Yesh! That snippet of firewall code is, um, well interesting to say the least if not broken. (I'm very tired if I come off a bit crass.)
To do what you are wanting to do I would attempt something like the following:
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP
iptables -t filter -N InternetTraffic
iptables -t filter -A InternetTraffic -d <IP of site 1> -j ACCEPT
iptables -t filter -A InternetTraffic -d <IP of site 2> -j ACCEPT
...
iptables -t filter -A InternetTraffic -d <IP of site n> -j ACCEPT
iptables -t filter -A InternetTraffic -j DROP
iptables -t filter -A INPUT -i eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT -i eth1 -j ACCEPT
iptables -t filter -A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -i eth0 -o eth1 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -i eth1 -o eth0 -p tcp --dport 80 -j InternetTraffic
iptables -t filter -A FORWARD -i eth1 -o eth0 -p tcp --dport 443 -j InternetTraffic
iptables -t filter -A OUTPUT -o eth0 -p tcp --dport 80 -j InternetTraffic
iptables -t filter -A OUTPUT -o eth0 -p tcp --dport 443 -j InternetTraffic
iptables -t filter -A OUTPUT -o eth1 -j ACCEPT
One word to the wise. You will likely need to have DNS somewhere for your systems to be able to find the hosts that they want to get to. If said DNS needs to pass through your firewall you will need to update the rules accordingly to allow it.
Grant. . . .
Barry Fawthrop wrote:
Hi
I was given a iptables ruleset (that I think was generated by firestarter)
I don't have GUI nor do I want to so I have no means to test it.
It runs on a gateway machine ETH0 = Wan and ETH1 = LAN NICs
I'm looking for a simple ruleset that will deny all outgoing traffic
accept to a list of IP addresses found in a file
and only on port 80 for HTTP access only.
I have this:
$IPT -t filter -A INPUT -s $INNET -d 0/0 -j DROP
$IPT -t filter -A OUTPUT -s $INNET -d 0/0 -j DROP
$IPT -t filter -A OUTPUT -p icmp -s $INNET -d 0/0 -j DROP
while read s1 s2
do
$IPT -t filter -A INPUT -s $INNET -d $s1 --dport 80 -j ACCEPT
$IPT -t filter -A OUTPUT -s $INNET -d $s1 --dport 80 -j ACCEPT
$IPT -t filter -A OUTPUT -p icmp -s $INNET -d $s1 -j ACCEPT
done < /allowed-hosts
1) doesn't work complains about --dport
2) I can still ping other ip addresses not found in the allowed-hosts file?
Any help, most welcome
Thank You
Barry
