Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 1 down vote favorite
1

On my desktop, I want to configure iptables pretty strictly. I see no reason why I need to allow anything except for internet traffic that I initiated. And maybe even that could be limited to only a few ports. What are the basic rules that can close off my desktop? I only need:

  • To browse the internet
  • Download email

Any recommended set of rules?

share|improve this question
possible duplicate of iptables: allow certain ips and block all other connection – Gilles Jul 9 '12 at 0:02

2 Answers

up vote 2 down vote

The following rules will allow all outgoing connections, but block any incoming connections. The INPUT and FORWARD chains are set to reject packets by default, the OUTPUT chain is set to accept packets by default, and the last rule allows incoming packets which are part of existing connections (which in this case can only be outgoing connections).

iptables --policy INPUT DROP
iptables --policy FORWARD DROP
iptables --policy OUTPUT ACCEPT
iptables --append INPUT --match state --state ESTABLISHED,RELATED --jump ACCEPT
iptables --append INPUT --jump REJECT
iptables --append FORWARD --jump REJECT

If you want to restrict outgoing traffic you want to change the OUTPUT policy to reject, and add rules to accept traffic on certain ports. For example:

iptables --policy OUTPUT DROP
iptables --append OUTPUT --protocol udp --match multiport --dports domain,bootps --jump ACCEPT
iptables --append OUTPUT --protocol tcp --match multiport --dports domain,http,https,ssh,pop3s,imaps,submission --jump ACCEPT
iptables --append OUTPUT --jump REJECT
share|improve this answer
REJECT is not a valid policy target (ACCEPT, DROP, QUEUE, and RETURN are the only ones allowed there). – Steven Monday Jul 8 '12 at 4:14
@StevenMonday Thanks, corrected. – mgorven Jul 8 '12 at 4:26
Is iptables --append OUTPUT --jump REJECT supposed to be iptables --append OUTPUT --jump DROP? or remain "REJECT"? All the --jumps still show "REJECT" – killermist Jul 8 '12 at 14:50
@killermist I prefer using explicit rejects in my firewalls instead of silent drops, hence the REJECT rules in addition to the DROP policies. – mgorven Jul 8 '12 at 17:20
After the previously mentioned valid policy list, I wasn't sure if "REJECT" was a valid policy, or not. Not a criticism question, just valid curiosity. – killermist Jul 8 '12 at 17:23
show 2 more comments
up vote 0 down vote

The following iptables-restore script should suffice for your needs:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -m state ! --state NEW -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
COMMIT

The script can be made even shorter by dropping the rule that allows ICMP pings, but I wouldn't recommend doing that. IMO, responding to ping doesn't hurt security much (if at all), and it can be helpful for network troubleshooting.

If you want to allow incoming connections on a particular TCP port (e.g. to allow ssh connections), you could add rule(s) to your script, such as the following, right above the COMMIT statement:

-A INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.