1

Im working to limit access to a new XenServer 6.2 installation. The default iptables rules on the boxes have a RH-Firewall-1-INPUT chain that exposes quite a bit to the outside world.

Without going through and adding -s <ip range> to each rule (there are many) is there a way to add the ip ranges to all the rules by default?

Historically I build iptables with INPUT DROP and FORWARD DROP then open everything to the internal networks followed by a -j REJECT to ignore the rest. The XenServer rules seem a bit more complex and having an inadvertant iptables lock-out would be a bad thing.

1

Something like this should work. Off the top of my head, it's been a while since I used iptables but.

# Create a whitelist chain
iptables -N whitelist

# Add some ip's to it
iptables -A whitelist -s 1.2.3.4/32 -j RETURN
iptables -A whitelist -s 2.3.4.5/32 -j RETURN
iptables -A whitelist -s 3.4.5.6/32 -j RETURN
# etc

# default drop on whitelist, no match - drop
iptables -P whitelist DROP


# Jump to the whitelist chain by default which will jump back if we get a match
iptables -A INPUT -j whitelist

# now back at your input chain
# All the normal rules follow
  • Silly question: do I need the additional rules after the 'whitelist'? If iptables has rejected anyone that doesn't match do I need the limits afterwards? – ethrbunny Nov 26 '13 at 13:13
2

You could have a rule that will -j JUMP to another chain, if the IP matches your range, else just drop everything.

2

FWIW, these are the default XenServer 6.2 rules - basically the stock RedHat rules since XenServer is based on RedHat:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     47   --  *      *       0.0.0.0/0            0.0.0.0/0           
 499M 1226G RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 187M packets, 1105G bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain RH-Firewall-1-INPUT (2 references)
 pkts bytes target     prot opt in     out     source               destination         
 312K  429M ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
15842 1331K ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 255 
    0     0 ACCEPT     esp  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     ah   --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251         udp dpt:5353 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:631 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:631 
    0     0 ACCEPT     udp  --  xenapi *       0.0.0.0/0            0.0.0.0/0           udp dpt:67 
 497M 1223G ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW udp dpt:694 
    1    60 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
    3   180 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:80 
10474  543K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:443 
1883K 2404M REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

So if you want to limit the access to a known range (eg 192.168.0.0/24) you could do something like this:

iptables -I INPUT -s ! 192.168.0.0/24 -j REJECT

This will reject anything NOT from that source address, so the remaining rules will only apply to that source range.

If you have multiple trusted sources, you'll need to use a new chain like @Matt said (although you should use -j RETURN instead of -j INPUT)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.