3

I use these commands to block all ports and allow only some specific ports.

iptables -F  
iptables -X  
iptables -P OUTPUT ACCEPT  
iptables -P FORWARD ACCEPT  
iptables -A INPUT -i lo -j ACCEPT  
iptables -A OUTPUT -o lo -j ACCEPT  
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT  
iptables -A OUTPUT -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT  
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE    
iptables -A FORWARD -j ACCEPT    
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT  
/sbin/iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT    
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT  
/sbin/iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT  
/sbin/iptables -A INPUT -p tcp --dport 443 -j ACCEPT  
/sbin/iptables -A OUTPUT -p tcp --sport 443 -j ACCEPT    
/sbin/iptables -A INPUT -p tcp --dport 1723 -j ACCEPT  
/sbin/iptables -A OUTPUT -p tcp --sport 1723 -j ACCEPT    
iptables -A INPUT -p gre -j ACCEPT      
iptables -A INPUT -j DROP  
iptables -A OUTPUT -j DROP  

This uses iptables to block all ports except 80, 22, 443, 1723.

What command can I use to check which ports are open?

3

You can use nmap or netcat.

For example :

 nmap -p 1-65535  127.0.0.1
  • But i open only 4 ports, all other ports are blocked. the output of command you gave me, shows so many ports. – purval_patel Mar 3 '17 at 6:45
  • @PurvalPatel You have lo wide open, so anything on 127.0.0.1 will go through. Try the same command on a different machine, replacing the loopback address with the IP of the machine running iptables – Fox Mar 6 '17 at 16:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.