5

I would like to do the following, but I'm having a hard time doing so using iptables in CentOS:

  1. I would like to accept inbound only port 80,443,22, snmp, 3306 to my server
  2. I would like to be able to allow all outbound ports
  3. I would like all other inbound connection to be dropped
  • You have given a list of ports, but not protocols. 80, 443, 22 and 3306 are normally used as TCP ports. However SNMP often uses UDP. Whenever giving ports it's good to get into the habit of saying "tcp/3306, udp/161, etc", then there is no confusion. – Coops Aug 12 '11 at 21:05
  • You don't say what role the server will play (I presume a LAMP server given the incoming ports). However from a security perspective filtering your outgoing traffic can be as useful as filtering your incoming traffic. Many times I've seen a compromised server made redundant as the hack depends on being able to communicate outbound on a specific port (often the IRC port) in order to take remote control of the server -- but the FW only allows outward traffic on certain ports. – Coops Aug 12 '11 at 21:10
7

Open your iptables(/etc/sysconfig/iptables) and add the following lines below (-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT) line:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 161 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 161 -j ACCEPT

Restart the iptables:

service iptables restart

By default, your iptables allow all outbound ports.

  • errr...how do you know it's RH? – serverhorror Jun 19 '11 at 20:54
  • It's in the title. :) – garconcn Jun 19 '11 at 21:34
  • 2
    doh! you mean the thing in bold letters at the top...I knew it means something. I'm so blind today! – serverhorror Jun 19 '11 at 21:52
  • thanks but I stll can ftp to my server. I want to block everthing else – edotan Jun 20 '11 at 9:20
  • @Elad, can you show your iptables with command "iptables -L"? You can delete INPUT line with --dport 21 or 20 – garconcn Jun 20 '11 at 20:22
1

lokkit will give you a simple interface to configure iptables with.

1
  1. I would like to accept inbound only port 80,443,22, snmp, 3306 to my server.
  2. I would like to be able to allow all outbound ports
  3. I would like all other inbound connection to be dropped.

Put this rules in a shell script....

#!/bin/bash

# 3

iptables -P INPUT DROP

iptables -P FORWARD DROP

# 2

iptables -P OUTPUT ACCEPT

iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED

iptables -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED

# 1 (change eth0 for your interface)

iptables -A INPUT -j ACCEPT -i eth0 -p tcp -m multiport --dport 80,443,22,161,3306

0

The answers given already will definitely do what you need. But really, you should understand how your firewall works if you're going to administrate it. Surprisingly, the CentOS documentation for setting up IPTABLES is easy to understand and gives a good base for getting it set up. So instead of just taking these guys' word for it and sticking these firewall rules up, read a bit and find out what they are doing.

http://wiki.centos.org/HowTos/Network/IPTables

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.