iptables question

Question

I'm trying to setup generic iptables rules that I can distribute to my little 4 node cluster.

I want all servers to:

1. accept any traffic on ports 22,80,443

2. or all traffic if the source is 127.0.0.1

3. or all traffic is the source is one of the servers in my cluster

4. anything else I want dropped

---

iptables -F
iptables -A INPUT -p all -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p all -s <SERVER-A> -j ACCEPT
iptables -A INPUT -p all -s <SERVER-B> -j ACCEPT
iptables -A INPUT -p all -s <SERVER-C> -j ACCEPT
iptables -A INPUT -p all -s <SERVER-D> -j ACCEPT
iptables -A INPUT -j DROP

Does this look correct?

Answer 1

1. Get rid of the final rule and make default policy DROP (iptables -P INPUT DROP)
2. This ruleset won't handle the return packets from outgoing connections; add iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT at the top (unless you want to not allow outgoing connections, in which case some OUTPUT rules would make that clearer).
3. Make the FORWARD chain policy DROP, just in case someone fat-fingers /proc/sys/net/ipv4/ip_forward.

Answer 2

I would heartily recommend using a wrapper around IPtables. On its own it gets quite ugly past the simple rules that you need.

We use FireHOL with good results - there are Debian/Ubuntu packages in the default distro, and RHEL/CentOS ones via RPMForge (iirc).

A firehol config for the rules you describe would be along the lines of:

my_ips="<your server list>"
interface any world 
        protection strong 100/sec 50
        policy drop
        server ident reject with tcp-reset
        server ssh accept
        server http accept
        server https accept
        server all accept src "$my_ips"

It's not much harder to create full router rules too - the above example is for a local (non-routing) firewall, as you describe in your question.

FireHOL, and other IPtables wrappers, also tend to add (or make it easy to add) sensible defaults to your firewall rules that will filter known-bad packets - for example the 'protection' line above, which winds up creating many (10+) useful iptables rules.

Another reason I prefer FireHOL is that the configuration file is still just a bash script, allowing the full flexibility of any IPtables shell script that you'd otherwise end up writing.

Answer 3

For your last rule. It would be more internet friendly to REJECT the packet, rather than drop. Something such as...

iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited