0

I'm trying to create a simple iptables configuration that restricts outgoing connections to a set of ip addresses. However every time I try to configure OUTPUT rules I kill my ssh connection.

For the sake of this question lets just assume that I want to allow all incoming traffic and only allow outgoing traffic to ip 8.8.8.8 on port 53.

Here is the iptables configuration I start with:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain DOCKER (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             ip-172-17-0-2.eu-central-1.compute.internal  tcp dpt:9090

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Now I try to restrict outgoing traffic like so:

iptables -I OUTPUT -d 8.8.8.8 -p udp --dport 53 -j ACCEPT
iptables -P OUTPUT DROP

The instance I execute the second command my ssh connection is blocked and I have to restart the server.

Maybe I understand iptables or ssh wrong. I was under the impression that the OUTPUT chain will control outgoing connections initiated by the server and shouldn't affect my ability to connect to the server on port 22. Also all other incoming connections on port 80 and 443 are killed so it is not only ssh.

1 Answer 1

1

I think I got it now:

iptables -I OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -d 127.0.0.0/8 -j ACCEPT
iptables -A OUTPUT -d 8.8.8.8 -p udp --dport 53 -j ACCEPT
iptables -P OUTPUT DROP

This should block all outgoing traffic on connections that have been initiated by the server. But not on connections that have been initiated by incoming connections.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .