blocking all traffic except whitelisted ip adresses

Question

I need block all incoming and outcoming connections in firewall, except ip adresses i whitelist. I am currently on virtual machine using ubuntu. I tried these commands from this site: but i cant connect to this website, which is google, but ping works, i have no experience with linux, other websites don't work aswell.

iptables -A INPUT -s 172.217.23.206 -j ACCEPT
iptables -A OUTPUT -d 172.217.23.206 -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP

Answer 1

iptables works on a first match basis. Let's break down your example:

iptables -A INPUT -s 172.217.23.206 -j ACCEPT
iptables -A OUTPUT -d 172.217.23.206 -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP

The first line tells iptables to permit all traffic from the IP address 172.217.23.206 to the machine where these rules where applied. And all traffic is, quite literally, all traffic. So, no matter the protocol, port, options, et cetera; as long as the source matches 172.217.23.206 it passes.

The second line permits all any and all traffic from your machine to 172.217.23.206. Again, it doesn't matter what the protocol, port, etc is; as long as the destination matches 172.217.23.206 it is allowed.

The third line tells iptables to drop any incoming traffic that doesn't match the first two rules, whereas the fourth and last line tells iptables to drop any outgoing traffic that doesn't match the three foregoing lines.

---

I am assuming you want to build a scenario that allows traffic to only a couple of websites. The ruleset you have written, isn't going to work for this scenario;

• Your computer has no way of knowing that google.com might resolve to 172.217.23.206. Normally, it can acquire this information by querying a DNS server or by local /etc/hosts entries.
• There is no reason to allow any incoming traffic in this scenario, as iptables is smart enough to keep track of your connections and to allow replies. This process is calling keeping state.
• Allowing all kinds of traffic to 172.217.23.206, just to get a website doesn't make any sense.
• ICMP traffic (including ping) is a special kind. You need to block it specifically.

---

This ruleset does fit this scenario:

iptables -I INPUT 1 -i lo -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp -d unix.stackexchange.com --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d unix.stackexchange.com --dport 443 -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP

This ruleset allows your computer to query DNS servers, using port 53/udp. It then permits TCP traffic to unix.stackexchange.com, to port 80 (http) and 443 (https). It keeps track of connections and drops all other traffic.

You could drop the rule permitting DNS queries, as long as you've configured the matching entries in /etc/resolv.conf.