iptable rules, your opinions

linuxcbon · 08-15-2008, 07:31 AM

Hi,

I have these rules for iptables, anything missing or could be improved ?

iptables -F
iptables -X
iptables -Z
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

Cheers

jomen · 08-15-2008, 07:54 AM

First you flush, then you delete, then you "zero" all the chains - why?
Flushing should be enough IMO.

You are restricting yourself a lot by only allowing ports 53,80 and 443 outgoing. You can only surf that way. No Mail. No ftp. Nothing else.

OUTPUT can be fully open IMO.

iptables -A OUTPUT -j ACCEPT

I'd put the INPUT -i lo -j ACCEPT first instead of last (I have...).

linuxcbon · 08-15-2008, 08:20 AM

Flushing is not enough, it doesn't empty the statistics.
I don't do mail or ftp, that's why I restrict (I use webmail).
Not sure if order of INPUT -i lo is important.
Should I restrict more, like to only eth0 and udp and tcp etc ?

jomen · 08-15-2008, 08:30 AM

Is more than this even possibe?
Out goes only what you allow - In goes only what you initiated.

linuxcbon · 08-15-2008, 08:43 AM

yes more is possible.

win32sux · 08-16-2008, 04:35 PM

You could improve the three web surfing rules by adding matches for packets in state NEW to them. That way, packets in state INVALID don't get sent to ACCEPT (as they do with your current rules). Also, you might wanna think about whether or not you really need that RELATED match in your INPUT chain. If you don't care about the ICMP error codes which need it then you wouldn't miss it at all. I'd also suggest adding IP matches to the DNS rule, to make sure only your preferred DNS servers are used. Just my

, can't think of anything else right now.

Code:

iptables -F
iptables -X
iptables -Z

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A OUTPUT -p UDP --dport 53 -d 208.67.222.222 \
-m state --state NEW -j ACCEPT
iptables -A OUTPUT -p UDP --dport 53 -d 208.67.220.220 \
-m state --state NEW -j ACCEPT

iptables -A OUTPUT -p TCP --dport 80 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p TCP --dport 443 -m state --state NEW -j ACCEPT

jomen · 08-16-2008, 05:04 PM

actually - it was more of a rhetorical question as the setup was already pretty tight.
The state INVALID thing came to my mind but...

linuxcbon · 08-16-2008, 05:54 PM

This one works ok, with eth0 specified

Code:

iptables -F
iptables -X
iptables -Z

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED  -j ACCEPT
iptables -A OUTPUT -o eth0 -m state --state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o eth0 -p udp --dport 53 -d FAVORITE-DNS -m state --state NEW -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW -j ACCEPT