1. Delete Existing Rules
Before you start building a new set of rules, you might want to clean-up all the default rules and existing rules. Use the iptables flush command as shown below to do this.
# iptables -F
# iptables –flush # service iptables save
2. Set Default Chain Policies
The default chain policy is ACCEPT. Change this to DROP for all INPUT, FORWARD, and OUTPUT chains as shown below.
# iptables -P INPUT DROP # iptables -P FORWARD DROP # iptables -P OUTPUT DROP
When you make both INPUT and OUTPUT chain’s default policy as DROP, for every firewall rule requirement you have, you should define two rules. i.e one for incoming and one for outgoing.
Change default policy for INPUT/OUTPUT/FORWARD to ACCEPT. All inbound connections will be allowed
# iptables -P INPUT ACCEPT # iptables -P OUTPUT ACCEPT # iptables -P FORWARD ACCEPT
3. Block an IP for inbound connection
# iptables -A INPUT -s 192.168.1.5 -j DROP # iptables -A INPUT -i eth0 -p tcp -s “$BLOCK_THIS_IP” -j DROP
4. Allow an IP for inbound connection
# iptables -A INPUT -s 192.168.1.5 -j ACCEPT
5. Block outbound IP address
# iptables -A OUTPUT -d -j DROP
6. Block outbound PORT
# iptables -A OUTPUT -p tcp –dport -j DROP
7. Block outbound IP:PORT
# iptables -A OUTPUT -p tcp -d –dport -j DROP
8. Allow port 2222 for inbound tcp connections
# iptables -A INPUT -p tcp –dport 2222 -j ACCEPT
9. White list an IP
# iptables -A INPUT -i eth0 -s -j ACCEPT
10. Open port 5666
# iptables -I INPUT -p tcp -m tcp –dport 5666 -j ACCEPT
11. Allow ALL Incoming SSH
The following rules allow ALL incoming ssh connections on eth0 interface.
# iptables -A INPUT -i eth0 -p tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT # iptables -A OUTPUT -o eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT
12.Allow Incoming SSH only from a Sepcific Network
The following rules allow incoming ssh connections only from 192.168.100.X network.
# iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT # iptables -A OUTPUT -o eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT
In the above example, instead of /24, you can also use the full subnet mask. i.e “192.168.100.0/255.255.255.0″.
13. Allow Incoming HTTP and HTTPS
The following rules allow all incoming web traffic. i.e HTTP traffic to port 80.
# iptables -A INPUT -i eth0 -p tcp –dport 80 -m state –state NEW,ESTABLISHED -j ACCEPT # iptables -A OUTPUT -o eth0 -p tcp –sport 80 -m state –state ESTABLISHED -j ACCEPT
The following rules allow all incoming secure web traffic. i.e HTTPS traffic to port 443.
# iptables -A INPUT -i eth0 -p tcp –dport 443 -m state –state NEW,ESTABLISHED -j ACCEPT # iptables -A OUTPUT -o eth0 -p tcp –sport 443 -m state –state ESTABLISHED -j ACCEPT
14. Combine Multiple Rules Together using MultiPorts
When you are allowing incoming connections from the outside world to multiple ports, instead of writing individual rules for each and every port, you can combine them together using the multiport extension as shown below.
The following example allows all incoming SSH, HTTP and HTTPS traffic.
# iptables -A INPUT -i eth0 -p tcp -m multiport –dports 22,80,443 -m state –state NEW,ESTABLISHED -j ACCEPT # iptables -A OUTPUT -o eth0 -p tcp -m multiport –sports 22,80,443 -m state –state ESTABLISHED -j ACCEPT
15. Allow Outgoing SSH
The following rules allow outgoing ssh connection. i.e When you ssh from inside to an outside server.
# iptables -A OUTPUT -o eth0 -p tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT # iptables -A INPUT -i eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT
Please note that this is slightly different than the incoming rule. i.e We allow both the NEW and ESTABLISHED state on the OUTPUT chain, and only ESTABLISHED state on the INPUT chain. For the incoming rule, it is vice versa.
16. Allow Outgoing SSH only to a Specific Network
The following rules allow outgoing ssh connection only to a specific network. i.e You an ssh only to 192.168.100.0/24 network from the inside.
# iptables -A OUTPUT -o eth0 -p tcp -d 192.168.100.0/24 –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT # iptables -A INPUT -i eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT
17. Allow Ping from Outside to Inside
The following rules allow outside users to be able to ping your servers.
# iptables -A OUTPUT -p icmp –icmp-type echo-request -j ACCEPT # iptables -A INPUT -p icmp –icmp-type echo-reply -j ACCEPT
19. Allow Loopback Access
You should allow full loopback access on your servers. i.e access using 127.0.0.1.
# iptables -A INPUT -i lo -j ACCEPT # iptables -A OUTPUT -o lo -j ACCEPT
20. Allow MySQL connection only from a specific network
# iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 –dport 3306 -m state –state NEW,ESTABLISHED -j ACCEPT # iptables -A OUTPUT -o eth0 -p tcp –sport 3306 -m state –state ESTABLISHED -j ACCEPT
21. Prevent DoS Attack
The following iptables rule will help you prevent the Denial of Service (DoS) attack on your webserver.
# iptables -A INPUT -p tcp –dport 80 -m limit –limit 25/minute –limit-burst 1000 -j ACCEPT
In the above example,
- -m limit: This uses the limit iptables extension.
- –limit 25/minute: This limits only maximum of 25 connection per minute. Change this value based on your specific requirement.
- –limit-burst 1000: This value indicates that the limit/minute will be enforced only after the total number of connection have reached the limit-burst level.
22. Port forwarding using IPTables
Forward port 80 from IP address to another IP:
# iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 80 -j DNAT –to [DESTIP]:80 # iptables -t nat -A POSTROUTING -p tcp –dst [DESTIP] –dport 80 -j SNAT –to [SRCIP] # iptables -t nat -A OUTPUT –dst [SRC] -p tcp –dport 80 -j DNAT –to [DESTIP]:80
Removing the above rules:
# iptables -t nat -D PREROUTING -i eth0 -p tcp –dport 80 -j DNAT –to [DESTIP]:80 # iptables -t nat -D POSTROUTING -p tcp –dst [DESTIP] –dport 80 -j SNAT –to [SRCIP] # iptables -t nat -d OUTPUT –dst [SRC] -p tcp –dport 80 -j DNAT –to [DESTIP]:80
23. List all the rules in the iptables
# iptables -L
24. Check an IP in the rule
# iptables -nL | grep [IP]
25. Save the current iptables rules
# iptables-save > File_name
26. Restore iptable rules from the file
# iptables-restore < file_name
Возможно вам понравится: