Example simple iptable ruleset - Revision history

Gordp at 18:35, 30 January 2008

2008-01-30T18:35:14Z

← Older revision		Revision as of 18:35, 30 January 2008
Line 1:		Line 1:
			Big Fat Warning: this is '''not''' a firewall, by an stretch! It is a super-simple set of iptables rules, which will permit all incoming connections, and all outgoing connections. It is useful as a baby-step towards developing a real iptables ruleset; it's also useful when used in conjunction with fail2ban (which will add host-specific blocking rules for you, based on authentication-failures).

	#! /bin/sh		#! /bin/sh
	# /etc/iptables.bak		# /etc/iptables.bak

Gordp at 17:33, 30 January 2008

2008-01-30T17:33:19Z

← Older revision		Revision as of 17:33, 30 January 2008
Line 13:		Line 13:
	$IPTABLES -P FORWARD DROP		$IPTABLES -P FORWARD DROP
	$IPTABLES -P OUTPUT ACCEPT		$IPTABLES -P OUTPUT ACCEPT

	Invoke and make these rules effective:		Invoke and make these rules effective:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''sh /etc/iptables.bak'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''sh /etc/iptables.bak'''

Gordp at 17:30, 30 January 2008

2008-01-30T17:30:47Z

← Older revision		Revision as of 17:30, 30 January 2008
Line 28:		Line 28:
	Chain OUTPUT (policy ACCEPT)		Chain OUTPUT (policy ACCEPT)
	target prot opt source destination		target prot opt source destination

			REMEMBER! If you like the ruleset, and want it to be in-effect the next time you start iptables (ie after a reboot), then you '''must''':
			<font color=red>hostname</font> <font color=blue>~ #</font> '''rc-update add iptables default'''
			<font color=lime>*</font> iptables added to runlevel default

			<font color=red>hostname</font> <font color=blue>~ #</font> '''/etc/init.d/iptables save'''
			<font color=lime>*</font> Saving iptables state ...

Gordp at 17:27, 30 January 2008

2008-01-30T17:27:50Z

← Older revision		Revision as of 17:27, 30 January 2008
Line 9:		Line 9:
	$IPTABLES --delete-chain		$IPTABLES --delete-chain

	# set the defaults so that by-default incoming packets are explicitly allowed;		# set the defaults so that by-default incoming and outgoing packets are explicitly allowed;
	$IPTABLES -P INPUT ACCEPT		$IPTABLES -P INPUT ACCEPT
	$IPTABLES -P FORWARD DROP		$IPTABLES -P FORWARD DROP

Gordp at 17:27, 30 January 2008

2008-01-30T17:27:10Z

← Older revision		Revision as of 17:27, 30 January 2008
Line 13:		Line 13:
	$IPTABLES -P FORWARD DROP		$IPTABLES -P FORWARD DROP
	$IPTABLES -P OUTPUT ACCEPT		$IPTABLES -P OUTPUT ACCEPT
			Invoke and make these rules effective:
			<font color=red>hostname</font> <font color=blue>~ #</font> '''sh /etc/iptables.bak'''

	Resulting active rules:		Resulting active rules:

Gordp at 17:26, 30 January 2008

2008-01-30T17:26:14Z

← Older revision		Revision as of 17:26, 30 January 2008
Line 13:		Line 13:
	$IPTABLES -P FORWARD DROP		$IPTABLES -P FORWARD DROP
	$IPTABLES -P OUTPUT ACCEPT		$IPTABLES -P OUTPUT ACCEPT

			Resulting active rules:

			<font color=red>hostname</font> <font color=blue>~ #</font> '''iptables -L'''

			Chain INPUT (policy ACCEPT)
			target prot opt source destination

			Chain FORWARD (policy DROP)
			target prot opt source destination

			Chain OUTPUT (policy ACCEPT)
			target prot opt source destination

Gordp at 17:23, 30 January 2008

2008-01-30T17:23:05Z

New page

#! /bin/sh
# /etc/iptables.bak

# Let's save typing & confusion with variables
IPTABLES=/sbin/iptables

# Flush active rules and custom tables
$IPTABLES --flush
$IPTABLES --delete-chain

# set the defaults so that by-default incoming packets are explicitly allowed;
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT ACCEPT