0

I am learning by myself for the Linux iptables. I am doing some labs which I found on web. I need to solve these: I am using Vmware ordoing this. my windows machine ip is: 192.168.48.129 and my vm ip is 172.17.40.100

Perform the following steps for this section:

Make certain that you have iptables services enabled and running instead of Firewalld.
Modify the iptables to meet the following conditions:

            1. All outgoing traffic is allowed.
            2. Responses to any traffic the machine sends out are allowed.
            Traffic on the loopback interface is allowed.
            3. The host machine (and only the host machine) must be able to ssh to that cloning-source VM.
            4. ICMP traffic is allowed if it originated with the local network only.
            5. As this is acting as the secure basis for later machines, no other traffic should be allowed, and no response should be sent if any other traffic is received.

My answer were as follows:

**1. iptables -P OUTPUT ACCEPT

  1. iptables -I OUTPUT -j ACCEPT

  2. iptables -I INPUT -p tcp -s 192.168.48.129 --sport 22 -j ACCEPT

  3. iptables -I INPUT -p icmp -s 172.17.40.0/24 -j ACCEPT

  4. iptables -P INPUT DROP **

  • the conntrack extension is typically used to allow related traffic. instead using iptables-save and iptables-restore may improve the atomicitiy and what the resulting rules all look like – thrig Jun 4 '18 at 19:44
  • 3. is wrong (the source IP is the host's source IP, right, but the port 22 is for the destination, not the source). As thrig told 2. is also wrong. The rule you added has the same effect as 1., thus not needed. You need a stateful rule using conntrack for input (replies) not output. Else 5. will prevent everything to work correctly. Look on internet for this, it's quite common and you want to learn – A.B Jun 10 '18 at 8:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.