1

Could anyone explain how to best tie these together in iptables?

Set up the rules in iptables so that you are be able to connect to 45.204.202.45 via Secure Shell (SSH) from behind the firewall. You also need to be able to reach a webserver, 196.20.10.5, from behind the firewall. However, do not to allow any incoming connections that are not related to those or to normal web browsing.

  • Do you need to use iptables directly? ufw on the command line and gufw are much easier to understand unless you want to get deep in to firewall stuff. – pbhj Jan 12 '18 at 13:54
  • Yes, it's specifically about iptables. But thanks! I'll look into the others too! – Saith Jan 12 '18 at 14:27
  • Tools like ufw write iptables rules, so you could perhaps clean your firewall out, use ufw, then iptables-save to get the rules? Just an idea, I remember doing iptables firewalls manually in the past and find ufw so much easier. My ufw is 32 rules, my iptables is 210 lines according to wc. – pbhj Jan 13 '18 at 19:36
0

Try this

#################################################
# clear existing chains
#################################################

/etc/init.d/iptables stop

iptables --flush
iptables --delete-chain

#################################################
# allow loopback
#################################################

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#################################################
# allow trafic to 45.204.202.45 port 22 | ssh
#################################################

iptables -A OUTPUT -o eth0 -p tcp -d 45.204.202.45 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

#################################################
# allow trafic to 196.20.10.5 port 80 | http
#################################################

iptables -A OUTPUT -o eth0 -p tcp -d 196.20.10.5 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

#################################################
# deny all other input
#################################################

iptables -A INPUT -j DROP

#################################################
# deny all other output
#################################################

iptables -A OUTPUT -j DROP

#################################################
# default policies
#################################################

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT

In example I use eth0 for name of ethernet card on you pc. You can check name on nic with command

ifconfig

or

ip a

Good Luck

| improve this answer | |
  • That makes sense! Thanks a bunch for commenting in what it does. – Saith Jan 12 '18 at 14:45
  • This is a nice answer, but I have a few comments. First, consider using REJECT rather than DROP - chiark.greenend.org.uk/~peterb/network/drop-vs-reject . Second be very careful with setting your default policy to DROP or REJECT, you will lock yourself out of remote servers if you flush your rules. third you need to add RELATED (you need to accept related traffic on tcp ports such as ssh). Usually set a rule allowing all established and related early in the rules and filter new connections. And last you likely need to allow a little more traffic , DNS comes to mind. – Panther Jan 12 '18 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.