Server: Ubuntu 10.04 LTS x64 (cloud server at rackspace)

Trying to get a better handle on iptables. All traffic should be dropped coming in except SSH and HTTP. All outgoing is safe. no forwards. The code I have below is based on a sample I found however I can not find any docs to explain what the range is for filters, for example ":INPUT DROP [0:65536]" What is the 0:65536 suppose to set? I guessed port range so I gave it the full range, but then outgoing has it defaulting to much higher. It was different but changing it does not seem to effect anything. What does it do?

Second, while traffic is blocked a nmap scan with full connect "-sT" still shows some 20-30 ports as open but banner grabbing with netcat does not show anything. Is that normal?

My method for testings is (as root).

iptables -F

iptables -L (check its flushed)

iptables-restore < iptables.test.rules



:INPUT DROP [0:65536]                                                                                                   
:FORWARD ACCEPT [0:0]                                                                                                   
:OUTPUT ACCEPT [1628:151823]                                                                                            

-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT                                                         
-A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT                                                         

-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT                                                                            
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT                                                                            

#future use                                                                                                                      
#-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT                                                                           
#-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT                                                                            
#-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT                                                                          


The values in [ ... : ... ] are counters [packet count : byte count]. In the iptables-save format they are used to initialise the counters when you run the iptables-restore command. You can see them when you use the iptables -L -v command e.g.

from iptables-save

:OUTPUT ACCEPT [48793:7859926]

from iptables -L -v

Chain OUTPUT (policy ACCEPT 48697 packets, 7845K bytes)

What ports are you seeing open ? I only see the ports that I have open.

  • how is that used when you first init them? should they be left at zero or how do you come up with the amount? – Ryan Mills Oct 4 '11 at 21:02
  • If you use iptables-save then they are the current values when you run the command. You can set them how you want, [0:0] is quite common. – user9517 Oct 4 '11 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.