1

I am trying to configure iptables on Ubuntu. I have the server setup as a transparent proxy using Squid which is working fine. At this time only port 80 is redirected to SQUID via nat iptables. I basically want to allow 80, 443, VOIP (SIP) and email protocols and block everything else. currently i have the following.

sudo iptables -A FORWARD -j ACCEPT -p tcp --dport https
sudo iptables -A FORWARD -j ACCEPT -p tcp --dport pop3
sudo iptables -A FORWARD -j ACCEPT -p tcp --dport imaps
sudo iptables -A FORWARD -j ACCEPT -p tcp --dport imap2
sudo iptables -A FORWARD -j ACCEPT -p tcp --dport smtp
sudo iptables -A FORWARD -j ACCEPT -p udp --dport sip
sudo iptables -A FORWARD -j ACCEPT -p udp --dport 10000:20000
sudo iptables -FORWARD -j REJECT -p tcp
sudo iptables -FORWARD -j REJECT -p udp

Few issues with this config:

  1. for some strange reason Gmail doesn't work over https. Does it use other ports in the background or am I overlooking something?
  2. I cannot seem to find the port range of the VOIP system we are using. System is from Tachyon and is SIP based. With the current config the phone rings but once answered there is nothing there which leads me to believe that the port range i put in was incorrect. udp 10000:20000 is the RTP protocol but not the one used in this scenario. What are the other protocols usually associated with SIP or is every implementation different.

Gracias!

1 Answer 1

3

If you default policy is DROP on FORWARD chain, you should put this before the REJECT rules

   sudo iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
4
  • What case will use this rule you suggested? Whats the default state in a rule? Just seems like other rules would be used unless the packets are related/established target another protocol/service. I have added this rule and am monitoring via native iptables logging/counters and seem like the majority of the traffic falls into this one rule. Can you give me an example of what connections this rule would catch? Mar 7, 2012 at 16:27
  • This rule makes your firewall to be act as stateful. It tracks your connections in the conntrack table and if a package comes in and it is related to a connection found in the conntrack table it accepts. Without this (assuming that your default policy is DROP), the packages answering to your initiated fonnections will be dropped by your fw. Mar 8, 2012 at 23:02
  • And the reason of this rule catch a lot, is: you open a connection to for example to 993. Source port is random, lets assume it is 34567. The reply for your request will be like remotemachine:993 -> your_host:34567 so you cannot explicit add this in rule, that's why stateful firewalls are around. Hope this explains well Mar 8, 2012 at 23:03
  • Very good explanation. Mucho Gracias! Mar 9, 2012 at 16:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .