3

I want to allow only internet access (it is useful for update) and ssh on my server. I found this set of rules:

  sudo iptables -P INPUT DROP
  sudo iptables -P OUTPUT DROP
  sudo iptables -A INPUT -i lo -j ACCEPT
  sudo iptables -A INPUT -p tcp -m tcp --dport [port number] -j ACCEPT
  sudo iptables -A OUTPUT -o lo -j ACCEPT
  sudo iptables -A OUTPUT -p tcp --sport [port number] -m state --state ESTABLISHED -j ACCEPT
  sudo service iptables save
  sudo netfilter-persistent reload

This is working well but I can't update my system or access internet. Which rules should I add to allow outgoing internet connection?

3
  • Would using UFW be more efficient? I could find those commands easily. Apr 30, 2017 at 9:23
  • SSH to server or from server?
    – 2707974
    Apr 30, 2017 at 11:26
  • @2707974 ssh from outside (any other computer) and allow server to access internet
    – dmx
    Apr 30, 2017 at 11:50

1 Answer 1

11

Let's start

Delete current rules and chains:

sudo iptables --flush
sudo iptables --delete-chain

Allow loopback:

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

Drop ICMP:

sudo iptables -A INPUT -p icmp --icmp-type any -j DROP
sudo iptables -A OUTPUT -p icmp -j DROP

Allow established connections:

sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Allow SSH:

sudo iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

Default policies:

sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT ACCEPT

Save:

sudo iptables-save

This is it. I think :)

1
  • 1
    THX THX THX THX
    – user956584
    Aug 1, 2017 at 18:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.