iptables
works on a first match basis. Let's break down your example:
iptables -A INPUT -s 172.217.23.206 -j ACCEPT
iptables -A OUTPUT -d 172.217.23.206 -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP
The first line tells iptables
to permit all traffic from the IP address 172.217.23.206
to the machine where these rules where applied. And all traffic is, quite literally, all traffic. So, no matter the protocol, port, options, et cetera; as long as the source matches 172.217.23.206
it passes.
The second line permits all any and all traffic from your machine to 172.217.23.206
. Again, it doesn't matter what the protocol, port, etc is; as long as the destination matches 172.217.23.206
it is allowed.
The third line tells iptables
to drop any incoming traffic that doesn't match the first two rules, whereas the fourth and last line tells iptables
to drop any outgoing traffic that doesn't match the three foregoing lines.
I am assuming you want to build a scenario that allows traffic to only a couple of websites. The ruleset you have written, isn't going to work for this scenario;
- Your computer has no way of knowing that google.com might resolve to
172.217.23.206
. Normally, it can acquire this information by querying a DNS server or by local /etc/hosts
entries.
- There is no reason to allow any incoming traffic in this scenario, as
iptables
is smart enough to keep track of your connections and to allow replies. This process is calling keeping state.
- Allowing all kinds of traffic to
172.217.23.206
, just to get a website doesn't make any sense.
- ICMP traffic (including
ping
) is a special kind. You need to block it specifically.
This ruleset does fit this scenario:
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp -d unix.stackexchange.com --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d unix.stackexchange.com --dport 443 -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP
This ruleset allows your computer to query DNS servers, using port 53/udp. It then permits TCP traffic to unix.stackexchange.com, to port 80 (http) and 443 (https). It keeps track of connections and drops all other traffic.
You could drop the rule permitting DNS queries, as long as you've configured the matching entries in /etc/resolv.conf
.
/etc/hosts
.