I'm testing the following iptables rules (ipv4) with support for logging of dropped packets. I log the drops to /var/log/iptables.log and then ban retrying/hammering IPs with fail2ban.

I'm no expert so I wanted to ask serverfault if my ruleset and the banning with fail2ban is any good or just some security through obscurity?

(FYI these rules are from a host with kvm/mail/ssh)

iptables rules

:OUTPUT ACCEPT [152:19775]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-I FORWARD -m physdev --physdev-is-bridged -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2727 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4949 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables INPUT:DROP: " --log-level 4
  • Looks OK although you need to allow more ICMP types, rules like these can cause chaos. ICMP messages are there for good reason, things like fragmentation needed should be allowed, as well as others like port unreachable, redirects. They may be matched as RELATED by the conntrack module but I wouldn't rely on it.
    – wurtel
    Mar 24 '15 at 10:25
  • Thank you for comment! I thought these rules would enable all icmp types My intention was to keep them all enabled. :/ I will have a look on how to keep all enabled or do you have a quick tip? Mar 24 '15 at 15:59
  • Would it be better to replace the two icmp lines with the following? -A INPUT -p icmp -j ACCEPT and -A OUTPUT -p icmp -j ACCEPT? Mar 24 '15 at 16:09
  • The OUTPUT rule doesn't do anything now as the policy is ACCEPT anyway; INPUT is a different story as there's a final DROP rule for everything. So, yes, accepting all icmp should be fine.
    – wurtel
    Mar 25 '15 at 7:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.