A simple question

Hi all,
I'm new to the use of iptable. I set this script for my home workstation, but when I apply these rules anything stop functioning.
I guess I'm doing something stupid but this is my very first time with iptables, so sorry.
I use my workstation that is behind an adsl router. My workstation has a fixed ip, 192.168.1.2 and I'd like to use it for Tomcat server , ssh server and general client features.Can anyone give me some help? Thanks

PS Comment are italian, but hope rules be quite clear...

#!/bin/sh
#G.P
#last update 050404
#Script di inizializzazione per settare un insieme di regole #di packet filtering tramite iptables.

#definire le policy (comportamento di default)per le catene di default /sbin/iptables -P INPUT DROP #ogni pacchetto in ingresso scartato /sbin/iptables -P OUTPUT DROP #ogni pacchetto in uscita accettato /sbin/iptables -P FORWARD DROP #ogni pacchetto di passaggio scartato

#flush di tutte le catene
/sbin/iptables --flush

#elimina le catene
/sbin/iptables -X miacatenain
/sbin/iptables -X miacatenaout

#creare una nuova catena
/sbin/iptables -N miacatenain
/sbin/iptables -N miacatenaout

#aggiungere una regola a INPUT e OUTPUT per passare #dalle regole appena definite. Ogni pacchetto fa match e passa #alla catena 'miacatena' corrispondente /sbin/iptables -A INPUT -j miacatenain /sbin/iptables -A OUTPUT -j miacatenaout

#######aggiungere le regole alla catena di ingresso#########

#ICMP
#Consentire traffico icmp
/sbin/iptables -A miacatenain -p icmp -j ACCEPT

#CUPS
#Consentire traffico cups in ingresso /sbin/iptables -A miacatenain -p tcp --dport 632 -j ACCEPT /sbin/iptables -A miacatenain -p udp --dport 632 -j ACCEPT

##EDONKEY
#Consentire traffico tcp alla porta 4663 /sbin/iptables -A miacatenain -p tcp --dport 4663 -j ACCEPT /sbin/iptables -A miacatenain -p udp --dport 4663 -j ACCEPT

#SSH
#Consentire traffico ssh in ingresso

/sbin/iptables -A miacatenain -p tcp --dport 22 -j ACCEPT /sbin/iptables -A miacatenain -p udp --dport 22 -j ACCEPT

#TOMCAT
#Consentire traffico web in ingresso x Tomcat da ufficio
/sbin/iptables -A miacatenain -p tcp --dport 8080 -d 192.168.1.2 -s 131.114.136.26 -j ACCEPT

#Consentire traffico web in ingresso x Tomcat da rete locale
/sbin/iptables -A miacatenain -p tcp --dport 8080 -d 192.168.1.2 -s 192.168.1.0/255.255.255.0 -j ACCEPT

#LOOPBACK
#Consentire tutto il traffico tramite l'interfaccia di loopback #/sbin/iptables -A miacatenain -i lo -j ACCEPT

#######aggiungere le regole alla catena di uscita#######

#Consentire connessioni ftp in ingresso #/sbin/iptables -A miacatena -p tcp --dport 2020 e 21 in uscita #/sbin/iptables -A miacatena -p tcp --dport

##EDONKEY
#Consentire traffico tcp alla porta 4663 /sbin/iptables -A miacatenaout -p tcp --dport 4663 -j ACCEPT /sbin/iptables -A miacatenaout -p udp --dport 4663 -j ACCEPT

#DNS
#Consentire traffico dns in uscita
/sbin/iptables -A miacatenaout -p tcp --dport 53 -j ACCEPT /sbin/iptables -A miacatenaout -p udp --dport 53 -j ACCEPT

#SMTP POP3
#Consentire traffico smtp
/sbin/iptables -A miacatenaout -p tcp --dport 25 -j ACCEPT /sbin/iptables -A miacatenaout -p tcp --dport 110 -j ACCEPT

#SSH
#Consentire traffico SSH in uscita
/sbin/iptables -A miacatenaout -p tcp --dport 22 -j ACCEPT /sbin/iptables -A miacatenaout -p udp --dport 22 -j ACCEPT

#WEB
#Consentire traffico web in uscita
/sbin/iptables -A miacatenaout -p tcp --dport 80 -j ACCEPT

#LOOPBACK
#Consentire tutto il traffico tramite l'interfaccia di loopback #/sbin/iptables -A miacatenain -i lo -j ACCEPT

#########applica le modifiche#########
/sbin/service iptables save

/sbin/service iptables restart

The major problem with your ruleset is that you have no rules in either your INPUT or OUTPUT chains to allow reply packets.

My recommendation is to start simple, and add things bit by bit. Then if
something goes wrong, you only need to look at the (simple) thing you added most recently.

For a home workstation, try the following ruleset (which will allow more traffic than you say you want, but is still secure from the outside world).

You can add more specific rules to allow only the correct traffic, and to allow limited connections from the outside, as you want to.

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -j ACCEPT

Regards,

Antony.

Most people have more than the average number of legs.

                                                     Please reply to the list;
                                                           please don't CC me.

Ok Antony, thanks for the help and sorry for my second mail, I was a bit in a hurry yesterday ;-) Maybe I have to review the TCP protocol...

Gianni

I have a gateway with the firewall function, it has 4 interfaces

			OUTSIDE NETWORK
			     ||
			    eth0
			167.205.30.75
	_____________________||________________________
    eth1		     eth2			eth3

167.205.102.0/26 167.205.102.64/27 167.205.102.128/27

the gateway just running SMTP and ssh, i want to log and prevent (as I can) the port scan from the outside. I was able to slow down the nmap from about 50 seconds to about 250 seconds from other host (from the outside network) to my internal box (167.205.102.2)
Does somebody can tell me how to increase this (slow down the nmap), some suggest will be good too...
Sorry for my english....

Regards, D. Prima Prayudi

IPv6-enabled
ARC-ITB 2001:d30:3:160::2/64