I am just starting on IPTables and already running into issues


I have this



But this allows for example other IP addresses to connect via PORT 22 to the machine, which I thought I BLOCK via Rule Number 3, but my guess is that either RULE 6 or Rule 7 cancels this. Correct??

And If I remove RULES 6 and 7 then I even can't connect to the machine via SSH can't even PING IT!

Clarification, .100 is my PC, .155 is my NAS, my local subnet is 10.0.0.0/24

TiA

Edit: PS No other Rules exists (done a iptables -F and everything else INPUT/OUTPUT/FORWARD is set to accept before starting)

Why do you need firewall rules in LAN? What are you trying to achieve?

Thx,

just trying to understand IPtables.

If it already goes wrong with these basic rules, then wonder what is going to happen with OUTSIDE rules!

1. When using -P OUTPUT DROP one must specify where OUTPUT is accepted. (remove rule 7 and output's all dropped)
2. When not using -P INPUT DROP then input is accepted and one must only specify which input is dropped.

So, your INPUT ACCEPT rules do nothing if -P INPUT (policy) is set to ACCEPT.
And your -P OUTPUT (policy) DROP will drop output of -p (protocol) icmp unless you specify the ACCEPT rule for icmp.

There's plenty of other stuff wrong with, but I hope this helps a bit.

1 members found this post helpful.

IPTables has been replaced by NFTables, so if you are just starting with packet filtering, you might skip IPTables.

https://wiki.nftables.org/wiki-nftab..._in_10_minutes

https://wiki.nftables.org/

1 members found this post helpful.

Haven't you been working with iptables for three years now?

https://www.linuxquestions.org/quest...on-4175665271/

1 members found this post helpful.

In addition, basically rules operate in order. -A appends the rule to the end of the chain so it depends on how they were added. Are you using a shell script or just typing them in on the command line? If using a script post its exact contents using code tags. To see the order run the command

iptables -L --line-numbers

To block ssh for incoming connections I would use:
iptables -A INPUT -i [interface name] -p tcp --dport 22 -j DROP

You also need to understand how basic server communications work. Basically the client talks to the server on one port, for ssh it is 22 by default and the server responds on another port. These ports are called ephemeral ports and it depends on the operating system but linux typically uses 32768–60999. This is why you need rule 6.

As posted with an output policy of drop nothing gets out without a specific rule. Much easier to learn if you reverse and use a policy of accept for output and drop for input.

You should also add input, output rules for lo.

1 members found this post helpful.

I simply use shorewall to do the heavy lifting for me. I specify what I want using fairly-simple configuration files, and it spits out and applies the right set of rules. Perfect.

1 members found this post helpful.

As michaelk points out, it is more useful and less error prone to view the rules as they actually exist in your kernel rather than as the commands used to insert them. To repeat how to do that:

Nftables is intended to replace iptables, but there is no urgency to change if you have some iptables knowledge. (I have found nftables a bit more difficult to work with than iptables, which may be due in part to my own old habits, but simply changing from one to the other does not instantly solve most problems.)

You have posted a set of rules then stated that they do not work, but have not clearly stated how you want them to work. You will find it a useful exercise to yourself, and in communicating your problems to others, to write out in simple human language how you want your rule set to work. For example:

You would then have a "specification" to implement with your rules and to communicate to others, and to test your results against. Then when you need to add some new traffic, start by adding it to the spec!

2 members found this post helpful.

hahahaha. Not really only been playing with it but as you can see I still don't understand it!

Thx Guys,

as always you gave me a lot to think about it.

I really like that suggestion by @Astrogeek to write down the "specification" first!!

Really appreciated. I hope one day I can help someone the same as you guys do!