1

My application server is on a network protected by a organization wide firewall, and my server is also using fail2ban. That said, I'd like to set up an additional layer of protection with iptables. I'm having a little trouble with my configuration - specifically accessing external content from the application server.

Requirements:

  1. Deny access to everyone, then allow to a specific IP range (4.3.2.*)
  2. Ability to retrieve external content from application server

Knowns:

  • The application server IP is 1.2.3.4
  • My laptop's static IP is 4.3.2.1

What I've tried:

Starting with a vanilla iptables config that allows traffic over ports 22, 80 and 443, I added the following.

# allow traffic from a specific IP range
iptables -A INPUT -s 4.3.2.0/24 -j ACCEPT

# allow traffic over LDAP port
iptables -A INPUT -p tcp --dport 636 -j ACCEPT

# keep existing traffic
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# deny all traffic
iptables --policy INPUT DROP

I save that config using service iptables save, then restart the service.

Here is iptables -L -v -n --line-numbers

Chain INPUT (policy DROP 461 packets, 81259 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1    11835 1095K fail2ban-SSH  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22 
2    2972K 1083M ACCEPT     all  --  *      *       4.3.2.0/24           0.0.0.0/0           
3        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:636 
4    3747K  436M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 89676 packets, 26M bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain fail2ban-SSH (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1    11776 1092K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0       

Problem:

I'm unable to access external content with the ruleset above. The default OUTPUT policy is ACCEPT, so I'm unsure what the problem could be. I've tested this from the application itself, and from simply going to command and using lynx https://some.site. If I change the default INPUT policy to ACCEPT, lynx is able to pull up the content. What about the INPUT policy is preventing the content from loading?

  • What does "accessing external content from the application server" mean from a network perspective? You should have a look at the traffic on the interface: tcpdump -i eth0 -n not tcp or not tcp port 22 – Hauke Laging May 15 '14 at 21:06
  • We can't help you if you don't post your entire ruleset. The line numbers on your INPUT chain show you're missing at least rule num 2,3,4,6,7 – Creek May 15 '14 at 23:24
  • @Creek, the other INPUT rules were additional subnets that would have access. I tried to simplify my question by removing them. The other IPs would be 4.3.3.0/24 and 4.3.4.0/24. That was all that was left out of the ruleset example. – a coder May 16 '14 at 2:58
0

Got this sorted out - was an easy solution. I obtain data from a single external sytem (1.1.1.99), but that IP wasn't in my ruleset and was being blocked.

So adding this and saving solves the problem:

iptables -A INPUT -s 1.1.1.99 -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.