Block all the ports excpet 80 on iptables (eth2)

webboy105 · 02-04-2010, 11:13 AM

I'm new to iptables and I would like to block all the ports on eth2 except port 80.

how can I do that?

If I Set the default policy of the INPUT chain to DROP, this will apply on all network cards. am I right?

iptables -P INPUT DROP

# Accept incomming TCP connections from eth2 on port 80

/sbin/iptables -A INPUT -i eth2 -p tcp --dport 80 -j ACCEPT

much appreciate your help!!

HasC · 02-04-2010, 11:22 AM

An advice:

Instead of -A, use -I. Just in case your distro already has a firewall configured, -I will insert your rule on top of their rules. Good for experimenting :-)

And, insert another 2 rules for chain OUTPUT. You're allowing packets to enter (INPUT), and you should let packets to go out too (OUTPUT)

Code:

iptables -P OUTPUT DROP
iptables -I OUTPUT -o eth2 -p tcp --sport 80 -j ACCEPT

webboy105 · 02-04-2010, 11:27 AM

Quote:

Originally Posted by HasC

An advice:

Instead of -A, use -I. Just in case your distro already has a firewall configured, -I will insert your rule on top of their rules. Good for experimenting :-)

And, insert another 2 rules for chain OUTPUT. You're allowing packets to enter (INPUT), and you should let packets to go out too (OUTPUT)

Code:

iptables -P OUTPUT DROP
iptables -I OUTPUT -o eth2 -p tcp --sport 80 -j ACCEPT

If I understand correctly, It will look like

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -I OUTPUT -o eth2 -p tcp --sport 80 -j ACCEPT

This will not impact other nic cards (like eth0 and eth1).

Hangdog42 · 02-04-2010, 11:33 AM

Quote:

Originally Posted by webboy105

If I understand correctly, It will look like

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -I OUTPUT -o eth2 -p tcp --sport 80 -j ACCEPT

This will not impact other nic cards (like eth0 and eth1).

That firewall will only allow outgoing traffic originating from port 80 on eth2. Everything incoming for eth2, and absolutely everything on all other cards will be dropped, both incoming and outgoing. Is that really what you want?

If you would explain a bit more about the different cards and what you're trying to accomplish, we probably could point you in a better direction.

HasC · 02-04-2010, 11:38 AM

You forgot to add the rule you're created first. That one should be included too

webboy105 · 02-04-2010, 11:49 AM

Quote:

Originally Posted by HasC

You forgot to add the rule you're created first. That one should be included too

thanks for your quick response. I'm still not clear on default oplicy rule.

default oplicy rule will not ipmact eth0 and eth1? am I right?

OK... so the default oplicy rule will not ipmact eth0 and eth1?
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -A INPUT -i eth2 -p tcp --dport 80 -j ACCEPT
iptables -I OUTPUT -o eth2 -p tcp --sport 80 -j ACCEPT

All the NIC cards (eth0, eth1 and eth2) are on different subnets.

Hangdog42 · 02-04-2010, 12:01 PM

Quote:

default oplicy rule will not ipmact eth0 and eth1? am I right?

No, the default policy will affect ALL interfaces. You'll need to add additional rules to cover eth0 and eth1. Those can be pretty broad, like just accepting all traffic on the interface:

Code:

iptables -A INPUT -i eth0 -j ACCEPT
iptables -A OUTPUT -o eth0 -j ACCEPT

Now this bugs me:

Quote:

iptables -I OUTPUT -o eth2 -p tcp --sport 80 -j ACCEPT

This rule means that the only traffic that gets out of eth2 MUST be coming from port 80. Unless you've taken some steps to limit whatever is sending packets to port 80, then you're going to have trouble. For example, if you are trying to limit eth2 to web traffic, you would need to modify this rule somewhat:

iptables -I OUTPUT -o eth2 -p tcp --dport 80 -j ACCEPT

This would allow a browser to send from any port but the only stuff that would get through would be packets destined for port 80 on the other end, which is where most web servers listen.

Again, if you could give us some background on what you're trying to accomplish, we might be able to give better advice.

webboy105 · 02-04-2010, 12:05 PM

Quote:

Originally Posted by Hangdog42

No, the default policy will affect ALL interfaces. You'll need to add additional rules to cover eth0 and eth1. Those can be pretty broad, like just accepting all traffic on the interface:

Code:

iptables -A INPUT -i eth0 -j ACCEPT
iptables -A OUTPUT -o eth0 -j ACCEPT

Now this bugs me:

This rule means that the only traffic that gets out of eth2 MUST be coming from port 80. Unless you've taken some steps to limit whatever is sending packets to port 80, then you're going to have trouble. For example, if you are trying to limit eth2 to web traffic, you would need to modify this rule somewhat:

iptables -I OUTPUT -o eth2 -p tcp --dport 80 -j ACCEPT

This would allow a browser to send from any port but the only stuff that would get through would be packets destined for port 80 on the other end, which is where most web servers listen.

Again, if you could give us some background on what you're trying to accomplish, we might be able to give better advice.

Thank you very much for your response.

I'm trying to accomplish to allow internet users to access web site over port 80 on eth2. They shouldn't have access to any other port on eth2.

nimnull22 · 02-04-2010, 12:07 PM

Default policy will work if nothing else do its choice.

But the question is - do you want to filter INCOMING packets to firewall, or OUTGOING?

Hangdog42 · 02-04-2010, 12:33 PM

Quote:

I'm trying to accomplish to allow internet users to access web site over port 80 on eth2. They shouldn't have access to any other port on eth2.

Sorry, I'm still a little confused about your network. Is eth2 on the web server or will it be handling outgoing traffic from the users web browsers?

webboy105 · 02-04-2010, 01:08 PM

Quote:

Originally Posted by Hangdog42

Sorry, I'm still a little confused about your network. Is eth2 on the web server or will it be handling outgoing traffic from the users web browsers?

eth2 is my web server.

Hangdog42 · 02-04-2010, 03:17 PM

OK, web servers usually listen on port 80, but they may return information on other ports. So your default policy is good, you only want traffic to come in on port 80, but you want it to be able to leave on any port. So introducing states on the outbound chain might be useful:

Code:

iptables -P INPUT DROP
iptables -P OUTPUT DROP

iptables -A INPUT -i eth0 -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A INPUT -i eth2 -p tcp --dport 80 -j ACCEPT

iptables -A OUTPUT -o eth0 -j ACCEPT
iptables -A OUTPUT -o eth1 -j ACCEPT
iptables -A OUTPUT -o eth2 -m state --state ESTABLISHED,RELATED -j ACCEPT

So the eth0 and eth1 lines should allow all traffic in and out on those two interfaces. The INPUT line for eth2 should only allow traffic heading for port 80, where hopefully your web server is listening. The OUTPUT line for eth2 allows any packets that have the ESTABLISHED or RELATED states, which basically means they have to be in response to an established connection. Since only port 80 accepts incoming connections, that should mean that it will be the only thing generating ESTABLISHED or RELATED packets.