0

First of all here is the list of things I want to do with the ip tables.

  • Accept all IPs on tcp port 80
  • Accept all IPs on tcp port 443
  • Accept from my ip on tcp port SSH_PORT

I also want everything else to be secure and function normally, eg: be able to use wget.

Below is what I have created.

# Accept tcp packets on destination port 80
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Accept tcp packets on destination port 443
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Accept from specific ip on ssh
iptables -A INPUT -p tcp -s 192.XXX.XX.XX/32 --dport SSHPORT -j ACCEPT

# Accept all icmp traffic
iptables -A INPUT -p icmp -j ACCEPT

# Accept established tcp traffic on the specified ports
iptables -A INPUT -m state --state ESTABLISHED --dport 32768:65535 -j ACCEPT


# Drop eveything else
iptables -P INPUT DROP
iptables -P FORWARD DROP

# Allow all output
iptables -P OUTPUT ACCEPT
2
  • Why do you try to create a firewall yourself? just use firewalld. – Michael Hampton May 15 '18 at 0:23
  • The cloud server I have, does not have a firewall, sure I could use something else, instead of setting the ip table myself, but I thought why not, I know its not easy, but it didnt not seem too hard – John James May 16 '18 at 20:37
0

assuming you meant this line then you seem to miss on the DNS traffic:

# Accept established tcp traffic on the specified ports

as you seem to allow all traffic. you should add -p tcp to that line.

you'll need your loopback traffic.... the rest is probably a matter of preference. I don't like for example to allow all icmp traffic in.

It also depends on what is this machine used for. you can decide if you need to allow UDP at all (except for DNS)?. if not then add the -p tcp to the output and established connections lines.

I also don't allow all output traffic. but since you don't mind here is my suggested config/modification:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]

# Allow ping and ICMP error returns.
-A INPUT -p icmp -m state --state NEW --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT

# Allow loopback (lo) traffic
 -A INPUT -i lo -j ACCEPT
 -A OUTPUT -o lo -j ACCEPT

## ------ DNS (UDP 53. 443 if you use DNSCrypt) -------------
-A INPUT   -p udp    -m multiport --sports 53,443  -m state --state ESTABLISHED,RELATED  -j ACCEPT
-A OUTPUT  -p udp    -m multiport --dports 53,443 -m state --state NEW,ESTABLISHED,RELATED  -j ACCEPT

# ------- web INPUT ----------
-A INPUT   -p tcp   -m multiport --dports 80,443  -m state  --state NEW,ESTABLISHED  -j ACCEPT

#---- SSH input
# Accept from specific ip on ssh---
-A INPUT -p tcp -s 192.XXX.XX.XX/32 --dport SSHPORT -j ACCEPT

# Accept established tcp traffic on the specified ports
-A INPUT -m state --state ESTABLISHED --dport 32768:65535 -j ACCEPT

# Drop eveything else
 -A INPUT DROP
 -A FORWARD DROP

# Allow all output
 -A OUTPUT ACCEPT

COMMIT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.