iptables

nakkaya · 01-18-2003, 05:01 PM

i checked the how to but i am just trying to close all ports and open just port 80 for www can any one tell me the command to do that with iptables?

Ztyx · 01-18-2003, 06:16 PM

Code:

iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT

This should probably work...

nakkaya · 01-18-2003, 11:55 PM

when i did that it blocked all the ports

Ztyx · 01-19-2003, 04:02 AM

Code:

iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT ! -p tcp -j DROP
iptables -A OUTPUT -p tcp --syn -j DROP

But as you probably can understand both of these rulesets only allows your webserver to communicate to the net. You will not be able to surf on the box aswell or do anything else...

nakkaya · 01-19-2003, 06:49 AM

sorry for misunderstanding i just want the browser to work that s why i said port 80 becouse http port is 80 but i need surf

ddpicard · 01-19-2003, 08:57 AM

You can always try firestarter or shorewall. I have shorewall running on my slackware 8.1 and it works great. Just follow the instructions and it will walk you through the setup. Here is the link:

http://shorewall.sourceforge.net/

dave

Ztyx · 01-19-2003, 09:22 AM

Hmm, you have to be even more specific;
- Block ALL incoming connections to your computer? Yes, that's what you want isn't it?
- ONLY allow websurfing on the computer? Are these firewall rules intended to block the use of the computer for anything else than surfing the web?
- Should FTP be turned on as some services on the web require it?

nakkaya · 01-19-2003, 09:29 AM

i want to block all ports except dhcp web ftp icq thats what i wanna do with ip tables

Ztyx · 01-19-2003, 04:05 PM

Ah; then do:

Code:

iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -A INPUT -p tcp  --syn -j DROP

This is a very basic firewall although it should deny most of the incoming connections. Every firewall is configured differently depending on what you run on your system so I suggest you read the HOWTO as it is very good to know how to create one that fits your purpose.

Sheers.

Grim Reaper · 01-24-2003, 06:43 AM

what Ztyx said, but where is this NAT table your talking about? AFAIK, IPTables doesn't have a NAT table by default...all it has is INPUT, OUTPUT and FORWARD...

to simplify things he could just:

iptables -F
iptables -A INPUT -p tcp --syn -j DROP

That's all i think he'd need...