LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
Reload this Page Firewall with allowed only defined hosts
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 06-20-2017, 06:20 AM   #1
horizn
Member
 
Registered: Jan 2015
Location: UK and Poland
Distribution: Slackware + Debian + Ubuntu
Posts: 170

Rep: Reputation: Disabled
Firewall with allowed only defined hosts

Hi,
I am trying to build Iptables based firewall to limit allowed outgoing traffic only to specified hostnames. Unfortunately for some reason all outgoing traffic to any hostname is allowed. What is wrong here?

Code:
#!/bin/sh
set -x

iptables -F

# Allow unlimited traffic on the loopback interface                                                                                                                                                                                                                            
iptables -A INPUT -i lo -j ACCEPT                                                                                                                                                                                                                                        
iptables -A OUTPUT -o lo -j ACCEPT                                                                                                                                                                                                                                       
                                                                                                                                                                                                                                                                               
# Set default policies                                                                                                                                                                                                                                                         
iptables --policy INPUT DROP                                                                                                                                                                                                                                             
iptables --policy OUTPUT DROP                                                                                                                                                                                                                                            
iptables --policy FORWARD DROP                        

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing DNS query
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

# Allow incoming
iptables -A INPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 873 -m state --state ESTABLISHED -j ACCEPT

# Allow outgoing
iptables -A OUTPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp -d 0.pool.ntp.org --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT 
iptables -A INPUT -p udp -d 0.pool.ntp.org --sport 123 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp -d 1.pool.ntp.org --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp -d 1.pool.ntp.org --sport 123 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d hostname1 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT 
iptables -A INPUT -p tcp -d hostname1 --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d hostname2 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT 
iptables -A INPUT -p tcp -d hostname2 --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d hostname3 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT 
iptables -A INPUT -p tcp -d hostname3 --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d hostname4 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT 
iptables -A INPUT -p tcp -d hostname4 --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d hostname5 --dport 8883 -m state --state NEW,ESTABLISHED -j ACCEPT 
iptables -A INPUT -p tcp -d hostname5 --sport 8883 -m state --state ESTABLISHED -j ACCEPT

# Drop all other traffic
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP
 
Old 06-20-2017, 08:54 AM   #2
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,659
Blog Entries: 4

Rep: Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941
You can't limit traffic "by hostname" since traffic is only sent to an IP-address. "Host names" are resolved by DNS lookups.
 
Old 06-20-2017, 01:59 PM   #3
lazydog
Senior Member
Contributing Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
You might want to take a look at IPSET and combine that with your firewall.
As an EXAMPLE.

This makes life a lot easier especially when a host name resolves to a number of IP addresses.

Oh, and your rules are very hard to read.

This does the sdame as yours and is easier to read and follow;

Code:
#!/bin/sh
set -x

iptables -F
iptables -X
iptables -Z


# Set default policies
########################

iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP



# Input Rules
###############

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p udp --sport 53 -j ACCEPT

iptables -A INPUT -p tcp --dport 21 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 873 -m state --state NEW -j ACCEPT

iptables -A INPUT -p udp -d 0.pool.ntp.org --dport 123 -j ACCEPT 
iptables -A INPUT -p udp -d 1.pool.ntp.org --sport 123 -j ACCEPT

iptables -A INPUT -j DROP


# Output rules
################

iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

iptables -A OUTPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -d hostname1 --dport 443 -m state --state NEW -j ACCEPT 
iptables -A OUTPUT -p tcp -d hostname2 --dport 443 -m state --state NEW -j ACCEPT 
iptables -A OUTPUT -p tcp -d hostname3 --dport 443 -m state --state NEW -j ACCEPT 
iptables -A OUTPUT -p tcp -d hostname4 --dport 443 -m state --state NEW -j ACCEPT 
iptables -A OUTPUT -p tcp -d hostname5 --dport 443 -m state --state NEW -j ACCEPT 


iptables -A OUTPUT -p udp -d 0.pool.ntp.org --dport 123 -j ACCEPT 
iptables -A OUTPUT -p udp -d 1.pool.ntp.org --dport 123 -j ACCEPT

iptables -A OUTPUT -j DROP
Last edited by lazydog; 06-20-2017 at 02:01 PM.
 
