I'm looking to set up my IPTables firewall in such a way that:
- Any new
connect()
is accepted - Once data is received:
- If the destination port is on a whitelist, continue allowing the connection and any
RELATED
connections - Otherwise, close/reset the connection
- If the destination port is on a whitelist, continue allowing the connection and any
I've looked around, and even tried a few configurations of my own, but I'm not very familiar with IPTables, and haven't had success. My first attempt was like so:
iptables -F
iptables -A INPUT -I lo -j ACCEPT
iptables -A INPUT -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT //example of allowed port
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
Which as I understand should perform the following:
- Accept all localhost traffic
- Accept all
NEW
connections - Accept all traffic to port
22
- Drop all traffic not handled by port
22
rule - (Set default rules for
INPUT
,FORWARD
, andOUTPUT
chains)
However, connections to port 22 still fail on connect()
. Ideally, communication with 22
should be unhindered, and connect()
to any other port succeeds, but then the connection is closed once send(...)
is called.
iptables -vnL
to look at the counters and possibly put in-j LOG
statements to see what rule gets hit when? I suppose there is a service listening on port 22? :)connect()
will fail, even if IPTables allows the connection attempt through.connect()
will fail if there is nothing listening. iptables is a packet filter, not a connection endpoint.haproxy
in TCP mode will do alot of what you want. You can have it listen on all the ports you are interested in and redirect to real services on a different set of ports or an internal IP.