Scott Miller wrote:
I was wondering if I could get someone to verify my rules. What I am trying
to do to start with, is make only certain ports available on my outgoing
mail server - essentially blocking all other ports not listed. I have the
below on my server in an inactive state because when I activate it, it locks
it completely down.
Could someone please take a look at my rules and share with me what I did
wrong? Here is my entire config file:
-----------------------------
*mangle
:PREROUTING ACCEPT [6:948]
:INPUT ACCEPT [6:948]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7:3269]
:POSTROUTING ACCEPT [7:3269]
COMMIT
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# HTTP
-A INPUT -p tcp -m tcp -m state NEW,ESTABLISHED --dport 80 --state NEW -j
ACCEPT
# SSH
-A INPUT -p tcp -m tcp -m state NEW,ESTABLISHED --dport 22 --state NEW -j
ACCEPT
# DNS
-A INPUT -p tcp -m tcp -m state NEW,ESTABLISHED --dport 53 --state NEW -j
ACCEPT
# TIME
-A INPUT -p udp -m udp -m state NEW,ESTABLISHED --dport 123 --state NEW -j
ACCEPT
# WEBMIN
-A INPUT -p tcp -m tcp -m state NEW,ESTABLISHED --dport 10000 --state NEW -j
ACCEPT
# SMTP
-A INPUT -p tcp -m tcp -m state NEW,ESTABLISHED --dport 25 --state NEW -j
ACCEPT
# POP3
-A INPUT -p tcp -m tcp -m state NEW,ESTABLISHED --dport 110 --state NEW -j
ACCEPT
# IMAP
-A INPUT -p tcp -m tcp -m state NEW,ESTABLISHED --dport 993 --state NEW -j
ACCEPT
# RSYNC-TCP
-A INPUT -p tcp -m tcp -m state NEW,ESTABLISHED --dport 873 --state NEW -j
ACCEPT
# RSYNC-UDP
-A INPUT -p udp -m udp -m state NEW,ESTABLISHED --dport 873 --state NEW -j
ACCEPT
# DENY ALL OTHERS
-A INPUT -i eth0 -j REJECT --reject-with icmp-net-unreachable
COMMIT
--------------------------
Hi Scott,
No expert here but I'll give this a try. This is very basic but
hopefully may provide some ideas.
You say you want to run a server so that means you should lock down
everything you specifically don't want to serve. That's accomplished by
setting the INPUT chain's default policy to DROP.
#> iptables -P INPUT DROP
Let the network gossip
#> iptables -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
We have to be able to talk to ourselves...
#> iptables -A INPUT -i lo -j ACCEPT
...and carry on a conversation.
#> iptables -A INPUT -m state --state ESTABLISHED,RELATED --j ACCEPT
With regard to unwanted traffic: UDP is stateless so we'll let the
default DROP policy discard that. TCP is stateful so we may or may not
want to let the default DROP policy apply. If we decide against
dropping unwanted TCP traffic we may want to cleanly terminate those
connections by resetting them
#> iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
We're ready. Let's open for business and allow NEW customers
(this one is shopping for SMTP)
#> iptables -A INPUT -p tcp --dport 25 --state NEW -j ACCEPT
(this one is shopping for HTTP)
#> iptables -A INPUT -p tcp --dport 80 --state NEW -j ACCEPT
Hope that is enough to get you going :m)
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
