1

I disable firewall like so:

#!/bin/bash
iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

Update

I also enable my firewall:

 #!/bin/bash

ssh=x.x.x.x
http='x.x.x.x y.y.y.y'

# Clear any previous rules.
iptables -F

# Default drop policy.
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Allow anything over loopback.
iptables -A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -o lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT

# Drop any tcp packet that does not start a connection with a syn flag.
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

# Drop any invalid packet that could not be identified.
iptables -A INPUT -m state --state INVALID -j DROP

# Drop invalid packets.
iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN              -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST              -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,RST FIN,RST              -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags ACK,FIN FIN                  -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags ACK,URG URG                  -j DROP

# Allow TCP/UDP connections out. Keep state so conns out are allowed back in.
iptables -A INPUT  -p tcp -m state --state ESTABLISHED     -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT  -p udp -m state --state ESTABLISHED     -j ACCEPT
iptables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT

# Allow only ICMP echo requests (ping) in. Limit rate in. Uncomment if needed.
iptables -A INPUT  -p icmp -m state --state NEW,ESTABLISHED --icmp-type echo-reply -j ACCEPT
iptables -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED --icmp-type echo-request -j ACCEPT

iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED --source $ssh -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport 22 -j DROP

for web in $http; do
    iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED --source $web -p tcp -m multiport --dports 80,443 -j ACCEPT
    iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp -m multiport --dports 80,443 -j DROP
done


# or block ICMP allow only ping out
iptables -A INPUT  -p icmp -m state --state NEW -j DROP
iptables -A INPUT  -p icmp -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT

So I want just x.x.x.x be able to ssh to me. and also I want the follwing ips to see my 80,443 ports:

x.x.x.x
y.y.y.y

how can I change it?

  • Can you post the output of iptables -L -n -v after you've run your firewall setup script? – David King Dec 30 '15 at 16:51
  • It's probably a good idea to move the lines that change the policy to DROP to the end of the script. If you're connected to that machine via ssh you will get dropped. – Alex Dec 30 '15 at 19:12
1

I think you are putting your rules in the wrong order. In iptables, the -A appends to the chain, not inserts it before it. Normally, you have ...

iptables -A INPUT  -p tcp -m state --state ESTABLISHED     -j ACCEPT

and then

# Drop any tcp packet that does not start a connection with a syn flag.
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

Instead of changing the order, you could rewrite it with -I INPUT 1, so that each rule is inserted before the previous one, ie, at the top. But the tail ping/icmp rules will have to be moved in that case.

Now, back to your question:

iptables -N SSH_CHECK
iptables -N HTTP_CHECK

iptables -A INPUT -p tcp --dport 22 -j SSH_CHECK
iptables -A INPUT -p tcp --dport 80 -j HTTP_CHECK
iptables -A INPUT -p tcp --dport 443 -j HTTP_CHECK

iptables -A SSH_CHECK -s x.x.x.x -j ACCEPT -m comment --comment "allow joe to ssh from his IP"
iptables -A HTTP_CHECK -s y.y.y.y -j ACCEPT -m comment --comment "allow mary to visit my HTTP/S server"

Your default drop policy takes care of the non-conforming IPs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.