How to setup a whitelist using iptables and ipset

Question

I'm trying to only accept connections from my whitelist on ports 53, 80 and 443.

Here is my iptables file

# Generated by iptables-save v1.4.21 on Thu Feb 25 18:28:29 2016
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8071:8079 -j ACCEPT
-A INPUT -p udp -m udp --dport 6881 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9001 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9030 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -m set --match-set whitelist src -j ACCEPT
-A INPUT -p udp -m tcp --dport 53 -m set --match-set whitelist src -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -m set --match-set whitelist src -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 443 -m set --match-set whitelist src -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -j ACCEPT
COMMIT
# Completed on Thu Feb 25 18:28:29 2016
# Generated by iptables-save v1.4.21 on Thu Feb 25 18:28:29 2016
*nat
:PREROUTING ACCEPT [97277:5398468]
:INPUT ACCEPT [96665:5304148]
:OUTPUT ACCEPT [107653:6493517]
:POSTROUTING ACCEPT [107653:6493517]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Thu Feb 25 18:28:29 2016

I have setup an ipset whitelist that looks like this:

create whitelist hash:net family inet hashsize 1024 maxelem 65536
add whitelist a.a.a.a
add whitelist b.b.b.b

Inside my /etc/network/if-pre-up.d/iptables script I have the following:

#!/bin/sh
/sbin/ipset restore < /etc/ipset.whitelist.conf
/sbin/iptables-restore < /etc/iptables.rules

I'm not sure why but when I uncomment the whitelist rules in my iptables file I am unable to access the server, even through port 22, which shouldn't be effected.

What am I doing wrong here?

Answer 1

Your iptables file has an error and when you execute it, it likely stops at that line. In the following line you are using the UDP protocol but matching with the TCP module:
-A INPUT -p udp -m tcp --dport 53 -m set --match-set whitelist src -j ACCEPT

Try using the TCP protocol with this line instead:
-A INPUT -p tcp -m tcp --dport 53 -m set --match-set whitelist src -j ACCEPT