iptables to secure nginx server

Question

Does anyone know iptables well? I have a task and I got a little confused with it because I have a quite poor understanding of networking :)

• i need to limit access to the server for all outgoing connections, except smtp to 587 to its specific address
• allow access to incoming connections on port 80 from the world, so that certbot can generate certificates for itself without problems
• allow access to the server from the local work subnet
• block an access from everything else :)

— what i tried:

• iptables --append OUTPUT --protocol tcp --src <here is the address of the mail server> --sport 587 --jump ACCEPT
• IPTABLES -P OUTPUT DROP
• iptables --append INPUT --protocol tcp --src <local network/24> --dport 22 --jump ACCEPT - to connect with SSH
• iptables --append INPUT --protocol tcp --dport 80 --jump ACCEPT - to connect to the world for certbot
• iptables --append INPUT --protocol tcp --src <local network/24> --dst 443 --jump ACCEPT - to provide an access only for work subnet
• IPTABLES -P INPUT DROP

at the moment, the result is that I cannot open the resource at the address on port 80/443 from the local network and getting ERR_PROXY_CONNECTION_FAILED

Answer 1

You need to allow the reply traffic too, if want to allow local subnet (10.0.0.0/24) SSH to this host

sudo iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp -m conntrack --ctstate ESTABLISHED -j ACCEPT

For allow incoming HTTP[S] from any IP address

sudo iptables -A INPUT -p tcp --dport 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp -m conntrack --ctstate ESTABLISHED -j ACCEPT

Answer 2

Allow outbound traffic in reverse direction from 80, 443 ports so server can reply or it will be dropped by chain's policy.

iptables --append OUTPUT --protocol tcp --sport 80 --jump ACCEPT
iptables --append OUTPUT --protocol tcp --dst <local network/24> --sport 443 --jump ACCEPT

Also you have error here

iptables --append INPUT --protocol tcp --src <local network/24> --dst 443 --jump ACCEPT

change it to

 iptables --append INPUT --protocol tcp --src <local network/24> --dport 443 --jump ACCEPT