5

I would like to do the following, but I'm having a hard time doing so using iptables in CentOS:

  1. I would like to accept inbound only port 80,443,22, snmp, 3306 to my server
  2. I would like to be able to allow all outbound ports
  3. I would like all other inbound connection to be dropped
2
  • You have given a list of ports, but not protocols. 80, 443, 22 and 3306 are normally used as TCP ports. However SNMP often uses UDP. Whenever giving ports it's good to get into the habit of saying "tcp/3306, udp/161, etc", then there is no confusion.
    – Coops
    Aug 12, 2011 at 21:05
  • You don't say what role the server will play (I presume a LAMP server given the incoming ports). However from a security perspective filtering your outgoing traffic can be as useful as filtering your incoming traffic. Many times I've seen a compromised server made redundant as the hack depends on being able to communicate outbound on a specific port (often the IRC port) in order to take remote control of the server -- but the FW only allows outward traffic on certain ports.
    – Coops
    Aug 12, 2011 at 21:10

4 Answers 4

7

Open your iptables(/etc/sysconfig/iptables) and add the following lines below (-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT) line:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 161 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 161 -j ACCEPT

Restart the iptables:

service iptables restart

By default, your iptables allow all outbound ports.

6
  • errr...how do you know it's RH? Jun 19, 2011 at 20:54
  • It's in the title. :)
    – garconcn
    Jun 19, 2011 at 21:34
  • 2
    doh! you mean the thing in bold letters at the top...I knew it means something. I'm so blind today! Jun 19, 2011 at 21:52
  • thanks but I stll can ftp to my server. I want to block everthing else
    – edotan
    Jun 20, 2011 at 9:20
  • @Elad, can you show your iptables with command "iptables -L"? You can delete INPUT line with --dport 21 or 20
    – garconcn
    Jun 20, 2011 at 20:22
1

lokkit will give you a simple interface to configure iptables with.

1
  1. I would like to accept inbound only port 80,443,22, snmp, 3306 to my server.
  2. I would like to be able to allow all outbound ports
  3. I would like all other inbound connection to be dropped.

Put this rules in a shell script....

#!/bin/bash

# 3

iptables -P INPUT DROP

iptables -P FORWARD DROP

# 2

iptables -P OUTPUT ACCEPT

iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED

iptables -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED

# 1 (change eth0 for your interface)

iptables -A INPUT -j ACCEPT -i eth0 -p tcp -m multiport --dport 80,443,22,161,3306

0

The answers given already will definitely do what you need. But really, you should understand how your firewall works if you're going to administrate it. Surprisingly, the CentOS documentation for setting up IPTABLES is easy to understand and gives a good base for getting it set up. So instead of just taking these guys' word for it and sticking these firewall rules up, read a bit and find out what they are doing.

http://wiki.centos.org/HowTos/Network/IPTables

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .