     0            tcp  --  !lo    *       23.253.72.149        0.0.0.0/0           tcp dpt:110 
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.72.149       tcp spt:110 
    0     0            icmp --  !lo    *       23.253.72.149        0.0.0.0/0           
    0     0            icmp --  !lo    *       0.0.0.0/0            23.253.72.149       
    0     0            tcp  --  !lo    *       23.253.72.149        0.0.0.0/0           
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.72.149       
    0     0            udp  --  !lo    *       23.253.72.149        0.0.0.0/0           
    0     0            udp  --  !lo    *       0.0.0.0/0            23.253.72.149       
    0     0            all  --  !lo    *       23.253.72.149        0.0.0.0/0           
    0     0            all  --  !lo    *       0.0.0.0/0            23.253.72.149       
    0     0            tcp  --  !lo    *       23.253.72.81         0.0.0.0/0           tcp dpt:80 
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.72.81        tcp spt:80 
    0     0            tcp  --  !lo    *       23.253.72.81         0.0.0.0/0           tcp dpt:25 
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.72.81        tcp spt:25 
    0     0            tcp  --  !lo    *       23.253.72.81         0.0.0.0/0           tcp dpt:110 
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.72.81        tcp spt:110 
    0     0            icmp --  !lo    *       23.253.72.81         0.0.0.0/0           
    0     0            icmp --  !lo    *       0.0.0.0/0            23.253.72.81        
    0     0            tcp  --  !lo    *       23.253.72.81         0.0.0.0/0           
    0     0            tcp  --  !lo    *       0.0.0.0/0            23.253.72.81        
    0     0            udp  --  !lo    *       23.253.72.81         0.0.0.0/0           
    0     0            udp  --  !lo    *       0.0.0.0/0            23.253.72.81        
    0     0            all  --  !lo    *       23.253.72.81         0.0.0.0/0           
    0     0            all  --  !lo    *       0.0.0.0/0            23.253.72.81        
    0     0            tcp  --  !lo    *       10.208.37.124        0.0.0.0/0           tcp dpt:80 
    0     0            tcp  --  !lo    *       0.0.0.0/0            10.208.37.124       tcp spt:80 
    0     0            tcp  --  !lo    *       10.208.37.124        0.0.0.0/0           tcp dpt:25 
    0     0            tcp  --  !lo    *       0.0.0.0/0            10.208.37.124       tcp spt:25 
    0     0            tcp  --  !lo    *       10.208.37.124        0.0.0.0/0           tcp dpt:110 
    0     0            tcp  --  !lo    *       0.0.0.0/0            10.208.37.124       tcp spt:110 
    0     0            icmp --  !lo    *       10.208.37.124        0.0.0.0/0           
    0     0            icmp --  !lo    *       0.0.0.0/0            10.208.37.124       
    0     0            tcp  --  !lo    *       10.208.37.124        0.0.0.0/0           
    0     0            tcp  --  !lo    *       0.0.0.0/0            10.208.37.124       
    0     0            udp  --  !lo    *       10.208.37.124        0.0.0.0/0           
    0     0            udp  --  !lo    *       0.0.0.0/0            10.208.37.124       
    0     0            all  --  !lo    *       10.208.37.124        0.0.0.0/0           
    0     0            all  --  !lo    *       0.0.0.0/0            10.208.37.124       
    5   484            all  --  !lo    *       0.0.0.0/0            0.0.0.0/0 

Here is the full output of the configuration:

