HOWTO Setup iptables
Kernel Configuration
NOTE This configuration is for basic firewalling only; we don't do NAT/packet-forwarding... so, if you're reading this, and wish to use NAT/forwarding, you will be missing a few key configuration items :-O
* NOTE As of kernel 2.6.22 you must enable the following:
Networking ---->
Networking options ---->
Network packet filtering framework (Netfilter)--->
Core Netfilter Configuration ---->
["enable"] Netfilter connection tracking support--->Layer 3 Independent Connection tracking
["enable"] Netfilter Xtables support (required for ip_tables)
["enable"] "NFLOG" target support
["enable"] "conntrack" connection tracking match support
["enable"] "state" match support
IP: Netfilter Configuration --->
["enable"] IPv4 connection tracking support (required for NAT) required by "Layer 3 Independent Connection tracking" above (caused many headaches)
["enable"] IP tables support (required for filtering/masq/NAT)
["enable"] Packet Filtering
["enable"] REJECT target support
["enable"] Packet mangling
Iptables Installation
emerge iptables rc-update add iptables default
Scripting the Rules
Once iptables is up-and-running, simply execute the script below, to implement the policies:
sh /etc/iptables.bak
Example 1 - /etc/iptables.bak for a web-server with vsftpd upload, also SSH connectivity, and being monitored by nagios:
#! /bin/sh # /etc/iptables.bak # Let's save typing & confusion with variables IPTABLES=/sbin/iptables # Flush active rules and custom tables $IPTABLES --flush $IPTABLES --delete-chain # set the defaults so that by-default incoming packets are dropped, unless explicitly allowed; # for a desktop workstation, we'll let lots of (unpredictable) outgoing packets go freely. $IPTABLES -P INPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -P OUTPUT ACCEPT # INBOUND POLICY # ============== # of course, accepting loopback is a good idea $IPTABLES -A INPUT -i lo -j ACCEPT # (Applies to packets entering our network interface from the network, # and addressed to this host.) $IPTABLES -A INPUT -m state --state INVALID -j DROP $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT # ftp incoming $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 20 -j ACCEPT $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 21 -j ACCEPT # ssh incoming, including non-standard port (if needed) $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT #$IPTABLES -A INPUT -p tcp -m state --state NEW --dport 222 -j ACCEPT # web serving, let's allow it! $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 80 -j ACCEPT # nagios (5666); monitor time (123), allow snmp (161) $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 5666 -j ACCEPT $IPTABLES -A INPUT -p udp -m state --state NEW --dport 123 -j ACCEPT $IPTABLES -A INPUT -p udp -m state --state NEW --dport 161 -j ACCEPT # OUTBOUND POLICY # =============== # of course, accepting loopback is a good idea $IPTABLES -A OUTPUT -o lo -j ACCEPT # (Applies to packets sent to the network interface from local processes) $IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
Example 2 - /etc/iptables.bak for a web-server with both http and https, including an nfs-mounted directory (this machine client-only). Also, our amanda-tape-server reaches out to back up this example, and we have SSH connectivity. To complicate matters, we run a Sassafrass keyserver, and a flexlm license-server. Again, monitoring by nagios:
#! /bin/sh # /etc/iptables.bak # Let's save typing & confusion with variables IPTABLES=/sbin/iptables # Flush active rules and custom tables $IPTABLES --flush $IPTABLES --delete-chain # set the defaults so that by-default incoming packets are dropped, unless explicitly allowed; # for a desktop workstation, we'll let lots of (unpredictable) outgoing packets go freely. $IPTABLES -P INPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -P OUTPUT ACCEPT # INBOUND POLICY # ============== # of course, accepting loopback is a good idea $IPTABLES -A INPUT -i lo -j ACCEPT # (Applies to packets entering our network interface from the network, # and addressed to this host.) $IPTABLES -A INPUT -m state --state INVALID -j DROP $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT # ftp incoming #$IPTABLES -A INPUT -p tcp -m state --state NEW --dport 20 -j ACCEPT #$IPTABLES -A INPUT -p tcp -m state --state NEW --dport 21 -j ACCEPT # ssh incoming, including non-standard port (if needed) $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT #$IPTABLES -A INPUT -p tcp -m state --state NEW --dport 222 -j ACCEPT # this machine is a mail-server, aggregating logs + hosting mailing-lists $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 25 -j ACCEPT # web serving, let's allow it! Both http and https ports $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 80 -j ACCEPT $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 443 -j ACCEPT # portmapper, in support of NFS-client $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 111 -j ACCEPT # nagios (5666); monitor time (123), allow snmp (161) $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 5666 -j ACCEPT $IPTABLES -A INPUT -p udp -m state --state NEW --dport 123 -j ACCEPT $IPTABLES -A INPUT -p udp -m state --state NEW --dport 161 -j ACCEPT # amanda tape-backups; we reach out and tape things from this machine $IPTABLES -A INPUT -p udp -m state --state NEW --dport 10080 -j ACCEPT $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 10082 -j ACCEPT $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 10083 -j ACCEPT # flexlm (lmgrd) license-server listens here (set in license.dat file) $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 7111 -j ACCEPT # Sassafrass keyserver listens here on both udp and tcp $IPTABLES -A INPUT -p tcp -m state --state NEW --dport 19283 -j ACCEPT $IPTABLES -A INPUT -p udp -m state --state NEW --dport 19283 -j ACCEPT # OUTBOUND POLICY # =============== # of course, accepting loopback is a good idea $IPTABLES -A OUTPUT -o lo -j ACCEPT # (Applies to packets sent to the network interface from local processes) $IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
Save the configuration:
etc/init.d/iptables save
And then back up your working configuration in case you break something later you can quickly revert:
cp /var/lib/iptables/rules-save /var/lib/iptables/rules.working
Viewing/checking the active ruleset:
iptables -L