1

Please, help me to understand what I'm doing wrong with iptables on ubuntu 14.04.

iptables -F
ip6tables -F

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT DROP

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

# allows the outgoing traffic of established connections, necessary if the OUTPUT policy is not set to ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -j DROP

iptables -nvL

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
10574   17M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    2    88 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
  260 14124 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
10317  623K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

In the above I try to block all except ssh. So, I expect that wget won't be able to download anything, but it works and apt-get update doesn't work (as expected). Please, explain me how to block all (incoming/outgoing), or if this configuration is ok, why wget is still working?

EDIT: Also I tried to change 2 lines to one, but it does't help.

iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Result: wget is working, apt-get update no. Could someone clarify why? Thanks.

  • Is wget using a proxy? A different interface? Please show a sample successful wget to see what connection(s) it makes. – JigglyNaga Sep 2 '16 at 8:33
  • Don't know about proxy, I didn't do any configuration of wget. There is only one eth0 except lo. CSample: Resolving repo1.maven.org (repo1.maven.org)... 151.101.20.209 Connecting to repo1.maven.org (repo1.maven.org)|151.101.20.209|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 8870813 (8.5M) [application/java-archive] Saving to: Б─≤wiremock-standalone-2.1.11.jarБ─≥ 100%[=========================================================================>] 8,870,813 654KB/s in 14s – itisevgeny Sep 2 '16 at 8:55
  • make sure the rules are actually loaded with iptables -nvL and paste the output, also please include the output of curl -vI www.google.com in the original question. – Rabin Sep 2 '16 at 8:57
  • sure, incoming ports closed, so web service which working on ubuntu isn't available via https for example. – itisevgeny Sep 2 '16 at 8:59
  • 2
    To help find a solution, you should edit the question to include some more information: (1) that you also want HTTPS, and (2) the purpose of your iptables commands (especially the cstate ones). If you're following instructions found elsewhere, please link to them so we can see whether they're right for your needs. – JigglyNaga Sep 2 '16 at 10:01
0

Let's look at your rules and requirements block by block. You've got a default policy of DROP so you don't need the final rule. (It's not a bad idea, though.)

I try to block all except ssh. So, I expect that wget won't be able to download anything, but it works and apt-get update doesn't work (as expected)

Input rules:

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

What that says is that any traffic related to an outgoing connection is to be permitted. And anything inbound to tcp/22 (i.e. ssh) is also to be permitted. Everything else should be dropped. Note that nothing here blocks your outgoing wget and apt-get update requests.

Output rules:

iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -j DROP

What this says is that any traffic related to a previously permitted inbound connection is to be permitted. And anything outbound to a destination tcp/22 (i.e. ssh) is also to be permitted. Finally, everything else should be dropped.

Observations:

Nothing in the outbound section permits your wget or apt-get update requests. Therefore, if wget is working then please provide the example command you're using, along with the output of set | grep _proxy. (You may see one or more definitions such as http_proxy, which define a proxy for each corresponding protocol.)


By the way, recommended practice for iptables is to allow all loopback traffic, which you can do with these two commands:

iptables -I INPUT -i lo -j ACCEPT
iptables -I OUTPUT -o lo -j ACCEPT
  • Default in/out policies is to DROP, and http/https not accepted, only 22 should be opened. So, question is not disappear. – itisevgeny Sep 2 '16 at 13:23
  • Thanks for your reply. I will check on fresh installation a little bit later. About loopback - I know, but in case if it doesn't needed, it is cannot be recommended anyway. It depends on situation. – itisevgeny Sep 5 '16 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.