Currently we are using basically OUTPUT default policy, ACCEPT.
That's enough for OUTPUT because Netfilter doesn't need special rules to start stateful connections tracking.
But if you want to filter out inbound traffic according to "default deny" policy it can be done with switching INPUT
-chain to DROP
: iptables -P INPUT DROP
Afterwards it all would be set with just 2 rules:
iptables -A INPUT -j ACCEPT -i lo
iptables -A INPUT -j ACCEPT -m state --state RELATED,ESTABLISHED
Pay your attention to the rule allowing input traffic on loopback interface — as I pointed out in my blog posting "Minimal firewall for end user", unless allowed explicitly, loopback traffic won't be handled by "established" state checking, compared to return traffic over, say, eth0
.
To ensure this minimal ruleset is loaded "as is" w/o interfering with rules that already might be there, it's convenient to make use of iptables-restore
in SHELL-session:
lptables-restore <<__EOF__
-P INPUT DROP
-A INPUT -j ACCEPT -i lo
-A INPUT -j ACCEPT -m state --state RELATED,ESTABLISHED
__EOF__
Before doing that make sure you won't cut your own networking connection1, although already open SSH sessions should continue to work normally, the attempts to open new ones won't work.
__
- Of course you can add other rules to allow such connections. It can be as simple as just
-A INPUT -j ACCEPT -p tcp --dport 22
— no need to tinker with -m state
here. Also don't forget to fix lptables-restore
back to iptables-restore
before trying it out ;)