3

Here is the file I load with iptables-restore on a Debian 8 freshly installed: The only thing I've changed is using the port 22022 for SSH in the /etc/ssh/sshd_config file.

----- SEE UPDATE BELOW-----

As soon as I load this file, I can't access to this debian in any way; even ping is not working. There is nothing in the /var/log/messages file about any error. This is my first try to configure iptables. I've read many docs about it, but there is something I'm doing wrong somewhere. Could you point out what happened here?

    *filter

    #----------
    # Local loop
    #----------
    -A INPUT -i lo -j ACCEPT
    -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

    #----------
    # Connexions already established
    #----------
    -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

    #----------
    # PING
    #----------
    -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

    #----------
    # SSH
    #----------

    -A INPUT -p tcp --dport 22022 -m state --state NEW,ESTABLISHED -j ACCEPT
    -A OUTPUT -p tcp --dport 22022 -m state --state NEW,ESTABLISHED -j ACCEPT

    #----------
    # HTTP
    #----------

    -A INPUT -p tcp --dport 80 -j ACCEPT
    -A OUTPUT -p tcp --dport 80 -j ACCEPT

    #----------
    # HTTPS
    #----------

    -A INPUT -p tcp --dport 443 -j ACCEPT
    -A OUTPUT -p tcp --dport 443 -j ACCEPT

    #----------
    # FTP
    #----------

    -A INPUT -p tcp --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT
    -A OUTPUT -p tcp --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT

    -A INPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
    -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT

    #----------
    # Logs
    #----------
    -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 4

    #----------
    # DROP everything else
    #----------
    -A INPUT -j DROP
    -A OUTPUT -j DROP
    -A FORWARD -j DROP

    COMMIT

----- UPDATE -----

Now I've NTP, Ping, DNS, Whois, SSH, HTTP(S) and FTP working. Hourra. Here is the new file, if you see something weird, tell me. I've also learned that using FTP(TLS/SSL) with vsftp (that I use) need some good skills to configure, and I've not found any good solution for now. I really hope that I'll figure this out, because I won't keep 'clear' FTP like this. If you have any idea. Thx again for your help, both answer were good, I can't choose one ;)

(by the way, I use a sh script now for loading modules)

    #!/bin/sh

    #----------
    # Load needed modules
    #----------
    modprobe ip_conntrack_ftp
    modprobe ip_nat_ftp

    #----------
    # Local loop
    #----------
    iptables -A INPUT -i lo -j ACCEPT
    iptables -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

    #----------
    # Connexions already established
    #----------
    iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

    #----------
    # NTP
    #----------
    iptables -A INPUT -p udp --sport 123 -j ACCEPT
    iptables -A OUTPUT -p udp --dport 123 -j ACCEPT

    #----------
    # PING
    #----------
    iptables -A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
    iptables -A OUTPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

    #----------
    # DNS
    #----------
    # UDP
    iptables -A INPUT -i eth0 -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
    iptables -A OUTPUT -o eth0 -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
    # TCP
    iptables -A INPUT -i eth0 -p tcp --sport 53 -m state --state ESTABLISHED -j ACCEPT
    iptables -A OUTPUT -o eth0 -p tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

    #----------
    # WHOIS
    #----------
    iptables -A INPUT -p tcp --sport 43 -j ACCEPT
    iptables -A OUTPUT -p tcp --dport 43 -j ACCEPT

    #----------
    # SSH
    #----------
    # Incoming
    iptables -A INPUT -i eth0 -p tcp --dport 22022 -m state --state NEW,ESTABLISHED -j ACCEPT
    iptables -A OUTPUT -o eth0 -p tcp --sport 22022 -m state --state ESTABLISHED -j ACCEPT
    # Outgoing
    iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
    iptables -A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

    #----------
    # HTTP
    #----------
    # Incoming
    iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
    iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
    # Outgoing
    iptables -A INPUT -i eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
    iptables -A OUTPUT -o eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

    #----------
    # HTTPS
    #----------
    # Incoming
    iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
    iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
    # Outgoing
    iptables -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
    iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT

    #----------
    # FTP
    #----------
    #incoming
    iptables -A INPUT -i eth0 -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
    iptables -A OUTPUT -o eth0 -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT

    #----------
    # Logs
    #----------
    #-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 4

    #----------
    # DROP everything else
    #----------
    iptables -A INPUT -j DROP
    iptables -A OUTPUT -j DROP
    iptables -A FORWARD -j DROP

    exit 0
  • 3
    You're dropping all outgoing packets. – ilkkachu Jul 28 '16 at 17:48
  • What are the policies for the INPUT and OUTPUT chains? – roaima Jul 28 '16 at 17:54
  • 1. Your OUTPUT rules for --dport 22022, --dport 80, --dport 443, etc. almost certainly don't do what you might think they do. Remove them. 2. Your rules for FTP won't work. 3. As @ilkkachu pointed out, you're dropping all outgoing packets. – roaima Jul 28 '16 at 17:57
4

After these rules:

-A OUTPUT -p tcp --dport 22022 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -j DROP

all you can send out of the machine, are HTTP(S) requests, some FTP connections and SSH connections destined to port 22022. But not for example responses originating from your SSH server, since their destination would be some random port chosen by the client (likely not 22022, except by chance). In the same way, responses from your HTTP server won't go out either, and neither are ICMP echo-replies allowed.

If you want to only allow packets sent by, say, your SSH server, you'll need to allow packets sent from port 22022, so --sport 22022.

Though even if you allow the SSH server to respond, you'll soon notice that you can't make many outgoing requests. You did allow HTTP requests, but for example outgoing DNS queries will not go out. Consider how tight you are willing to make the output rules. I'd suggest at least adding -m state --state ESTABLISHED -j ACCEPT and a -j LOG rule to the OUTPUT chain to start with.

  • Thx Ikkachu, roaima, and Henrik too ! It really helps me to understand (a little) how iptables "speaks". I'll edit my question with my new config file where I can now have ping, DNS and SSH working. – nderambure Jul 28 '16 at 21:26
3

As ilkkachu said in his answer, your output rules doesn't do want (I guess) you want them to.

Some advice:

  • Instead of explicitly ending your chains with a DROP rule, set a DROP policy for them instead with iptables -P INPUT DROP (and similar for OUTPUT and FORWARD, then you can add rules to the chains with iptables -A <chain>, the policy is automatically applies to any packet that reaches the end of the chain.
  • Add a rule to the OUTPUT chain allowing traffic on established and related connections, with iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT. Totally similar to the one you have in the INPUT chain. Then responses to anything you've allowed incoming will be allowed, no need to think about how that particular protocol works.
  • Consider adding rules allowing your server to make outgoing DNS requests (remember both UDP and TCP).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.