IPTables Configuration to allow all connections, only close/deny once data is sent

Question

I'm looking to set up my IPTables firewall in such a way that:

• Any new connect() is accepted
• Once data is received:
  • If the destination port is on a whitelist, continue allowing the connection and any RELATED connections
  • Otherwise, close/reset the connection

---

I've looked around, and even tried a few configurations of my own, but I'm not very familiar with IPTables, and haven't had success. My first attempt was like so:

iptables -F
iptables -A INPUT -I lo -j ACCEPT
iptables -A INPUT -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT //example of allowed port
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

Which as I understand should perform the following:

• Accept all localhost traffic
• Accept all NEW connections
• Accept all traffic to port 22
• Drop all traffic not handled by port 22 rule
• (Set default rules for INPUT, FORWARD, and OUTPUT chains)

However, connections to port 22 still fail on connect(). Ideally, communication with 22 should be unhindered, and connect() to any other port succeeds, but then the connection is closed once send(...) is called.

Answer 1

Your setup will probably do what you want, once you have a service listening on the concerned port(s). Iptables is a packet filter, not a connection endpoint.