Jump to content



Photo

IP Tables - Why doesn't this work?

centos iptables firewall linux

  • Please log in to reply
4 replies to this topic

#1 johnporter29

johnporter29

    a = 1; b = 2; a + b = c

  • Joined: 20-November 04
  • Location: Rotherham, UK
  • OS: Windows 8.1 Pro x64
  • Phone: Lenovo A820

Posted 29 July 2012 - 14:34

I am trying to get to grips with IPTables on CentOS 6.3 and having difficulty in understand why this doesn't work. Basically this should allow incoming only connections on Port 22 (SSH) and both incoming and outgoing on Ports 80 and 443.

-p INPUT DROP
-p OUTPUT DROP
-p FORWARD DROP

#allow all traffic on loopback adapter
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

# allow incoming ssh connections only
-A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INOUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

# port 80/443 - incoming
-A INPUT -i eth0 -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT

# port 80/443 - outgoing
-A OUTPUT -o eth0 -p tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp --sport 80 -j ACCEPT

-A INPUT -j DROP
-A OUTPUT -j DROP

Feel free to suggest alternatives but please explain things and not just post the solution.

Thanks


#2 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 86
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 30 July 2012 - 11:41

"-A INOUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT"

What is INOUT?

#3 OP johnporter29

johnporter29

    a = 1; b = 2; a + b = c

  • Joined: 20-November 04
  • Location: Rotherham, UK
  • OS: Windows 8.1 Pro x64
  • Phone: Lenovo A820

Posted 30 July 2012 - 14:09

"-A INOUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT"

What is INOUT?


A spelling mistake :blush: ! Thanks Budman.

#4 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 86
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 30 July 2012 - 15:52

happens - so that should fix your 22 inbound.

# port 80/443 - outgoing

Seems to be missing the 443 stuff.

#5 OP johnporter29

johnporter29

    a = 1; b = 2; a + b = c

  • Joined: 20-November 04
  • Location: Rotherham, UK
  • OS: Windows 8.1 Pro x64
  • Phone: Lenovo A820

Posted 31 July 2012 - 08:46

The problem I had was that I couldn't get out on port 80 from the server i.e. I couldn't browse the web from there using the rules above, so I didn't put the 443 stuff in till I got the 80 stuff working.

I have since been reading articles etc and now have a script that builds the iptables config and it appears to be working as expected, I will post the script later if anyone is interested.



Click here to login or here to register to remove this ad, it's free!