0

I am trying to block all traffic to a webserver except from some defined subnets. I've checked numerous posts and believed I had iptables set correctly but for some reason the site is still accessible outside the subnets i've defined in the ruleset. Is anyone able to shed some light on what I may have done wrong? I've established that removing rule 3 stops the site from being reachable at all. The site itself sits in 10.10.0.0/16.

Chain INPUT (policy DROP 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 ACCEPT     all  --  any    any     10.10.0.0/16         anywhere            
2        0     0 ACCEPT     all  --  any    any     172.30.0.0/16        anywhere            
3        0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 ACCEPT     all  --  any    lo      anywhere             anywhere    

The goal will be to add various whitelisted public IPs and lockdown the site so that it is only accessible to some.

Rules were added as follows:

iptables -I INPUT -i lo -j ACCEPT
iptables -I OUTPUT -o lo -j ACCEPT
iptables -I INPUT -s 10.10.0.0/16 -j ACCEPT
iptables -I INPUT -s 172.30.0.0/16 -j ACCEPT
iptables -P INPUT DROP
  • With nftables it is much easier. – ctrl-alt-delor Mar 20 '20 at 22:28
0

The rule order matters in iptables. By using iptables -A you are appending rules at the end of the ruleset. But iptables -I inserts a rule on top of the ruleset, unless you specify a line number (you haven't). As a result rules are not evaluated in the intended order.

Here is a sample configuration that should work, based on this post. Flush your rules before to avoid duplication.

iptables -P FORWARD DROP
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -s 172.30.0.0/16 -j ACCEPT
# add some more whitelisting rules here
iptables -P INPUT DROP # Drop everything we don't accept

The third rule is important:

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

otherwise your server will not get replies to the connections that it initiated, take for example DNS requests.

On a side note, iptables works for IPv4 but not IPv6, so if your server is IPv6-enabled you may have clients connecting using IPv6. This is possible if they are connecting by hostname instead of IP address, and that the hostname resolves to a valid IPv6 address on your server. You'd probably be aware though, but many people are still not aware that iptables does filter IPv6 traffic (and attacks). I would then also add similar ip6tables rules if appropriate for your setup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.