# Generated by iptables-save v1.3.5 on Wed Jan  8 20:49:24 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [302211:210610546]
:RH-Firewall-1-INPUT - [0:0]
:acctboth - [0:0]
:cP-Firewall-1-INPUT - [0:0]
-N xxx # create a new chain
-A xxx --src 50.88.183.6 -j ACCEPT  # allow 20.88.183.6
-A xxx --src 97.68.205.177 -j ACCEPT  # allow 87.68.205.177 
-A xxx --src 38.103.14.231 -j ACCEPT  # allow 39.103.14.231
-A xxx -j DROP  # drop everyone else
-I INPUT -m tcp -p tcp --dport 8209 -j xxx  # use chain xxx for packets coming to TCP port 8209
-A INPUT -p tcp -s 20.88.183.6 -j ACCEPT 
-A INPUT -p tcp -s 87.68.205.177 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 49152:65534 -j ACCEPT 
-A INPUT -j cP-Firewall-1-INPUT 
-A INPUT -j acctboth 
-A INPUT -j RH-Firewall-1-INPUT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -s 220.177.198.26 -j DROP 
-A INPUT -p tcp -s 115.239.248.121 -j DROP 
-A INPUT -p tcp -s 222.186.56.33 -j DROP 
-A FORWARD -j cP-Firewall-1-INPUT 
-A FORWARD -j RH-Firewall-1-INPUT 
-A OUTPUT -j acctboth 
-A RH-Firewall-1-INPUT -i lo -j ACCEPT 
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT 
-A RH-Firewall-1-INPUT -p esp -j ACCEPT 
-A RH-Firewall-1-INPUT -p ah -j ACCEPT 
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT 
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT 
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT 
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8209 -j ACCEPT 
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited 
-A acctboth -s 23.253.74.239 -i ! lo -p tcp -m tcp --dport 80 
-A acctboth -d 23.253.74.239 -i ! lo -p tcp -m tcp --sport 80 
-A acctboth -s 23.253.74.239 -i ! lo -p tcp -m tcp --dport 25 
-A acctboth -d 23.253.74.239 -i ! lo -p tcp -m tcp --sport 25 
-A acctboth -s 23.253.74.239 -i ! lo -p tcp -m tcp --dport 110 
-A acctboth -d 23.253.74.239 -i ! lo -p tcp -m tcp --sport 110 
-A acctboth -s 23.253.74.239 -i ! lo -p icmp 
-A acctboth -d 23.253.74.239 -i ! lo -p icmp 
-A acctboth -s 23.253.74.239 -i ! lo -p tcp 
-A acctboth -d 23.253.74.239 -i ! lo -p tcp 
-A acctboth -s 23.253.74.239 -i ! lo -p udp 
-A acctboth -d 23.253.74.239 -i ! lo -p udp 
-A acctboth -s 23.253.74.239 -i ! lo 
-A acctboth -d 23.253.74.239 -i ! lo 
-A acctboth -s 10.208.37.124 -i ! lo -p tcp -m tcp --dport 80 
-A acctboth -d 10.208.37.124 -i ! lo -p tcp -m tcp --sport 80 
-A acctboth -s 10.208.37.124 -i ! lo -p tcp -m tcp --dport 25 
-A acctboth -d 10.208.37.124 -i ! lo -p tcp -m tcp --sport 25 
-A acctboth -s 10.208.37.124 -i ! lo -p tcp -m tcp --dport 110 
-A acctboth -d 10.208.37.124 -i ! lo -p tcp -m tcp --sport 110 
-A acctboth -s 10.208.37.124 -i ! lo -p icmp 
-A acctboth -d 10.208.37.124 -i ! lo -p icmp 
-A acctboth -s 10.208.37.124 -i ! lo -p tcp 
-A acctboth -d 10.208.37.124 -i ! lo -p tcp 
-A acctboth -s 10.208.37.124 -i ! lo -p udp 
-A acctboth -d 10.208.37.124 -i ! lo -p udp 
-A acctboth -s 10.208.37.124 -i ! lo 
-A acctboth -d 10.208.37.124 -i ! lo 
-A acctboth -i ! lo 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2078 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2082 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2077 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 26 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8209 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2086 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2087 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2095 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 465 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2096 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT 
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2083 -j ACCEPT 
-A cP-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT 
COMMIT
# Completed on Wed Jan  8 20:49:24 2014
# Generated by iptables-save v1.3.5 on Wed Jan  8 20:49:24 2014
*nat
:PREROUTING ACCEPT [10751:641344]
:POSTROUTING ACCEPT [6174:435114]
:OUTPUT ACCEPT [6174:435114]
COMMIT
10
  • 3
    Placement does matter, which makes it very hard to diagnose from a partial set of rules. Please paste into your question the output of iptables -L -n -v.
    – MadHatter
    Apr 13, 2014 at 16:13
  • Seems like --src should -s. Not clear on where --src came from, but perhaps a variation on --src-range? Apr 13, 2014 at 17:10
  • @MadHatter I pasted the full config as you requested. thanks Apr 13, 2014 at 17:20
  • Michael, thanks, but that's not what I asked for; you would be amazed how often there are differences between the config'ed firewall and the live one. iptables -L -n -v, please.
    – MadHatter
    Apr 13, 2014 at 18:57
  • @MadHatter Sorry about that... I just updated it Apr 13, 2014 at 19:09

