What's wrong with my iptables script?

veritas · 06-02-2004, 08:15 PM

Here's the basic overview of what I want out of my firewall:

1) allow local loopback and allow it to be pinged
2) drop every other ping packet from outside my computer
3) allow apache access
4) drop everything else

And here is what i pieced together with a few LQ searches:

Code:

iptables -F

#drop everything
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

#allow http
iptables -A INPUT -p tcp -s 0/0 --dport 80:81 -j ACCEPT

# Allow the loopback interface to be used by local machine

iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A OUTPUT -o lo -p all -j ACCEPT

# Allow established connections

iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --tcp-option ! 2 -j REJECT --reject-with tcp-reset

With this configuration i can ping localhost/127.0.0.1 but I can also ping my actual IP address, which I don't want. What can I change to make it match my criteria?

Thanks,
Wes

Mathieu · 06-02-2004, 09:06 PM

From where are you ping-ing ?

If you are doing it from your computer (the PC with the above mentioned rules), you will be able to ping your IP.
Why: Because OUTPUT is set to ACCEPT.
In this case, packets (ping) are coming from lo and leaving by OUTPUT.

However, if you ping from another PC, your PC will drop all ping packets.

Plus, since your OUTPUT is set to ACCEPT, the following line is not needed

Code:

iptables -A OUTPUT -o lo -p all -j ACCEPT

veritas · 06-05-2004, 09:55 PM

Hey, thanks for the reply and sorry for my late followup. Anyways, I took out the

Code:

iptables -A OUTPUT -o lo -p all -j ACCEPT

line just like you said, since it was not needed.

I guess it really doesn't matter if I can ping my IP address locally, because my friend can't ping it from his computer, so that's good. (I originally thought my last iptables configuration had it set to where I couldn't ping my IP locally, but apparently not)

Thanks,
Wes

tuxq · 06-06-2004, 11:39 AM

I only have on suggestion...
http://www.lowth.com/LinWiz/1.09/Ser...fw.pl/iptables
Very nice ... =)