0

On my personal server ( Centos 6.6 ), i acquired a secondary ip in order to keep all backend access splitted from the frontend applications. But i'm not sure how can i specify wich port can be accessed for a given IP.

For example

eth0 (192.168.10.1) will be only for port 80/443 eth0:1 ( 192.168.10.2) will be only for ssh

What i have so far, but it's not working, since i still can access 80/443/22 from any ip:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [1119386456:2737152595892]

#allow incoming ICMP ping pong stuff
-A INPUT -i eth0 -p icmp --icmp-type 8 -s 0/0 -m state --state NEW,ESTABLISHED,RELATED -m limit --limit 30/sec  -j ACCEPT
-A OUTPUT -o eth0 -p icmp --icmp-type 0 -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
#Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT

#Accept all established inbound connections
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0:1 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource
-A INPUT -i eth0:1 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --name DEFAULT --rsource -j DROP
#Allow SSH
-A INPUT -i eth0:1 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
#Allow HTTP
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
#Allow HTTPS
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

#
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A INPUT -j DROP
-A FORWARD -j DROP
COMMIT

is there anything i'm missing? Thanks in advance.

EDIT:

Sorry if i didn't made myself clear. but the intention only accept traffic to the ports 80/443 on eth0 ( 192.168.10.1) and traffic from 22 on eth0:1 ( 192.168.10.2)

2

Replace -i eth0:1 with -d 1.1.1.1/32

I believe you have used ifconfig to create interface alias. Actually you can assign more than one IP for interface with iproute2 utility(ip addr add ..).

It's better to use IP addresses in iptables rules.

| improve this answer | |
  • I locked myself out with that sugestion :| – thclpr Apr 23 '15 at 11:10
  • 1
    @Thales you should had rule with source address -s <YOURIP> -j ACCEPT before actual edit of iptables rules. Also you can use -j LOG for rules debugging before aplying restrictions(ACCEPT, DROP). – Navern Apr 23 '15 at 11:48
  • 1
    please provide actual information about your IP addresses, output of "ip r" command and actual iptables rules. It would be easier to help you. – Navern Apr 23 '15 at 11:49
  • i can give an example, but not the public ip :). i'll update the question – thclpr Apr 23 '15 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.