1

Could anyone explain how to best tie these together in iptables?

Set up the rules in iptables so that you are be able to connect to 45.204.202.45 via Secure Shell (SSH) from behind the firewall. You also need to be able to reach a webserver, 196.20.10.5, from behind the firewall. However, do not to allow any incoming connections that are not related to those or to normal web browsing.

Improve this question
3
  • Do you need to use iptables directly? ufw on the command line and gufw are much easier to understand unless you want to get deep in to firewall stuff.
    – pbhj
    Jan 12, 2018 at 13:54
  • Yes, it's specifically about iptables. But thanks! I'll look into the others too!
    – Saith
    Jan 12, 2018 at 14:27
  • Tools like ufw write iptables rules, so you could perhaps clean your firewall out, use ufw, then iptables-save to get the rules? Just an idea, I remember doing iptables firewalls manually in the past and find ufw so much easier. My ufw is 32 rules, my iptables is 210 lines according to wc.
    – pbhj
    Jan 13, 2018 at 19:36

1 Answer 1

Reset to default
0

Try this

#################################################
# clear existing chains
#################################################

/etc/init.d/iptables stop

iptables --flush
iptables --delete-chain

#################################################
# allow loopback
#################################################

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#################################################
# allow trafic to 45.204.202.45 port 22 | ssh
#################################################

iptables -A OUTPUT -o eth0 -p tcp -d 45.204.202.45 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

#################################################
# allow trafic to 196.20.10.5 port 80 | http
#################################################

iptables -A OUTPUT -o eth0 -p tcp -d 196.20.10.5 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

#################################################
# deny all other input
#################################################

iptables -A INPUT -j DROP

#################################################
# deny all other output
#################################################

iptables -A OUTPUT -j DROP

#################################################
# default policies
#################################################

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT

In example I use eth0 for name of ethernet card on you pc. You can check name on nic with command

ifconfig

or

ip a

Good Luck

Improve this answer
2
  • That makes sense! Thanks a bunch for commenting in what it does.
    – Saith
    Jan 12, 2018 at 14:45
  • This is a nice answer, but I have a few comments. First, consider using REJECT rather than DROP - chiark.greenend.org.uk/~peterb/network/drop-vs-reject . Second be very careful with setting your default policy to DROP or REJECT, you will lock yourself out of remote servers if you flush your rules. third you need to add RELATED (you need to accept related traffic on tcp ports such as ssh). Usually set a rule allowing all established and related early in the rules and filter new connections. And last you likely need to allow a little more traffic , DNS comes to mind.
    – Panther
    Jan 12, 2018 at 15:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .