On Fri, 2003-08-29 at 11:47, Andrew Gaffney wrote:
> I'm trying to create a firewall using iptables. I want it to drop
> incoming packets except to ports 22, 25, and 80 unless the source
> address is 192.168.254.x. I'm asking before I do this because I'm
> accessing the computer remotely right now and I don't want to cut myself
> off from it. I'm thinking something like:
>
> <snip>
>
> Would either of these get me the desired results?
i'm thinkin' you want:
# policies
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# accept established connections to save having to go through all of those rules.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# dns, repeat for each address
iptables -A OUTPUT -o eth0 -p udp -s <YOUR_IP> --sport 1024:65535 -d <DNS_IP> --dport
53 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -s <YOUR_IP> --sport 1024:65535 -d <DNS_IP> --dport
53 -m state --state NEW -j ACCEPT
# outgoing traffic
iptables -A OUTPUT -o eth0 -p tcp -s <YOUR_IP> --sport 1024:65535 --dport 22 -m state
--state NEW -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -s <YOUR_IP> --sport 1024:65535 --dport 25 -m state
--state NEW -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -s <YOUR_IP> --sport 1024:65535 --dport 80 -m state
--state NEW -j ACCEPT
# incomming connections
iptables -A INPUT -i eth0 -p tcp -s --sport 192.168.254.0/24 1024:65535 -d <YOUR_IP>
--dport 22 -m state --state NEW -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s --sport 192.168.254.0/24 1024:65535 -d <YOUR_IP>
--dport 25 -m state --state NEW -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s --sport 192.168.254.0/24 1024:65535 -d <YOUR_IP>
--dport 80 -m state --state NEW -j ACCEPT
note the following:
(a) the chain policy (-P) should always be put at the top.
(b) the output DROP policy is generally regarded as a little too
restrictive, but i like it that way... you may want to use them
or not.
(c) this script doesn't do everything, ie. it doesn't disable
forwarding and check for martains etc. i would suggest you buy a
book and get the low-down on iptables to fully understand
everything about it.
(d) connection tracking must be available to iptables. so you should
either load the module (ip_conntrack), or compile it directly into
your kernel.
--
this is your life and it's ending one minute at a time.
- tyler Durden, "fight club"
--
[EMAIL PROTECTED] mailing list
