block ports
A message that is not in the archive (sent off-list or not yet received): 200209171745.06648@.
Quoted 1 line
iptables -A INPUT -p udp --dport 21 -j ACCEPT
skip this.
Quoted 1 line
iptables -A INPUT -p udp --dport 22 -j ACCEPT
this too
Quoted 1 line
iptables -A INPUT -p udp --dport 143 -j ACCEPT
this too
Quoted 1 line
iptables -A INPUT -p udp --dport 3306 -j ACCEPT
and this.
ftp, ssh, https and mysql do not use udp for transport.
DNS does, so let it be.
Quoted 2 lines
I am not sure exactly exactly about ESTABLISHED, RELATED which Anthony was talking about.
Put a
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT so that
1) Packets traverse a less number of rules
2) Allow eg. icmp related traffic to existing connections (like port unreachables)
2) Well, if you do not need ACLs in OUTPUT, you may put some sanity checks there: like -m unclean -m ttl, -m state --state INVALID, etc. You may add a rule:
iptables -P OUTPUT ACCEPT
iptables -A OUTPUT -s ! <your.real.ip> -j DROP
If you are not forwarding, set it to ACCEPT.
Regards,
Maciej soltysiak