0

In iptables I drop all incoming traffic. But I want e.g. PING to work when sent to the blocked addresses.

What works is if I allow ESTABLISHED. But this also allows existing (=established) connections to continue even if the iptables rules say they should be blocked/dropped.

In man iptables:

ESTABLISHED meaning that the packet is associated with a connection which has seen packets in both directions

I don't see any better state to identify connection which just received first packet in the second direction - first reply to an outgoing request.

Is there a way to set rules for these "newly established" connections?

Maybe NEW could be somehow used on the outgoing connection to allow incoming packets on it?

UPDATE: Since i can't express the intent otherwise:

I wish to implement a whitelist, so a few specific addresses should be able to connect, others should be dropped. So i have:

iptables -A INPUT -s 1.1.1.1,2.2.2.2 -j ACCEPT
iptables -P INPUT DROP

But this also blocks reply traffic, so if this computer sends a ping to the whitelisted addresses, it will not receive a reply. That is why i added the ESTABLISHED rule, which fixes that problem:

iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

But this introduces another problem: if a connection existed before applying these rules from a non-whitelisted addresss 9.9.9.9, it will be allowed to continue.

How can I allow reply traffic without allowing existing connection that should be blocked by the iptables rules?

Improve this question
  • Can you clarify what you mean with "But this also allows connections to persist even when they should be blocked."? – Mathias Weidner Dec 2 '19 at 17:44
  • @MathiasWeidner I mean that after setting a rule, say block 1.2.3.4, if a TCP connection was open at that time the ESTABLISHED flag will let it continue living. The ESTABLISHED flag is too permissive for me, but i don't see a functional alternative. – Jakub Fojtik Dec 4 '19 at 11:32
  • IPTABLES rules are applied by reading the file from top to bottom and the first rule that applies is used. E.g. if you put ESTABLISHED at the end of the rule set AFTER you drop or block, the ESTABLISHED rule won't apply. Ideally you set your firewall to POLICY DROP, open the ports for just what you need and in the end allow ESTABLISHED and RELATED. Only a connection that was established via a NEW rule falls into these categories. TL;DR: The order of your rules matters. – Broco Dec 4 '19 at 12:18
  • @Broco i do have INPUT POLICY DROP, but it also blocks traffic that is a reply to an outgoing request. Established allows it, but also allows other unwanted traffic. I added an example to the question. – Jakub Fojtik Dec 4 '19 at 13:18
  • Established doesn't allow unwanted traffic. But you could add a destination address to your ESTABLISHED rule instead of allowing it for everybody. – Broco Dec 5 '19 at 14:32
1

If I understand you correctly, your problem arises when your firewall rules where to permissive and you add a rule to block traffic that was allowed before. Then the traffic that was already allowed and has an open connection in the conntrack module is allowed after the new rule is in place.

You should have a look at the conntrack-tools.

Using the conntrack program you would list the active connections and explicitely delete the unwanted connections.

Please be aware that ESTABLISHED within the conntrack module refers to the state of the connections known to the conntrack module. That means, after you have deleted the connection from there, the iptables rules will prevent the connection from being established anew because the next datagramm would set the state to NEW.

Improve this answer
  • The problem is i have to set the permisive rule or other stuff breaks. I am asking if iptables have a better way to set it up. I added the specific example to the question if that helps. – Jakub Fojtik Dec 4 '19 at 13:14
  • hows about established,related – djdomi Dec 4 '19 at 17:58
  • @djdomi what do you mean? The question was about ESTABLISHED. – Mathias Weidner Dec 4 '19 at 18:10
  • instead only --state ESTABLISHED he may can use --state ESTABLISHED,RELATED which should it restrict once more because it will check for it – djdomi Dec 5 '19 at 8:11
  • 1
    sudo iptables -A INPUT -p icmp --icmp-type echo-request -j accept and sudo iptables -A OUTPUT -p icmp --icmp-type echo-reply -j accept may give a option to accept echo request if i understand – djdomi Dec 5 '19 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.