1

This box is running Ubuntu 14.04b and was almost unconfigured.
I thought it would be a good idea to bring at least a firewall, and iptables was my choice.

IMHO, it will be better to load the rules from a iptables-generated file at interface pre-up startup, through /etc/network/interfaces, using something like
pre-up iptables-restore < /etc/iptables.rules
(with a iptables-save at post-down, in case I have to change something).

There are, however, two things that grind my gears:

  • First, I'm not sure my file will correctly get the job done (see below).
  • Second, last time I used iptables, IPv6 was not even a thing! I discovered there's an ip6tables for that, but I can't determine if I can use the same rule file for both... That would be great, but sadly, it sounds too easy to be true :/

Hereafter is my rule file, would anybody be kind enough to point me out anything weird, illogic or unneeded?

As you can see, the box will have an Apache web server (with domain name, so DNS needs to pass through), a MySQL server (with remote access), a SFTP server (it seems like FTP is now a pretty outdated thing), will act as mailserver (postfix, probably, and maybe a mailing-list with majordomo if it still exists) and must absolutely be accessible through SSH (I can't afford to lose SSH access to this server: it's a dedicated stuff somewhere at 400 Km away with no console)

# Generated by iptables-save v1.4.21 on Wed Sep 28 15:08:21 2016
*raw
:PREROUTING ACCEPT [30261051:8737714396]
:OUTPUT ACCEPT [28933128:15186346449]
COMMIT
# Completed on Wed Sep 28 15:08:21 2016
# Generated by iptables-save v1.4.21 on Wed Sep 28 15:08:21 2016
*nat
:PREROUTING ACCEPT [8040256:1000464908]
:INPUT ACCEPT [8040256:1000464908]
:OUTPUT ACCEPT [357964:47801350]
:POSTROUTING ACCEPT [357964:47801350]
COMMIT
# Completed on Wed Sep 28 15:08:21 2016
# Generated by iptables-save v1.4.21 on Wed Sep 28 15:08:21 2016
*mangle
:PREROUTING ACCEPT [30261051:8737714396]
:INPUT ACCEPT [30261051:8737714396]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [28933128:15186346449]
:POSTROUTING ACCEPT [28933128:15186346449]
COMMIT
# Completed on Wed Sep 28 15:08:21 2016
# Generated by iptables-save v1.4.21 on Wed Sep 28 15:08:21 2016
*filter
:INPUT ACCEPT [10752:1386943]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [18529:5801236]
# Do not kill established connections
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

#INPUT rules
#SSH & SFTP
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
#HTTP server
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
#HTTPS
-A INPUT -i eth0 -p tcp -m tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
#Echo
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
#DNS
-A INPUT -i eth0 -p udp -m udp --sport 53 -j ACCEPT
#SMTP
-A INPUT -i eth0 -p tcp -m tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
#SQL in
-A INPUT -i eth0 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
#IMAP
-A INPUT -i eth0 -p tcp -m tcp --dport 143 -m state --state NEW,ESTABLISHED -j ACCEPT
#IMAP sur SSL
-A INPUT -i eth0 -p tcp -m tcp --dport 993 -m state --state NEW,ESTABLISHED -j ACCEPT
#POP3
-A INPUT -i eth0 -p tcp -m tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT
#POP3 sur SSL
-A INPUT -i eth0 -p tcp -m tcp --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT
#Limit HTTP flood
-A INPUT -p tcp -m tcp --dport 80 -m limit --limit 25/min --limit-burst 100 -j ACCEPT
#Loopback
-A INPUT -i lo -j ACCEPT

#OUTPUTS
#SSH & SFTP
-A OUTPUT -o eth0 -p tcp -m tcp --sport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
#HTTP
-A OUTPUT -o eth0 -p tcp -m tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
#HTTPS
-A OUTPUT -o eth0 -p tcp -m tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
#echo
-A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
#DNS
-A OUTPUT -o eth0 -p udp -m udp --dport 53 -j ACCEPT
#SMTP
-A OUTPUT -o eth0 -p tcp -m tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT
#SQL out
-A OUTPUT -o eth0 -p tcp -m tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT
#IMAP
-A OUTPUT -o eth0 -p tcp -m tcp --sport 143 -m state --state ESTABLISHED -j ACCEPT
#IMAP sur SSL
-A OUTPUT -o eth0 -p tcp -m tcp --sport 993 -m state --state ESTABLISHED -j ACCEPT
#POP3
-A OUTPUT -o eth0 -p tcp -m tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT
#POP3 sur SSL
-A OUTPUT -o eth0 -p tcp -m tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT
#Doublons by legacy script.
#Remove?
-A OUTPUT -p tcp -m tcp --dport 53
-A OUTPUT -p udp -m udp --dport 53
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
#Loopback
-A OUTPUT -o lo -j ACCEPT

#End of config. Make it happen!
COMMIT
# Completed on Wed Sep 28 15:08:21 2016

Thanks for any help!

2

Since your iptables save file doesn't reference any IPs, you should be okay using it for ip6tables as well. Your best bet is to issue an at job to reset the firewall rules in 2 minutes (or whatever time you feel appropriate):

# echo "service iptables stop" | at now + 2 minutes

then apply the iptables rules from your file for IPv4 and IPv6:

# iptables-restore < iptables-save-file
# ip6tables-restore < iptables-save-file

if things are inaccessible at that point, wait 2 minutes for the at job to deactivate the firewall, and start configuring the rulesets manually. If they work, run service iptables save and service ip6tables save and enjoy your new firewall.

I should also note that your existing file never actually denies or rejects or drops any traffic - the default policy on all chains is ACCEPT, and there are no trailing rules with DROP or REJECT targets, so you've got what appears to be a rather ineffectual firewall configuration.

  • Thanks @John Not a bad idea, using at to avoid being locked out! But there's no "iptables" service... According to the distro-specific documentation I gathered, I guess I'll have to use the ufw (not a big deal, thought). So, as long I don't use any IP, I'll use a common file for both iptables and ip6tables, that'll be perfect. Oops! I thought default policy was REJECT if any ACCEPT rule was set. If I'm not mistaking, adding these lines at the beginning of the *filter section should do the trick? : -P INPUT DROP -P FORWARD DROP -P OUTPUT ACCEPT – Pylou Sep 29 '16 at 12:14
  • I strongly recommend you never edit the save file yourself. It's bad practice and can lead to much pain if you get it wrong and the system reboots on you unexpectedly. Set your "at" trigger and modify the active ruleset (iptables -P ACCEPT DROP). – John Sep 29 '16 at 12:49
  • Well, in fact, I only edit copies of the save file, and now, thanks to your idea, I manually load it with a timed reload of the "last valid file". Once everything is running as expected, the "last valid" is archived and the work copy becomes the new valid file. But you indeed have a point: in the event of a crash during the "test timer", I'm not sure the at scheduler will work properly... – Pylou Sep 30 '16 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.