My application server is on a network protected by a organization wide firewall, and my server is also using
fail2ban. That said, I'd like to set up an additional layer of protection with
iptables. I'm having a little trouble with my configuration - specifically accessing external content from the application server.
- Deny access to everyone, then allow to a specific IP range (4.3.2.*)
- Ability to retrieve external content from application server
- The application server IP is 188.8.131.52
- My laptop's static IP is 184.108.40.206
What I've tried:
Starting with a vanilla
iptables config that allows traffic over ports 22, 80 and 443, I added the following.
# allow traffic from a specific IP range iptables -A INPUT -s 220.127.116.11/24 -j ACCEPT # allow traffic over LDAP port iptables -A INPUT -p tcp --dport 636 -j ACCEPT # keep existing traffic iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT # deny all traffic iptables --policy INPUT DROP
I save that config using
service iptables save, then restart the service.
iptables -L -v -n --line-numbers
Chain INPUT (policy DROP 461 packets, 81259 bytes) num pkts bytes target prot opt in out source destination 1 11835 1095K fail2ban-SSH tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 2 2972K 1083M ACCEPT all -- * * 18.104.22.168/24 0.0.0.0/0 3 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:636 4 3747K 436M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 89676 packets, 26M bytes) num pkts bytes target prot opt in out source destination Chain fail2ban-SSH (1 references) num pkts bytes target prot opt in out source destination 1 11776 1092K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
I'm unable to access external content with the ruleset above. The default OUTPUT policy is ACCEPT, so I'm unsure what the problem could be. I've tested this from the application itself, and from simply going to command and using lynx https://some.site. If I change the default INPUT policy to ACCEPT, lynx is able to pull up the content. What about the INPUT policy is preventing the content from loading?