-1

I'm building a firewall rule that should drop all outgoing connection except telnet out. [ I know that I ultimately need to drop all input and allow some, but I need to filter output as well ( block all output except some ), this is the requirment plz stick to it.]

so I Google and followed the recommended setting like :

iptables --flush
iptables -P INPUT ACCEPT
iptables -P OUTPUT DROP
iptables -A OUTPUT -o eth0 -p tcp --dport 1234 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i  eth0 -p tcp --dport 1234 -m state --state ESTABLISHED,RELATED -j ACCEPT

PS: 1234 is my test port

I'm able to connect to telnet out

but as soon as I add iptables -P INPUT DROP

I'm unable to connect even though I have the INPUT rule to ACCEPT the Established connection.

where am I going wrong ?

PS: I don't have kernel/iptables LOGGING.

e.g., Drop drop INPUT AND OUTPUT

Also, fedora and redhat will drop both INPUT and OUTPUT to begin with that is the default firewall.

4
  • 1
    Why drop everything from the OUTPUT, except the exceptions? Accepting anything in INPUT? This rules are very strange. They usually drop INPUT with exceptions and allow output.
    – ThoriumBR
    Sep 11, 2014 at 18:57
  • my plan is to add more input rules but I start out with INPUT - DROP , this is not strange. Thats how firewalls are built you start with DROP ALL and add/ACCEPT what you want
    – resultsway
    Sep 11, 2014 at 18:59
  • 1
    Firewalls usually start filtering INPUT, not output (except in a few cases). But what's your plan?
    – ThoriumBR
    Sep 11, 2014 at 19:01
  • sorry, I updated the question, the problem comes after i drop all INPUT eventhough I have specific input rule. +1 for good advice. But it still doesnt solve the technical issue.
    – resultsway
    Sep 11, 2014 at 19:32

4 Answers 4

1

If you want to connect from Server to Port 1234 over TCP and nothing else this shoud work:

iptables -A INPUT -p tcp --sport 1234 -j ACCEPT
iptables -A INPUT -j DROP
iptables -A OUTPUT -p tcp --dport 1234 -j ACCEPT
iptables -A OUTPUT -j DROP
4
  • You understood the question. and you gave a correction OUTPUT goes with --sport (+1) but somehow it still doesnt work. ( just to verify I flush all the rules and iam able to connect to an external telnetd on port 1234)
    – resultsway
    Sep 11, 2014 at 21:05
  • I misunderstood your Question. You want to connect from Server to Port 1234. I had described the other way around. I have update the answer. Sep 11, 2014 at 21:12
  • right on :) I answered my own question in the mean time. Thx.
    – resultsway
    Sep 11, 2014 at 21:15
  • It won't work as planned, unless the client connecting use 1234 as source port and destination port. Filtering INPUT by source port will not work on almost every case.
    – ThoriumBR
    Sep 11, 2014 at 21:27
0

I strongly recommend reading IPTABLES(8) manual by typing man iptables.

or try this:

# iptables -A OUTPUT -p tcp --dport 1234 -j ACCEPT
# iptables -A OUTPUT -p tcp -j DROP

and then

# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]
# 
0

The problem is that you inverted the firewall. You should filter the INPUT, not the output.

This will work:

iptables --flush
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

This rules will allow you to connect to any server, no matter the IP or tcp port, and let only the packets related to your connections get in.

If you want to permit access from external hosts on your port 1234, add this:

iptables -A INPUT -p tcp --dport 1234 -j ACCEPT
1
  • I know that I ultimately need to drop all input and allow some, but I need to filter output as well ( block all output except some ), this is the requirment plz stick to it.
    – resultsway
    Sep 11, 2014 at 20:31
0

The mistake in the above was INPUT goes with --sport not --dport for block all except OUTGOING 1234 port.

iptables -A INPUT -i eth0 -p tcp --sport 1234 -m state --state ESTABLISHED,RELATED -j ACCEPT

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .