This is probably as basic as it gets but I'm a developer and really have no experience with iptbles.

The only connections I need opened are:

eth0 (outward facing)

  1. ssh
  2. ping
  3. SSL to tomcat (forward port 443 to 8443)

eth1(local subnet)

  1. connection to postgres server

Everything else should be blocked. My current attempts seem to be leaving all other ports open. I wonder what gives.

Thanks serverfault!

# Block incoming on eth0
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 8443 -j ACCEPT

# Block incoming on eth1
iptables -A INPUT -i eth1 -p tcp --dport 5432 -j ACCEPT

# Block everything by default
iptables -j INPUT -i eth0 -j DROP
iptables -j INPUT -i eth1 -j DROP

iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443

Note: I did what you said, but you may want to allow all icmp packets, they're sometimes useful.

Note 2: I assume "postgres server" is the same host.

  • I think you should add the state rules to track NEW, RELATED and ESTABLILISHED connections on this rules, and redirecting the port for SSL doesn't seem right to me, either run Tomcat on 443 or use something (nginx, pound, apache) to answer the answer the SSL on port 443 and reverse proxy Tomcat. – coredump Sep 12 '10 at 14:26
  • You might want to add "iptables -A INPUT -i eth0 -p icmp --icmp-type fragmentation-needed -j ACCEPT". – Gerald Combs Sep 12 '10 at 15:34

Once you've put those rules in place you either have to put a rule that jumps to REJECT or DROP, or you have to change the chain's default policy (-P).

  • Do you have an example I could look at? Is there an easier way to configure something simple like this on centos? – bdd May 23 '10 at 5:45
  • The built-in firewall tool (lokkit, or whatever it's called in 5.x) can set up the simple pass-through rules, and editing the file in /etc/sysconfig will allow you to tweak the rules to add the interface. You'll have to add the port remap rule yourself though. Or you could always try something like fwbuilder if you don't want to deal with the iptables command line. – Ignacio Vazquez-Abrams May 23 '10 at 5:49

try the linux program ufw, it makes configuring iptables much easier

  • 1
    I think UFW does not work with centOS--only ubuntu. – bdd May 23 '10 at 16:29

We need to know what you already have.

And we aren't going to write out these rules for you. If you want someone to write iptables rules for you, hire a consultant.

So let's see what you have already.

If this is CentOS as I think you are suggesting, you could show us either /etc/sysconfig/iptables, or the output of both

iptables -L -vn


iptables -L -vn -t nat

Try this site for a clean startup configuration: http://www.mista.nu/iptables/

iptables -P INPUT DROP # drop will be default policy
iptables -i eth0 -A INPUT -p tcp --dport 22 -j ACCEPT # ssh
iptables -i eth0 -A INPUT -p tcp --dport 443 -j ACCEPT # delete this if prerouting works
iptables -i eth0 -A INPUT -p tcp --dport 8443 -j ACCEPT # 8443
iptables -i eth0 -A INPUT -p icmp --icmp-type 8 -j ACCEPT # ping
iptables -i eth1 -A INPUT -j ACCEPT # all from eth1

#route port 443 to 8443 from eth0

iptables -t nat -i eth0 -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443 

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.