0

Does anyone know iptables well? I have a task and I got a little confused with it because I have a quite poor understanding of networking :)

  • i need to limit access to the server for all outgoing connections, except smtp to 587 to its specific address
  • allow access to incoming connections on port 80 from the world, so that certbot can generate certificates for itself without problems
  • allow access to the server from the local work subnet
  • block an access from everything else :)

— what i tried:

  • iptables --append OUTPUT --protocol tcp --src <here is the address of the mail server> --sport 587 --jump ACCEPT
  • IPTABLES -P OUTPUT DROP
  • iptables --append INPUT --protocol tcp --src <local network/24> --dport 22 --jump ACCEPT - to connect with SSH
  • iptables --append INPUT --protocol tcp --dport 80 --jump ACCEPT - to connect to the world for certbot
  • iptables --append INPUT --protocol tcp --src <local network/24> --dst 443 --jump ACCEPT - to provide an access only for work subnet
  • IPTABLES -P INPUT DROP

at the moment, the result is that I cannot open the resource at the address on port 80/443 from the local network and getting ERR_PROXY_CONNECTION_FAILED

2 Answers 2

0

You need to allow the reply traffic too, if want to allow local subnet (10.0.0.0/24) SSH to this host

sudo iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp -m conntrack --ctstate ESTABLISHED -j ACCEPT

For allow incoming HTTP[S] from any IP address

sudo iptables -A INPUT -p tcp --dport 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp -m conntrack --ctstate ESTABLISHED -j ACCEPT
0

Allow outbound traffic in reverse direction from 80, 443 ports so server can reply or it will be dropped by chain's policy.

iptables --append OUTPUT --protocol tcp --sport 80 --jump ACCEPT
iptables --append OUTPUT --protocol tcp --dst <local network/24> --sport 443 --jump ACCEPT

Also you have error here

iptables --append INPUT --protocol tcp --src <local network/24> --dst 443 --jump ACCEPT

change it to

 iptables --append INPUT --protocol tcp --src <local network/24> --dport 443 --jump ACCEPT

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .