block ports
A message that is not in the archive (sent off-list or not yet received): 200209161226.11945@.
Quoted 10 lines · PayalR
Hi all,
I have a stupid question. I want to have incoming internet access for only port 22, 25, 80 and 110. How do I go abut it?
I thought of this rule first,#iptables -A INPUT -i eth0 -p tcp --dport ! 22 -j DROP
and go for the other ports as well. But my problem is that if a packet arrives from port 110, it will be checked for rule 1 above and since it is not for port 22 it will be dropped disregarding the next rules. Right?
Right.
The recommended way to configure a firewall is "block everything except what
you want to allow". Therefore do this:
iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 25 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 110 -j ACCEPT
I recommend the ESTABLISHED, RELATED rule to make sure that things like ICMP get through as well.
Antony.
Signature · 3 lines
Documentation is like sex: when it's good, it's very very good; when it's bad, it's still better than nothing.
Hi,
Thanks a lot for the mails. They were pretty helpful.
I still have some doubts.
Anthony suggests putting,
iptables -P INPUT DROP
at start of rules while Alex wants it at end. What do I do?
I want to send email and browse the net from server. The server does have to make dns look-ups.
One more small thing, I was getting flood udp requests to port 2002. I had blocked ICMP totally incoming as outgoing totally. Now what i did was for port 2002 INPUT rule I told to REJECT the packet with reject-with icmp-port-unreachable. Now will this setup send the error message back to the remote server, cos' in the previous rule I had totally blocked ICMP.
Thanks a lot and bye.
With regards.
-Payal
Quoted 28 lines · you
Quoted 10 lines · PayalR
Hi all,
I have a stupid question. I want to have incoming internet access for only port 22, 25, 80 and 110. How do I go abut it?
I thought of this rule first,#iptables -A INPUT -i eth0 -p tcp --dport ! 22 -j DROP
and go for the other ports as well. But my problem is that if a packet arrives from port 110, it will be checked for rule 1 above and since it is not for port 22 it will be dropped disregarding the next rules. Right?
Right.
The recommended way to configure a firewall is "block everything except
what you want to allow". Therefore do this:iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 25 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 110 -j ACCEPTI recommend the ESTABLISHED, RELATED rule to make sure that things like ICMP get through as well.
Antony.
A message that is not in the archive (sent off-list or not yet received): 200209170024.26303@.
Quoted 6 lines · PayalR
Hi,
Thanks a lot for the mails. They were pretty helpful. I still have some doubts.
Antony suggests putting,
iptables -P INPUT DROP
at start of rules while Alex wants it at end. What do I do?
Doesn't matter. Same thing. I prefer having a default DROP policy, so I
know that's what's going to happen to any packets which reach the end of my ruleset, and I can add rules any time without worrying about where the DROP rule is.
Alex may prefer to have an explicit rule saying DROP so it's more obvious that it's there.
If in doubt, use both :-)
Quoted 2 lines
I want to send email and browse the net from server. The server does have to make dns look-ups.
In that case make sure TCP port 53 and UDP port 53 are allowed out from the machine, and ESTABLISHED,RELATED packets are allowed back in.
Quoted 1 line
One more small thing, I was getting flood udp requests to port 2002.
So is everyone these days:
http://www.sophos.co.uk/virusinfo/analyses/linuxslappera.html
Quoted 1 line
I had blocked ICMP totally incoming as outgoing totally.
Not a good idea. There are some ICMP packets you really should allow in to
your machine - these are covered by the RELATED rule.
Quoted 4 lines
Now what i did was for
port 2002 INPUT rule I told to REJECT the packet with reject-with icmp-port-unreachable. Now will this setup send the error message back to the remote server, cos' in the previous rule I had totally blocked ICMP.
Yes it will, however I doubt it'll do much good. My approach would be to
DROP these UDP 2002 packets and not use up any of your outgoing bandwidth sending ICMP packets which the remote machine probably won't pay attention to.
Antony.
Signature · 4 lines
Perfection in design is achieved not when there is nothing left to add, but rather when there is nothing left to take away. - Antoine de Saint-Exupery
Hi
Quoted 7 lines · on 16. September 2002 09:02 PayalR wrote:
Hi all,
I have a stupid question. I want to have incoming internet access for only port 22, 25, 80 and 110. How do I go abut it?
I thought of this rule first,#iptables -A INPUT -i eth0 -p tcp --dport ! 22 -j DROP
Quoted 7 lines
and go for the other ports as well. But my problem is that if a packet arrives from port 110, it will be checked for rule 1 above and since it is not for port 22 it will be dropped disregarding the next rules. Right?
What can I do about this? How do I exactly frame the rules? Thanks a lot and bye.
#iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT #iptables -A INPUT -i eth0 -p tcp --dport 25 -j ACCEPT #iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT #iptables -A INPUT -i eth0 -p tcp --dport 110 -j ACCEPT
And at the end of the Chain
#iptables -A INPUT -i eth0 -p tcp --dport 1:1024 -j DROP to drop all other priviledged ports or
#iptables -P INPUT DROP
to drop all other traffic (use when you know you want to drop all including ICMP and UDP)
You know that this is not the right way if you want to "surf", send email and use ssh. This is the server-side setup for this.
greetings
Axel