0

I'd like to block everything outgoing from my server while still allowing responses to incoming http/https requests.

Some examples:

User calls my server using his browser (https://myserver.example.org/test.html) Firewall should allow a response and server should deliver test.html to user.

Application on my server tries to connect to https://badguy.example.org/test.html Firewall should deny this outgoing request because badguy.example.org didn't request anything from my server.

I don't want that to be based on IPs or IP ranges. Just if server is contacted from an ip, it is allowed to respond. If he hasn't been contacted by this ip before, it is not allowed to send anything there.

Is this possibe using ufw or iptables? How do I do that?

0

The key is the flag --state ESTABLISHED in the OUTPUT chain which allow only ESTABLISHED connections not new ones.

(OPTIONAL) Allow login via SSH for administration's tasks,

iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

Allow HTTP traffic

iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

Allow HTTPS traffic

iptables -A INPUT -i eth0 -p tcp --dport 443-m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 443-m state --state ESTABLISHED -j ACCEPT

Block outgoing http/https requests originated from your server.

iptables -A OUTPUT -o eth0 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -j DROP
|improve this answer|||||
  • It works. Many thanks! – Mike Kruger Mar 26 at 20:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.