2

This is probably as basic as it gets but I'm a developer and really have no experience with iptbles.

The only connections I need opened are:

eth0 (outward facing)

  1. ssh
  2. ping
  3. SSL to tomcat (forward port 443 to 8443)

eth1(local subnet)

  1. connection to postgres server

Everything else should be blocked. My current attempts seem to be leaving all other ports open. I wonder what gives.

Thanks serverfault!

Improve this question

6 Answers 6

Reset to default
2 
# Block incoming on eth0
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 8443 -j ACCEPT

# Block incoming on eth1
iptables -A INPUT -i eth1 -p tcp --dport 5432 -j ACCEPT

# Block everything by default
iptables -j INPUT -i eth0 -j DROP
iptables -j INPUT -i eth1 -j DROP

# NAT
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443

Note: I did what you said, but you may want to allow all icmp packets, they're sometimes useful.

Note 2: I assume "postgres server" is the same host.

Improve this answer
2
  • I think you should add the state rules to track NEW, RELATED and ESTABLILISHED connections on this rules, and redirecting the port for SSL doesn't seem right to me, either run Tomcat on 443 or use something (nginx, pound, apache) to answer the answer the SSL on port 443 and reverse proxy Tomcat.
    – coredump
    Sep 12, 2010 at 14:26
  • You might want to add "iptables -A INPUT -i eth0 -p icmp --icmp-type fragmentation-needed -j ACCEPT".
    – Gerald Combs
    Sep 12, 2010 at 15:34
0

Once you've put those rules in place you either have to put a rule that jumps to REJECT or DROP, or you have to change the chain's default policy (-P).

Improve this answer
2
  • Do you have an example I could look at? Is there an easier way to configure something simple like this on centos?
    – bdd
    May 23, 2010 at 5:45
  • The built-in firewall tool (lokkit, or whatever it's called in 5.x) can set up the simple pass-through rules, and editing the file in /etc/sysconfig will allow you to tweak the rules to add the interface. You'll have to add the port remap rule yourself though. Or you could always try something like fwbuilder if you don't want to deal with the iptables command line.
    – Ignacio Vazquez-Abrams
    May 23, 2010 at 5:49
0

try the linux program ufw, it makes configuring iptables much easier

Improve this answer
1
  • 1
    I think UFW does not work with centOS--only ubuntu.
    – bdd
    May 23, 2010 at 16:29
0

We need to know what you already have.

And we aren't going to write out these rules for you. If you want someone to write iptables rules for you, hire a consultant.

So let's see what you have already.

If this is CentOS as I think you are suggesting, you could show us either /etc/sysconfig/iptables, or the output of both

iptables -L -vn

And 

iptables -L -vn -t nat
Improve this answer
0

Try this site for a clean startup configuration: http://www.mista.nu/iptables/

Improve this answer
0 
iptables -P INPUT DROP # drop will be default policy
iptables -i eth0 -A INPUT -p tcp --dport 22 -j ACCEPT # ssh
iptables -i eth0 -A INPUT -p tcp --dport 443 -j ACCEPT # delete this if prerouting works
iptables -i eth0 -A INPUT -p tcp --dport 8443 -j ACCEPT # 8443
iptables -i eth0 -A INPUT -p icmp --icmp-type 8 -j ACCEPT # ping
iptables -i eth1 -A INPUT -j ACCEPT # all from eth1

#route port 443 to 8443 from eth0

iptables -t nat -i eth0 -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .