iptables rules for a Linux web server.

hack3rcon · 03-14-2016, 02:03 AM

I understand. My rules my be accept from "nrp.co".
Can you change my iptables that accept below Input and Output :

Code:

Chain INPUT (policy DROP)
ACCEPT     tcp  --  XXXX.nrp.co     anywhere             tcp dpt:domain
ACCEPT     udp  --  XXXX.nrp.co     anywhere             udp dpt:domain
ACCEPT     tcp  --  XXXX.nrp.co     anywhere             tcp spt:domain
ACCEPT     udp  --  XXXX.nrp.co     anywhere             udp spt:domain


Chain OUTPUT (policy DROP)
ACCEPT     tcp  --  anywhere             XXXX.nrp.co     tcp dpt:domain
ACCEPT     udp  --  anywhere             XXXX.nrp.co     udp dpt:domain
ACCEPT     tcp  --  anywhere             XXXX.nrp.co     tcp spt:domain
ACCEPT     udp  --  anywhere             XXXX.nrp.co     udp spt:domain

Chain ALLOWIN (1 references)
target     prot opt source               destination         
ACCEPT     all  --  XXXX.nrp.co     anywhere

My iptables rules are :

Code:

-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

#  Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#  Allows all outbound traffic
#  You can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

# Allows HTTP and HTTPS connections from anywhere (the normal ports for websites)
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
-A INPUT -p tcp --dport 25 -j ACCEPT
-A INPUT -p tcp --dport 21 -j ACCEPT
-A INPUT -p tcp --dport 110 -j ACCEPT
-A INPUT -p tcp --dport 143 -j ACCEPT
-A INPUT -p tcp --dport 465 -j ACCEPT
-A INPUT -p tcp --dport 587 -j ACCEPT
-A INPUT -p tcp --dport 993 -j ACCEPT
-A INPUT -p tcp --dport 995 -j ACCEPT
-A INPUT -p tcp --dport 995 -j ACCEPT

#  Allows SSH connections (only 4 attempts by an IP every 3 minutes, drop the rest)
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 180 --hitcount 4 --name DEFAULT --rsource -j DROP
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

# log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT

Please tell me how can I add Part 1 to my iptables rules.

Tnx.

lazydog · 03-14-2016, 11:20 AM

Quote:

Originally Posted by hack3rcon

When I did "systemctl stop firewalld && systemctl start iptables && systemctl start ip6tables" my website take down

and I must enable "firewalld". What is your idea?

Those commands should have switched you from firewalld to iptables. once that is done you can apply the rules and that should get your web site up and running again.

hack3rcon · 03-15-2016, 01:05 AM

Thank you so much.