I am trying to block the entire Internet on all ports, but allow a multiple ranges to connect on specific ports. I want this ruleset to apply to outbound connections as well (using REJECT
instead of DROP
) as to prevent identification attacks.
*filter
# Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT
# Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow all network traffic
-A INPUT -s 192.168.0.0/24 -j ACCEPT
-A INPUT -d 192.168.0.0/24 -j ACCEPT
# Allow all SSH
-A INPUT -p tcp --dport 22 -j ACCEPT
# Permitted web connections
-A INPUT -s 8.4.0.0/24 -p tcp --dport http -j ACCEPT
-A INPUT -s 8.8.0.0/24 -p tcp --dport http -j ACCEPT
-A INPUT -s 8.4.0.0/24 -p tcp --dport https -j ACCEPT
-A INPUT -s 8.8.0.0/24 -p tcp --dport https -j ACCEPT
-A OUTPUT -s 8.4.0.0/24 -p tcp --dport http -j ACCEPT
-A OUTPUT -s 8.8.0.0/24 -p tcp --dport http -j ACCEPT
-A OUTPUT -s 8.4.0.0/24 -p tcp --dport https -j ACCEPT
-A OUTPUT -s 8.8.0.0/24 -p tcp --dport https -j ACCEPT
# Reject all web not to or from a safe server
-A INPUT -p tcp --dport http -j DROP
-A INPUT -p tcp --dport https -j DROP
-A OUTPUT -p tcp --dport http -j REJECT
-A OUTPUT -p tcp --dport https -j REJECT
# Drop all other inbound - default deny unless explicitly allowed
-A INPUT -j DROP
-A FORWARD -j DROP
COMMIT
The drawback with my very strict policy is the verbosity of adding an additional range. Each range takes four lines of policy to work. Inbound/HTTP, Inbound/HTTPS, Outbound/HTTP, Outbound/HTTP. It's a huge pain to keep straight.
What I would like it something like this:
# Pseucode
*group webservers
8.8.0.0/24
8.4.0.0/24
*filter
-A INPUT -s webservers -p tcp --dport http -j ACCEPT
-A INPUT -s webservers -p tcp --dport http -j ACCEPT
-A OUTPUT -s webservers -p tcp --dport http -j ACCEPT
-A OUTPUT -s webservers -p tcp --dport http -j ACCEPT
Is there an easy way to accomplish this?