1

My new centos 6.5 cloud server came with this 

/etc/sysconfig/iptables

inside we have:

# Generated by iptables-save v1.4.7 on Mon Jun 16 20:04:05 2014
*filter
:INPUT ACCEPT [8:607]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [6:1089]
COMMIT
# Completed on Mon Jun 16 20:04:05 2014

but it looks like regardless if i stop or start iptables.. other ports remain open. i know this because i installed things such as webmin which was working fine on port 10000

and i also added a port to httpd.conf

 listen 81

as well as a virtual host for port 81.

it all works regardless of if iptables is started or stopped.

which means this above iptables file i have needs modifications.

i would like to disable all ports except for port 80 and 22

from there on i can test and add other ports myself.

Improve this question

1 Answer 1

Reset to default
2

Before giving any rules I would suggest to give your client IP full access in that server and once you confirm all rules are perfect, you can remove that rule.

iptables -A INPUT -s YOUR-CLIENT-IP -j ACCEPT

where YOUR-CLIENT-IP should be replaced by the IP with which you are connecting to the server.

Now you can start the rules. So first allowing SSH and HTTP:-

iptables -I INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -I INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

Finally you can block all other packets:-

iptables -A INPUT -j REJECT

And then you can verify if everything is working fine by access SSH and HTTP from other IPs and if everything is fine, you can remove the 1st rule in the list.

iptables -D INPUT 1

SHORT ANSWER

iptables -I INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -I INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -j REJECT

BETTER ANSWER

As pointed by creek in the comment, a better method would be to change the last rule and that would make it like this:-

iptables -I INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -I INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -P INPUT REJECT
Improve this answer
5
  • 4
    Instead of the -j REJECT rule at the end of the ruleset, the preferred method is to change the default policy for the INPUT chain, iptables -P INPUT DROP. That helps minimize incorrect configurations due to rule placement.
    – Creek
    Commented Jul 15, 2014 at 12:43
  • Yes Mr. Creek that is correct indeed. ;)
    – beginer
    Commented Jul 15, 2014 at 16:18
  • error with: $ sudo iptables -P INPUT -j REJECT--> iptables v1.4.21: -P requires a chain and a policy
    – arod
    Commented Jul 25, 2015 at 18:51
  • @arod sorry that was a typo. The "-j" is not required while setting default policy. I have edited my answer. Now you can go ahead with that.
    – beginer
    Commented Jul 27, 2015 at 8:28
  • 2
    You should use drop instead of reject if you dont want users to see your host as @Creek said in his comment
    – JazzCat
    Commented Apr 1, 2016 at 18:18

You must log in to answer this question.