1

I need to setup iptables for a mongodb database server, such that it allows only two types of INPUT connections:

  1. one connection to port 27017, monogdb's default port, from our main web-app
  2. one ssh connection from my main network, which has a different IP address from our web-app

The issue is that these rules needs to be chained.

Here's what I tried:

iptables -A INPUT -p tcp --dport ssh -j ACCEPT # allows all connections via ssh (port 22)

iptables -A INPUT -s web-app-IP -p tcp --destination-port 27017 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -d web-app-IP -p tcp --source-port 27017 -m state --state ESTABLISHED -j ACCEPT

iptables -P INPUT DROP
iptables -P OUTPUT DROP

The first line allows all incoming connections on port 22, while the second and third lines allow all connections from thw web-app-IP to and from the mongodb server only.

It seems that the first line is getting blocked by the second and third line. Is there a logical OR operator for iptables? If not, how do I setup the rules to allow for both of these types of connections?

1 Answer 1

3

You're not allowing ESTABLISHED connections out from ssh. I'd go with a slightly simpler:

iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --destination-port 22 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp -s web-app-IP -p tcp --destination-port 27017 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP
3
  • Also, you might want to allow some ICMP in/out, but that's out of scope for this!
    – Bill Weiss
    Commented Mar 16, 2014 at 1:04
  • Could you please explain this line: iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT in particular, I don't understand the -m flag and what does it mean to be ESTABLISHED ? Thanks
    – vgoklani
    Commented Mar 17, 2014 at 1:19
  • -m state means "load the state module" (which is where we get --state from). The ESTABLISHED state is packets in a tcp session we've already allowed (which we did with --state NEW on the ssh and 27017 lines)
    – Bill Weiss
    Commented Mar 17, 2014 at 2:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .