Trying to setup two ethernet cards with two websites

I tried your suggestions below and yes, I finally have two websites working on the same box. Simplifying things does indeed work.

Is there a way to, by default drop everything on the output chain, but insert a rule to allow only http requests that were initialed by a client to either website?

Or if my input rules are sufficient, do I really need to do anything on the output chain other than let everthing out?

Thanks,
Justin

on

that

match

the two below...

--dport

--dport

...are included in these two, so you won't need both. You probably don't want those below, as they accept anything regardless to state.

--dport

--dport

are these really nessecary? with -P DROP, this'll deny any outgoing connections at all, regardless of protocol. It'll even drop ICMP packets, something you probably don't want.

To allow for multiple hosts in a rule, you can specify a mask (or number of bits). For instance:

# iptables -s 10.0.0.0/31
will match 10.0.0.0 and 10.0.0.1. .93 and .94, however, overlaps this 
and needs to be allowed for specifically.

so - try first with -P OUTPUT -j ACCEPT, and no rules in the OUTPUT chain. It shouldn't be any problem then.

roy

If you trust that nothing on the box is or ever will connect that you don't want to, then output chain can just have an ACCEPT policy. If you want to lock down to make it harder for a trojan or such to communicate back from the box, you can set a DROP policy, then:

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

will let traffic back out in response to client requests, but not let the box initiate any connections. If this tighter firewall still allows the needed connections, why open up any further? I'd suggest you might want to log dropped output traffic, though, to see what DOES try to get out. Depending on your usage and plans, you might want to open a few outbounds, like traceroute, ping, CVS, http, or ftp access FROM the box if you want to use these services when logged into the box, for updating software etc. Of course you can just allow those connections when needed, and the rest of the time go with DROP policy and the EST/REL rule above.

j

just remember to allow incoming ICMP. Please? ICMP _is_ an integral part of IP, and shouldn't be blocked out! You can do

iptables -I INPUT -p icmp -j REJECT --reject-with echo-reply

to answer all pings to hosts behind with echo reply (just fake it) in case you're afraid of anyone scanning you.

you might add a -limit as well to prevent them DoSing you (man iptables)

roy

The RELATED state does just this. If you allow absolutely nothing in but tcp 80 and established, and absolutely nothing out but established, only the port 80 request and reply will get through. If you also allow related out then so long as an 'established' connection exists then supplementary connections are accepted as well, like ICMP fragmentation control stuff. The only /initial/ connection allowed in this mini-scenario is to destination port 80 with TCP, but once that connection is flowing then the server would be allowed to send related packets to the same client, even other ports or protocols, and they will get through regardless of whether they are explicitly accepted or explicitly dropped by the firewall. That is the basic purpose of the RELATED state. It's extended with helpers too consider things like FTP data to be related to FTP control, and the NAT functions are extended as well, but the whole idea of RELATED is to let through stuff that is, well, related.

j