[SOLVED] making a simple iptables firewall for internal server, just looking for tips (and allowing ftp)

psycroptic · 07-15-2013, 02:33 PM

i've got a mail server behind a router with ports 25,465,587 & 993 open externally. i've decided to make a simple firewall that closes off everything, then opens up these ports plus 22 for ssh and ping from the local network.

/etc/iptables/iptables.rules

Code:

*filter
:INPUT DROP [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -s 172.16.0.0/16 -j ACCEPT
-A INPUT -p tcp --dport 22 -j ACCEPT
-A INPUT -p tcp --dport 25 -j ACCEPT
-A INPUT -p tcp --dport 465 -j ACCEPT
-A INPUT -p tcp --dport 587 -j ACCEPT
-A INPUT -p tcp --dport 993 -j ACCEPT
COMMIT

anything else that might be pertinent to add? not sure if FORWARD needs anything added there

mosiac · 07-15-2013, 03:09 PM

I'm not too familiar with iptables but you can group all the ports if you like, but I think it looks cleaner the way you have it.

dkm999 · 07-15-2013, 06:37 PM

If the mail server is the only service running on this machine, you probably have all you need, except possibly a rule to prevent forwarding

Code:

:FORWARD DROP [0:0]

Other common services that you might want to have universally accessible are DNS (UDP port 53), and maybe HTTPD (port 80 and maybe 443 [SSL]).

psycroptic · 07-15-2013, 08:51 PM

good stuff. i've been trying to work out getting active FTP through iptables as the next thing.

dkm999 · 07-15-2013, 09:53 PM

It looks like this is a common problem: you only need to add these rules:

Code:

-A INPUT -p TCP -dport 21 -j ACCEPT
-A INPUT -p TCP -m helper --helper ftp -j ACCEPT

The phrase -m helper --helper ftp takes care of the fact that FTP uses two destination ports (21 & 20), and lets both through your firewall.

psycroptic · 07-15-2013, 10:20 PM

Quote:

Originally Posted by dkm999

It looks like this is a common problem: you only need to add these rules:

Code:

-A INPUT -p TCP -dport 21 -j ACCEPT
-A INPUT -p TCP -m helper --helper ftp -j ACCEPT

The phrase -m helper --helper ftp takes care of the fact that FTP uses two destination ports (21 & 20), and lets both through your firewall.

yeah i added those, i still can't access the FTP server. even worse, Proftpd (the server i'm using) logs a successful login/chdir from my own machine, even though i definitely CANNOT access ftp with iptables running....

dkm999 · 07-15-2013, 10:27 PM

If Proftpd logs the connection and chdir, then the problem is not with the first iptables rule, at least (port 21). Those operations all occur over port 21, the control port. The problem may be elsewhere. Are you getting any packets counted on the second rule (-m helper --helper ftp)? You can see how many packets matched this rule using the command

Code:

iptables -nvL

.

psycroptic · 07-15-2013, 10:31 PM

Actually, I hadn't loaded the "ip_conntrack_ftp" kernel module, which (apparently) is both necessary and not always loaded. Doing that enabled access.

Thanks for the help.