-1

Purely as an academic exercise in an attempt to simply learn, I have been playing with iptables. Spent a few days on this so far and I think I now have a good understanding of how it all works. I started with only changing settings on the INPUT chain and I can now accept/deny pretty much anything I need. ssh access for example.

I then moved on to 'playing' with the OUTPUT chain and, whilst I think I understand what I'm doing, I must be missing something somewhere. Here is what I am trying to do (simply as a learning excercise).

Block all incoming requests, block all outgoing requests, then manually enable them one by one. Thought I would test it with http web access and I can't get it working.

I am using webmin to configure iptables but I am happy to use a shell as well.

INPUT chain : Default to block. Enable TCP to destination port 80 for NEW and ESTABLISHED connections. Enable TCP to destination port 53 for NEW and ESTABLISHED connections.

OUTPUT chain : Default to block. Enable TCP from source port 80 for NEW connections. Enable TCP from source port 53 for NEW connections.

I am thinking this way, I can browse the interweb (not HTTPS I know) as long as I initiate the connection.

As I say I'm just trying to understand a little more about iptables and network traffic in general.

Any pointers as to what I am doing wrong would be welcome.

P.S. I'm a Windows convert .... be gentle !

1

First, IMO, you should NEVER set the default policy to DROP or REJECT. This is because if you flush iptables you will be locked out (not that I have EVER locked myself out mind you =) ).

Second, IMO, you should use REJECT rather then DROP. DROP is not more or less secure then REJECT, does not in any way "hide" your ip via "sealth", it simply slows legitimate traffic. Crackers can tell your ip exists because of the lag and they set their tools not ignore time outs. See http://www.chiark.greenend.org.uk/~peterb/network/drop-vs-reject

Third, the OUTPUT chain only blocks traffic coming from your host (sorry to state the obvious).

Last , the order of your rules counts, so if you need help, post your rules.

See also: http://bodhizazen.com/Tutorials/iptables

  • Thanks for the link it is a real good read. I will have another play and see how I get on. – hatterman Feb 18 '14 at 19:41
  • So, for an effective firewall do you really only need to filter incoming traffic ? – hatterman Feb 18 '14 at 19:57
  • That is a matter of opinion / paranoia. IMO, if you have illegitimate outgoing traffic you have already been cracked and/or you have untrusted users. Others feel filtering outgoing traffic can prevent unauthorized traffic. – Panther Feb 18 '14 at 20:02
  • Yes, that's what I was thinking, which is why I initially tried to only allow port 80 and 53 in and out as an exercise in allowing web browsing only. Do I only need 80 and 53 ? – hatterman Feb 18 '14 at 21:02
  • As always, "it depends" po0rt 80, for example, is used by default by web servers. clients use a higher pseudorandom port. so, port 80 as the source or destination port ? – Panther Feb 18 '14 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.