2 Answers 2

1

OK, the main issue is that right now your firewall is doing precisely nothing. The INPUT chain contains exactly one rule, which sends your traffic to a chain called acctboth. That chain contains a bunch of rules, none of which has a dispositive target, so all packets will fall through it and go back to the default policy, which on that chain (as all other chains) is ACCEPT.

The upshot is that this machine is completely unfirewalled.

Why there is such a mismatch between the "firewall config" you show, and your live ruleset, I don't know. You haven't told us what file that config ruleset came from, so we have no idea whether or not there's an issue with loading from the config file. It is pretty clear that you're making no difference to the live ruleset by the edits you're making. All we know for sure is that your machine is completely unfirewalled.

Also, your server is running CentOS 6.2, which is nearly two years past end-of-life.

Please don't take this too much to heart, but it looks like you're really out of your depth. Get some professional assistance with this machine, because at the moment, it's wide open and unpatched.

0

This is the dump of a generic iptables ruleset I use for web servers. Note I have an SSH war dialing detection ruleset in place named SSH_CHECK that may not be applicable to your issue, but wanted to set it here anyway as part of my complete ruleset.

# Generated by iptables-save v1.4.12 on Sun Apr  6 11:50:24 2014
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [3:198]
:POSTROUTING ACCEPT [3:198]
COMMIT
# Completed on Sun Apr  6 11:50:24 2014
# Generated by iptables-save v1.4.12 on Sun Apr  6 11:50:24 2014
*mangle
:PREROUTING ACCEPT [22:1475]
:INPUT ACCEPT [22:1475]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [21:3342]
:POSTROUTING ACCEPT [21:3342]
COMMIT
# Completed on Sun Apr  6 11:50:24 2014
# Generated by iptables-save v1.4.12 on Sun Apr  6 11:50:24 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [21:3342]
:SSH_CHECK - [0:0]
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j SSH_CHECK
-A INPUT -j TOR
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A INPUT -p esp -j ACCEPT
-A INPUT -p ah -j ACCEPT
-A INPUT -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j TOR
-A SSH_CHECK -m recent --set --name SSH --rsource
-A SSH_CHECK -m recent --update --seconds 60 --hitcount 4 --name SSH --rsource -j DROP
COMMIT
# Completed on Sun Apr  6 11:50:24 2014

Looking at your rules, perhaps you can try placing the values directly into the INPUT chain like so:

-A INPUT -s 50.88.183.6 -m tcp -j ACCEPT  # allow 20.88.183.6
-A INPUT -s 97.68.205.177 -m tcp -j ACCEPT  # allow 87.68.205.177 
-A INPUT -s 38.103.14.231 -m tcp -j ACCEPT  # allow 49.103.14.231

Note how I am explicitly setting the INPUT chain, using -s instead of --src as yours has & I am also explicitly setting -m tcp.

Also, since you are explicit granting about access to port 8209 maybe this would work for you directly on the INPUT chain:

-A INPUT -s 50.88.183.6 -m tcp --dport 8209 -j ACCEPT  # allow 20.88.183.6
-A INPUT -s 97.68.205.177 -m tcp --dport 8209 -j ACCEPT  # allow 87.68.205.177 
-A INPUT -s 38.103.14.231 -m tcp --dport 8209 -j ACCEPT  # allow 49.103.14.231
2
  • My problem right now is that any IP can access port 8209, so maybe I don't have it setup correctly to block all other IPs to that port. I am not sure. I have very little iptables experience. Apr 13, 2014 at 17:51
  • Also, I did paste the entire configuration above Apr 13, 2014 at 17:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .