Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have so many questions around iptables and how it works. But we're using a modified kernel, and hence whatever experiment I try and fail, I can't be sure if it happens with Linux in common or just this kernel, as many modules are removed. So, as of now, I have a requirement.

We have 2 apps running on top of 2 Linux instances, and these both apps communicate with each other through port 42605. In total, port 42605, 22, and ICMP are the ones I wanted to allow for communication between these 2 instances. I wanted to quickly verify this. With the iptables rule I tried, I couldn't verify this. So, modified the existing rules in the Linux instances and finally the below rule works for me. I have these rules set in both the Linux instances, and both apps are able to communicate between each other now. Am I doing it right? Or is there any loophole in these rules?

[root@localhost ~]# vi /etc/sysconfig/iptables
# Generated by iptables-save v1.4.7 on Sun Mar 16 03:56:09 2014
*nat
:PREROUTING ACCEPT [13049:3908712]
:POSTROUTING ACCEPT [62301:3240130]
:OUTPUT ACCEPT [62358:3244501]
COMMIT
# Completed on Sun Mar 16 03:56:09 2014
# Generated by iptables-save v1.4.7 on Sun Mar 16 03:56:09 2014
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:LOG_ACCEPT - [0:0]
:LOG_DROP - [0:0]
:icmp_packets - [0:0]
-A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 8001 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j LOG_ACCEPT
-A INPUT -p udp -m udp --dport 22 -j LOG_ACCEPT
-A INPUT -p tcp -m tcp --dport 42605 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -j ACCEPT
-A INPUT -p icmp -j icmp_packets
-A INPUT -j LOG_DROP
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 42605 -j ACCEPT
-A OUTPUT -d 127.0.0.1/32 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p icmp -j icmp_packets
-A OUTPUT -j LOG_DROP
-A LOG_ACCEPT -j LOG --log-prefix "[IPTABLES ACCEPT] : " --log-tcp-options --log-ip-options
-A LOG_ACCEPT -j ACCEPT
-A LOG_DROP -j LOG --log-prefix "[IPTABLES DROP] : " --log-tcp-options --log-ip-options
-A LOG_DROP -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type any -j ACCEPT
COMMIT
# Completed on Sun Mar 16 03:56:09 2014
share|improve this question

1 Answer 1

-A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 8001 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

would usually be written as

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8001 -j ACCEPT

This

-A INPUT -s 127.0.0.1/32 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -j ACCEPT

doesn't make sense to me as long as 127.0.0.0/8 is the address block of lo.

-A INPUT -i lo -j ACCEPT

is enough. This rule covers the other two. 127.0.0.1/32 is strange anyway. And the third rule doesn't make any sense at all after the first one.

The same for

-A OUTPUT -d 127.0.0.1/32 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

What is UDP port 22 used for...?

But those are not security-related. The only problem of that kind is

-A icmp_packets -p icmp -m icmp --icmp-type any -j ACCEPT

I am not familiar enough with that to be sure but this is usually not what you want. ICMP can e.g. reconfigure the routing table. But whether that is possible depends on the kernel configuration.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.