2

This is my setting in /etc/sysconfig/iptables:

#start of my iptables  
# Generated by iptables-save v1.2.11 on Wed May 27 00:31:22 2015  
*mangle
:PREROUTING ACCEPT [130933577:29488298585]  
:INPUT ACCEPT [130933577:29488298585]  
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [171790648:176814024859]  
:POSTROUTING ACCEPT [171789023:176813945079]  
COMMIT
# Completed on Wed May 27 00:31:22 2015  
# Generated by iptables-save v1.2.11 on Wed May 27 00:31:22 2015  
*filter  
:INPUT ACCEPT [130907005:29486700773]  
:FORWARD ACCEPT [0:0]  
:OUTPUT ACCEPT [171789023:176813945079]  
-A INPUT -s 117.21.191.0/255.255.255.0 -j DROP  
-A INPUT -s 106.0.210.78 -j DROP  
-A INPUT -s 58.218.0.0/255.255.0.0 -j DROP  
-A INPUT -s 117.3.215.251 -j DROP  
-A INPUT -s 119.97.146.0/255.255.255.0 -j DROP  
-A INPUT -s 203.185.69.45 -j DROP  
-A INPUT -s 58.18.172.0/255.255.255.0 -j DROP  
-A OUTPUT -p tcp -m tcp --dport 6660:6669 -j DROP  
-A INPUT -p tcp -s my_static_ip --dport 22 -j ACCEPT  
-A INPUT -p tcp -s my_static_ip --dport 21 -j ACCEPT  
-A INPUT -p tcp -s my_static_ip --dport 110 -j ACCEPT  
-A INPUT -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT  
-A INPUT -p tcp -m tcp --dport 443 -m state --state NEW,ESTABLISHED -j  ACCEPT  
-A INPUT -p tcp ! -s my_static_ip -j DROP  
COMMIT  
# Completed on Wed May 27 00:31:22 2015  
# Generated by iptables-save v1.2.11 on Wed May 27 00:31:22 2015  
*nat  
:PREROUTING ACCEPT [8063847:452240147]  
:POSTROUTING ACCEPT [3324733:239203840]  
:OUTPUT ACCEPT [3324733:239203840]  
COMMIT  
# Completed on Wed May 27 00:31:22 2015  
# end of my iptables  

my_static_ip is the ip address that I use to connect to the linux server (say 100.10.10.10).

Basically I wanted to allow only my one ip to connect to my server to use ssh, ftp, receive and send email etc etc because there were many abusive IP and bots that tried to access ssh, ftp, pop, etc. HTTP and SSL must be allowed for everyone on my server.

With the setting above, everything is well except that I cannot receive nor send email. Could you tell me what I did wrong?

Thank you in advance for your help.

1

Email transport normally use port 25 (SMTP), 465 (SMTP over SSL) and/or 587 (Submission). The only 'email' port that I can see in your configuration is 110 (POP3) which is a client to mailserver protocol to read emails in your favorite mailclient but it is not used to receive or send emails from/to your server.

If you want to receive emails to your server you need to allow the above ports from external side and if you want to be able to send mails from your client through your server you need to allow those ports from your static address.

1

First, a general remark about good practice:

A nicer way of doing this is to create another chain, and redirect the filter for your ip:

-A INPUT -p tcp -s my_static_ip -j MYIP

and then put all the other filters in the MYIP chain. You also don't need the negation clause ! -s my_static_ip, after you redirect your ip to another chain, then next line can just drop everything else with

-A INPUT -p tcp -j DROP

sshguard or a similar filter is also a nice idea to block the abusers without completely restricting access over ssh all but one address.

If you trust my_static_ip, you could just let it through completely.

For email, you will need to find out which protocols you use. You opened port 110 (non-encrypted POP) but you probably need SMTP and/or IMAP.

This brings me to my next comment: you wouldn't have seen any problems, if you accepted all ESTABLISHED connections anyway (not just http(s)). Because you are the one that initiates the connection to the mail server (checking for new mail or sending it), the mail server will not contact you on its own, it will just serve you what you requested. So if you allow all ESTABLISHED, that's covered. Many applications, not just mail clients, use various protocols to retrieve their content, and they will all break in your current configuration. Just use

-A INPUT -p tcp -m tcp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT  

and you've covered all the cases without compromising the security. New incoming connections will be dropped, but if the communication comes from your side, it is let through.

EDIT:

My suggestion, but I haven't tested it.

*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:TCP - [0:0]
:UDP - [0:0]
:MYIP - [0:0]
##:sshguard - [0:0]
#accept established connections immediately
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
#drop all invalid packets
-A INPUT -m conntrack --ctstate INVALID -j DROP
#accept localhost (web interfaces and such)
-A INPUT -i lo -j ACCEPT
#pings and such
-A INPUT -p icmp -j ACCEPT
#special treatment of your ip
#whatever MYIP chain doesn't accept is still subjected to all the following
#rules - because of the dash in the :MYIP - line above.
#if you really trust MYIP, you can just use ACCEPT
-A INPUT -s my_static_ip -j MYIP
#split into individual chains for TCP and UDP packets, handle them separately
#in case you want to add specific rules for UDP and TCP things (like the http(s) acceptance below)
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
#reasonable defaults for dropping things
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
#if you have a web server, allow http(s):
-A TCP -p tcp -m tcp --dport 80 -j ACCEPT
-A TCP -p tcp -m tcp --dport 443 -j ACCEPT
#dropping these outbound ports?
-A OUTPUT -p tcp -m tcp --dport 6660:6669 -j DROP
#it's nice to let DNS through
-A UDP -p udp -m udp --dport 53 -j ACCEPT

#what to accept in your ip chain
#you don't even need mail ports here, because their requests don't come from outside
-A MYIP -p tcp --dport 22 -j ACCEPT
-A MYIP -p tcp --dport 21 -j ACCEPT

#alternative: install sshguard and uncomment these lines (and the chain definition in the header)
##-A TCP -p tcp -m tcp --dport 22 -j sshguard
##-A TCP -p tcp -m tcp --dport 22 -j ACCEPT
COMMIT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.