1

I'm trying to setup generic iptables rules that I can distribute to my little 4 node cluster.

I want all servers to:

  1. accept any traffic on ports 22,80,443

  2. or all traffic if the source is 127.0.0.1

  3. or all traffic is the source is one of the servers in my cluster

  4. anything else I want dropped

iptables -F
iptables -A INPUT -p all -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p all -s <SERVER-A> -j ACCEPT
iptables -A INPUT -p all -s <SERVER-B> -j ACCEPT
iptables -A INPUT -p all -s <SERVER-C> -j ACCEPT
iptables -A INPUT -p all -s <SERVER-D> -j ACCEPT
iptables -A INPUT -j DROP

Does this look correct?

Improve this question

3 Answers 3

Reset to default
1
  1. Get rid of the final rule and make default policy DROP (iptables -P INPUT DROP)
  2. This ruleset won't handle the return packets from outgoing connections; add iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT at the top (unless you want to not allow outgoing connections, in which case some OUTPUT rules would make that clearer).
  3. Make the FORWARD chain policy DROP, just in case someone fat-fingers /proc/sys/net/ipv4/ip_forward.
Improve this answer
3
  • Thankyou for the reply! 2 questions: I'm not sure how to make the default policy DROP like you mentioned. Also iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT doens't seem to work for me, I get this error message: "iptables: No chain/target/match by that name"
    – rizen
    Jan 15, 2010 at 0:28
  • I've added the command you need to set the policy to my answer; I don't know why the ESTABLISHED,RELATED command isn't working for you, it works fine for me. Double check you haven't typo'd it.
    – womble ♦
    Jan 15, 2010 at 0:42
  • womble- i figured out it wasn't working because I'm trying to run it in an openvz container. when I run it on physical HW it works like a charm. Thanks again!!
    – rizen
    Jan 15, 2010 at 0:55
0

I would heartily recommend using a wrapper around IPtables. On its own it gets quite ugly past the simple rules that you need.

We use FireHOL with good results - there are Debian/Ubuntu packages in the default distro, and RHEL/CentOS ones via RPMForge (iirc).

A firehol config for the rules you describe would be along the lines of:

my_ips="<your server list>"
interface any world 
        protection strong 100/sec 50
        policy drop
        server ident reject with tcp-reset
        server ssh accept
        server http accept
        server https accept
        server all accept src "$my_ips"

It's not much harder to create full router rules too - the above example is for a local (non-routing) firewall, as you describe in your question.

FireHOL, and other IPtables wrappers, also tend to add (or make it easy to add) sensible defaults to your firewall rules that will filter known-bad packets - for example the 'protection' line above, which winds up creating many (10+) useful iptables rules.

Another reason I prefer FireHOL is that the configuration file is still just a bash script, allowing the full flexibility of any IPtables shell script that you'd otherwise end up writing.

Improve this answer
0

For your last rule. It would be more internet friendly to REJECT the packet, rather than drop. Something such as...

iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited

Improve this answer

You must log in to answer this question.