Old 07-08-2017, 08:12 PM   #4
linksanguinario
LQ Newbie
 
Registered: Jul 2017
Posts: 4

Rep: Reputation: Disabled
HI. It's true about domains in iptables. And second, when you ask to a server Web (80 or 443) it doesn't have to answer trough same ports (80 or 443) it's more probably that answer any ramdom port(1024-65xxx)
 
Old 07-09-2017, 12:29 AM   #5
elcore
Senior Member
 
Registered: Sep 2014
Distribution: Slackware
Posts: 1,753

Rep: Reputation: Disabled
What is wrong here is these ACCEPT rules on top apply to all hosts:

Code:
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
For example I'd set one box like this to simply ban everything with few exceptions:
Code:
DNS1=x.x.x.x
HOST1=y.y.y.y
HOST2=z.z.z.z

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -i lo -j ACCEPT 
iptables -A INPUT -i eth0 -p udp -s $DNS1 --sport 53 -m state --state ESTABLISHED,RELATED  -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s $HOST1 --sport 443 -m state --state ESTABLISHED,RELATED  -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s $HOST2 --sport 443 -m state --state ESTABLISHED,RELATED  -j ACCEPT
iptables -A INPUT -j DROP

iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp -d $DNS1 --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -d $HOST1 --dport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -d $HOST2 --dport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j DROP
But if I add your top rules to this filter, it obviously would not work, it would just accept all hosts in specified state.
Code:
DNS1=x.x.x.x
HOST1=y.y.y.y
HOST2=z.z.z.z

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -i lo -j ACCEPT 
iptables -A INPUT -i eth0 -p udp -s $DNS1 --sport 53 -m state --state ESTABLISHED,RELATED  -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s $HOST1 --sport 443 -m state --state ESTABLISHED,RELATED  -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s $HOST2 --sport 443 -m state --state ESTABLISHED,RELATED  -j ACCEPT
iptables -A INPUT -j DROP

iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp -d $DNS1 --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -d $HOST1 --dport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -d $HOST2 --dport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j DROP
 
Old 07-10-2017, 12:05 PM   #6
lazydog
Senior Member
Contributing Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
Quote:
Originally Posted by linksanguinario View Post
HI. It's true about domains in iptables. And second, when you ask to a server Web (80 or 443) it doesn't have to answer trough same ports (80 or 443) it's more probably that answer any ramdom port(1024-65xxx)
This is wrong. The server has to answer on the port that the request came in on, it cannot randomly switch to another port as the client will not accept the response.
 
Old 07-10-2017, 12:10 PM   #7
lazydog
Senior Member
Contributing Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
Quote:
Originally Posted by lazydog View Post
Code:
#!/bin/sh
set -x

iptables -F
iptables -X
iptables -Z


# Set default policies
########################

iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP



# Input Rules
###############

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p udp --sport 53 -j ACCEPT

iptables -A INPUT -p tcp --dport 21 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 873 -m state --state NEW -j ACCEPT

iptables -A INPUT -p udp -d 0.pool.ntp.org --dport 123 -j ACCEPT 
iptables -A INPUT -p udp -d 1.pool.ntp.org --sport 123 -j ACCEPT

iptables -A INPUT -j DROP


# Output rules
################

iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

iptables -A OUTPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -d hostname1 --dport 443 -m state --state NEW -j ACCEPT 
iptables -A OUTPUT -p tcp -d hostname2 --dport 443 -m state --state NEW -j ACCEPT 
iptables -A OUTPUT -p tcp -d hostname3 --dport 443 -m state --state NEW -j ACCEPT 
iptables -A OUTPUT -p tcp -d hostname4 --dport 443 -m state --state NEW -j ACCEPT 
iptables -A OUTPUT -p tcp -d hostname5 --dport 443 -m state --state NEW -j ACCEPT 


iptables -A OUTPUT -p udp -d 0.pool.ntp.org --dport 123 -j ACCEPT 
iptables -A OUTPUT -p udp -d 1.pool.ntp.org --dport 123 -j ACCEPT

iptables -A OUTPUT -j DROP
Seen a mistake, highlighted above in RED, in my original reply that needs to be removed.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Ping behind firewall hosts sachee Linux - Networking 6 09-26-2011 12:23 PM
Changing hostname in /etc/hosts so that it is defined to ip-address and not loopback Azazwa Linux - Newbie 1 03-09-2009 08:48 AM
/etc/hosts.allow can't verify allowed hostname - what do I do? Dragons Master Linux - Security 3 05-05-2006 06:05 AM
Avoid the firewall for outbound traffic on locally-defined virtual IP address? ariebs Linux - Security 4 09-30-2004 02:37 PM
Avoid the firewall for outbound traffic on locally-defined virtual IP address? ariebs Linux - Networking 1 08-19-2004 12:05 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 04:21 AM.

Contact Us - Advertising Info - Rules - Privacy - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration