Before the actual configuration, I insist on giving you a few tips I've learned the hard way so you don't have to. You must keep in mind that the order in which you add rules is everything. For example, if you make the mistake of adding the first rule to deny everything, then, no matter what you set to allow after, it will still be denied.
The second thing you must keep in mind is that the rulesets are in memory and are not saved on disk automatically, so if you reboot your computer without first running the INIT script (or iptables-save) to save them, everything you've worked for will be gone.
Another important thing that applies if you work on your server from a remote PC, through ssh: it's important not to block yourself out so make this your first rule:
# iptables -A INPUT -s 213.10.10.13 -d 192.168.1.1 -p TCP -dport 22 -j ACCEPT
Explanation:
-A: appends the rule to the INPUT chain;
-s: source IP, in this case, the IP you are ssh'ing from;
-d: destination IP, in this case, the server IP;
-p: communication protocol;
--dport: destination port, in our case it's the SSHd port;
-j: stands for 'Jump'. If everything matches, the packet is accepted.
Next, let's set some basic rules for general traffic. One of iptables' features is the ability to determine the state a packet is in. This is the packets' state on a new connection:
NEW: 1st server sends 2nd a SYN packet that it wants to create a new connection.
RELATED: 2nd server receives the SYN packet and sends to 1st server a SYN-ACK packet which tells that everything is alright.
ESTABLISHED: 1st server receives the SYN-ACK packet and sends 2nd server an ACK packet which is the final acknowledgment, the connection finishes establishing and the traffic start between the two servers.
In order for your server to be able to establish TCP connections with other servers, iptables must be configured with the following rules:
# iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -A OUTPUT -m state --state RELATED,ESTABLISHED
Custom rules
To block IPs:
# iptables -A INPUT -s 213.10.10.13 -j DROP
This rule blocks any incoming traffic from 192.168.1.13.
# iptables -A INPUT -d 192.168.1.15 -j REJECT
This rule blocks any incoming traffic for LAN computer with IP 192.168.1.15 (behind your server).
To allow IPs:
# iptables -A INPUT -s 213.10.10.13 -d 192.168.1.4 -p tcp --dport 21
This rule accepts incoming traffic from source IP to destination IP which is a FTP server.
After you've configured all the rules for every port on your local or network service you want to allow (or block) traffic to or from, it's time to block the rest:
# iptables -A INPUT -j REJECT
# iptables -A FORWARD -j REJECT
These block rules MUST be added last.
To delete a rule, simply write it again but replace the '-A' before the chain with '-D' (Delete).
Saving rulesets
To save your iptables configuration, simply execute the command:
# /etc/init.d/iptables save
To stop iptables and flush all rules: (careful, use the save INIT script before stopping iptables and flushing rules)
# /etc/init.d/iptables stop
To start the iptables again and loading the rulesets from /etc/sysconfig/iptables:
# /etc/init.d/iptables start
|
