Currently we are using basically OUTPUT default policy, ACCEPT.
That's enough for OUTPUT because Netfilter doesn't need special rules to start stateful connections tracking.
But if you want to filter out inbound traffic according to "default deny" policy it can be done with switching
iptables -P INPUT DROP
Afterwards it all would be set with just 2 rules:
iptables -A INPUT -j ACCEPT -i lo
iptables -A INPUT -j ACCEPT -m state --state RELATED,ESTABLISHED
Pay your attention to the rule allowing input traffic on loopback interface — as I pointed out in my blog posting "Minimal firewall for end user", unless allowed explicitly, loopback traffic won't be handled by "established" state checking, compared to return traffic over, say,
To ensure this minimal ruleset is loaded "as is" w/o interfering with rules that already might be there, it's convenient to make use of
iptables-restore in SHELL-session:
-P INPUT DROP
-A INPUT -j ACCEPT -i lo
-A INPUT -j ACCEPT -m state --state RELATED,ESTABLISHED
Before doing that make sure you won't cut your own networking connection1, although already open SSH sessions should continue to work normally, the attempts to open new ones won't work.
- Of course you can add other rules to allow such connections. It can be as simple as just
-A INPUT -j ACCEPT -p tcp --dport 22 — no need to tinker with
-m state here. Also don't forget to fix
lptables-restore back to
iptables-restore before trying it out ;)