0

I have iptables set up on a server to only allow whitelisted ips to access it:

:INPUT ACCEPT [1695:323274]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [987:756890]
:xxx - [0:0]

-A INPUT -s 12.34.56.78/32 -j ACCEPT
-A INPUT -s 98.76.54.32/32 -j ACCEPT
-A INPUT -j DROP

This works in that it allows 12.34.56.78 and 98.76.54.32 (example IPs, obviously) to access the server. However, the server can't access the Internet itself. EG I can't access google using the lynx browser.

I don't mind this behaviour, but there are a few websites that I need the server to be able to talk to, specifically update sites.

What can I add to the rules to allow my server to talk to whitelisted servers?

1

-A INPUT -j DROP is dropping all incoming traffic, including replies from google in your example.

Change that rule to -A INPUT -p tcp --dport 80 -j DROP so that it blocks incoming requests to your web server (you may need to add https port 443 and other services that you don't want exposed), while allowing you to receive traffic back from connections that you initiate from the server.

Another option is to allow traffic for established connections with iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

2
  • I have my rules in a text file and I use iptables-restore. Changing that rule to what you suggest makes iptables-restore complain: unknown option "--dport" – Cameron Ball Apr 3 '14 at 1:28
  • sorry, forgot the protocol, edited the answer – LinuxDevOps Apr 3 '14 at 1:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.