2

I have set up lots of rules on iptables (if you want the orignal script click here):

iptables -A INPUT -m set --match-set banned src -j DROP
iptables -A INPUT -m set --match-set whitelist src -j ACCEPT
iptables -A INPUT -m set --match-set whitelist2 src -j ACCEPT
iptables -A OUTPUT -m set --match-set banned src -j DROP
iptables -A OUTPUT -m set --match-set whitelist src -j ACCEPT
iptables -A OUTPUT -m set --match-set whitelist2 src -j ACCEPT
iptables -A FORWARD -m set --match-set banned src -j DROP
iptables -A FORWARD -m set --match-set whitelist src -j ACCEPT
iptables -A FORWARD -m set --match-set whitelist2 src -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type     iptables -A OUTPUT -p icmp --icmp-type     iptables -A FORWARD -p icmp --icmp-type     iptables -A FORWARD -p icmp --icmp-type     iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.10.10.50 -o eth1 -j SNAT --to 192.168.1.142
iptables -t nat -A POSTROUTING -s 169.254.232.41 -o eth1 -j SNAT --to 192.168.1.142
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -p tcp -m multiport --dports 80 -d 192.168.1.142 -j DNAT --to 10.10.10.50:8000
iptables -t nat -A PREROUTING -i eth1 -p tcp -m multiport --dports 3389 -d 192.168.1.142 -j DNAT --to 10.10.10.50
iptables -t nat -A PREROUTING -i eth1 -p tcp -m multiport --dports 80 -d 192.168.1.142 -j DNAT --to 169.254.232.41:8000
iptables -t nat -A PREROUTING -i eth1 -p tcp -m multiport --dports 3389 -d 192.168.1.142 -j DNAT --to 169.254.232.41
iptables -N PACKET-CHECK
iptables -N 53-SCAN
iptables -t filter -A INPUT -m state --state NEW,UNTRACKED -j PACKET-CHECK
iptables -t filter -A INPUT -m state --state NEW -j PACKET-CHECK
iptables -t filter -A INPUT -m state --state NEW,UNTRACKED -j 53-SCAN
iptables -t filter -A INPUT -m state --state NEW -j 53-SCAN
iptables -A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 3389 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 8000 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 53 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 69 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 123 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 8000 -j ACCEPT
iptables -A INPUT -p udp -i eth2 -m multiport --dports 67,68 -j ACCEPT
iptables -A OUTPUT -p udp -o eth2 -m multiport --dports 67,68 -j ACCEPT
iptables -A INPUT -p tcp -i eth2 -m tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 67 -j DROP
iptables -A INPUT -p udp -m udp --dport 68 -j DROP
iptables -A OUTPUT -p udp -m udp --dport 67 -j DROP
iptables -A OUTPUT -p udp -m udp --dport 68 -j DROP
iptables -A INPUT -j DROP
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT

I now want to check if my rules work properly by trying various connections to my machine and checking which rules are being matched.

How could I do this?

1
  • Comments are not for extended discussion; this conversation has been moved to chat. – terdon Mar 23 '18 at 11:24
1
iptables -vnL

The packets are evaluated against the rules from top to bottom. A more detailed answer including debugging (logging) method can be found in this answer. And below an overview of the chains:

enter image description here

2
  • Shouldn't there be an arrow joining the ROUTING after the OUTPUT chain to the INPUT chain for loopback packets? – Torin Mar 19 '18 at 16:47
  • No I think not. Loopback traffic is not done via routing. It travels the same path as normal packets do, but when it exits on the right it just (magically) comes back in on the left. (But I have no proof, please correct me if I am wrong) – rda Mar 19 '18 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.