[CentOS] iptables rules

[Robert Spangler]

On Monday 29 March 2010 16:48, m.roth at 5-cent.us wrote:

>  I've got a server with several ip's on eth0. I want to block all traffic
>  *except* to port 80 on them, but not on any other IPs, so that
>  eth0 is www.xxx.yyy.zzz
>  eth0:1 is www.xxx.yyy.ggg
>  eth0:2 is www.xxx.yyy.hhh
>
>  I've tried
>  -A RH-Firewall-1-INPUT -p tcp -d www.xxx.yyy.ggg --dport ! 80 -j DROP
>  -A RH-Firewall-1-INPUT -p tcp -d www.xxx.yyy.hhh --dport ! 80 -j DROP

The problem is your firewall is no firewall.  It blocks nothing and allows 
everything.

>  *filter
>
>  :INPUT ACCEPT [0:0]
>  :FORWARD ACCEPT [0:0]
>  :OUTPUT ACCEPT [769:48207]
>  :RH-Firewall-1-INPUT - [0:0]

By setting all the default policies to ACCEPT you are blocking nothing.

>  -A INPUT -j RH-Firewall-1-INPUT
>  -A FORWARD -j RH-Firewall-1-INPUT
>  -A RH-Firewall-1-INPUT -i lo -j ACCEPT
>  -A RH-Firewall-1-INPUT -d  www.xxx.yyy.ggg -p tcp -m tcp ! --dport 80 -j
> DROP -A RH-Firewall-1-INPUT -d www.xxx.yyy.hhh -p tcp -m tcp ! --dport 80
> -j DROP -A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
>  <...>
>  and I notice it puts the ! in front of the --dport, but has no complaints.
>
>  However, I can telnet to www.xxx.yyy.hhh 443. What's wrong with the rules?

See above.  Try these rules I'm sure you will get better results.  And yes, I 
dropped the stupid RH-Firewall-1-INPUT BS that RH puts in there.
Lets make a stateful firewall while we are at it also.


#Set policies to drop
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

#Setup OUTPUT Rules to allow everything outbound
iptables -I OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I OUTPUT -m state --state NEW -j ACCEPT
iptables -I OUTPUT -j DROP

# Setup INPUT Rules to only all what we want
iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
iptables -I INPUT -j DROP

Sure you can combined the output rules into one but I like it this way in case 
I need to block something from exiting the system.

You can use this tutorial to better define your rules, for example the icmp 
rule you have above you can fine tune this to only allow what is needed.  
Just remember that the rules are read from top to bottom and the first 
matching rules is used.

http://www.zoominternet.net/~lazydog/iptables-tutorial.html


-- 

Regards
Robert

Linux User #296285
http://counter.li.org