Hello, printer problems
Iptables block printer connection, but i opened ports, am i wrong?
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i lo -p udp --dport 123 -j ACCEPT
iptables -A INPUT -p udp --sport 123:123 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o lo -p udp --sport 123 -j ACCEPT
iptables -A OUTPUT -p udp --dport 123:123 -m state --state NEW,ESTABLISHED -j ACCEPT

Cups ports:
53 (DNS) TCP/UDP OUT Domain Name System lookups and service registrations.
443 (IPPS) TCP Internet Printing Protocol requests and responses (print jobs, status monitoring, etc.)
631 (IPP/IPPS) TCP IN Internet Printing Protocol requests and responses (print jobs, status monitoring, etc.)
5353 (mDNS) UDP IN+OUT Multicast DNS lookups and service registrations.
Other ports: watch att. file.

Port 53:
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT

Port 443:
iptables -t filter -A INPUT -p tcp -m multiport --sports 80,443,8000,8080 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A OUTPUT -p tcp -m multiport --dports 80,443,8000,8080 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT


Port 631:
iptables -A INPUT -p tcp -s 192.xxx.x.x --dport 631 -j ACCEPT

Port 5353:
iptables -A INPUT -p udp -s 192.xxx.x.x --dport 5353 -j ACCEPT
iptables -A OUTPUT -p udp -s 192.xxx.x.x --dport 5353 -j ACCEPT

Did i have to add /24 after my IP address?
Wher am i wrong?

Attached Thumbnails

 

You didn't post the model number of your printer but I would guess you also need to allow port 9100 TCP. You may need an output rule for port 631 TCP.

You have an allow anything input rule from lo so any other input rule is not necessary. You need an output anything to lo rule also.

Hello Michael, in the CUP i only see 631 (IPP/IPPS) TCP IN Internet Printing Protocol requests and responses (print jobs, status monitoring, etc.) IN
Printer model is HP laserjet m140we.
Let's try opening 9100 TCP.
ADDED:
iptables -A INPUT -p tcp -s 192.XXX.X.X --dport 9100 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.XXX.X.X --dport 9100 -j ACCEPT

STILL not working ;(
lo already ACCEPT anything
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT

Attached Thumbnails

   

[QUOTE=maddy0;6447642]Hello Michael, in the CUP i only see 631 (IPP/IPPS) TCP IN Internet Printing Protocol requests and responses (print jobs, status monitoring, etc.) IN
Printer model is HP laserjet m140we.
Let's try opening 9100 TCP.
ADDED:
iptables -A INPUT -p tcp -s 192.XXX.X.X --dport 9100 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.XXX.X.X --dport 9100 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.1.8 --dport 631 -j ACCEPT

STILL not working ;(

Attached Thumbnails

 

Some older HP printers use 9100. I believe output should be -d not -s.

iptables -A OUTPUT -p tcp -d 192.168.1.8 --dport 631 -j ACCEPT

Thanks, but still not working :/
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp -m multiport --dports 80,443,8000,8080 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT -p tcp -m multiport --sports 80,443,8000,8080 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp -j DROP
ip6tables -A OUTPUT -p udp -j DROP
iptables -A INPUT -p tcp -s 192.168.1.8 --dport 515 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.1.8 --dport 515 -j ACCEPT
iptables -A INPUT -p udp -s 192.168.1.8 --dport 5353 -j ACCEPT
iptables -A OUTPUT -p udp -s 192.168.1.8 --dport 5353 -j ACCEPT
iptables -A INPUT -i lo -p udp --dport 123 -j ACCEPT
iptables -A INPUT -p udp --sport 123:123 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o lo -p udp --sport 123 -j ACCEPT
iptables -A OUTPUT -p udp --dport 123:123 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.8 --dport 9100 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.1.8 --dport 9100 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.1.8 --dport 631 -j ACCEPT
iptables -A OUTPUT -p tcp -d 192.168.1.8 --dport 631 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.8 --dport 631 -j ACCEPT

Attached Thumbnails

 

What happens if we just go with a basic firewall. FYI -t filter is the default if -t option is not specified.

[QUOTE=maddy0;6447644]With there rules + DNS and HTTP/HTTPS, i can surf and print as well. I would like to DROP OUTPUT too, but ok, adding some rules.

Attached Thumbnails

 

Just add the following and see what happens.

iptables -A OUTPUT -j DROP

With that rule i can't print nor surf

That means you are missing something in your output rules or something is not correct.

I wont take your time so long...tell me if ur tired
root@UnVaXXeD:~# iptables -S
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -j DROP

I didn't fully explain what is going on. Go back to the rules you had in post #8.

In addition to the existing output rules adding the drop rule in #10 effectively is the same thing as having the output policy as drop as long it is the last rule in that table. iptables rules are handled sequentially. If printing still works then the existing output rules are sufficient if not then something is missing.

I'm lost
ATM RULES:
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp -m udp --sport 553 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.8 --dport 9100 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.1.8 --dport 9100 -j ACCEPT
iptables -A INPUT -s 192.168.1.8 -p tcp -m tcp --dport 631 -j ACCEPT
iptables -A INPUT -s 192.168.1.8 -p udp -m udp --dport 631 -j ACCEPT
iptables -A OUTPUT -s 192.168.1.8 -p udp -m udp --dport 631 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.1.8 --dport 631 -j ACCEPT
iptables -A INPUT -s 192.168.1.8 -p udp -m udp --dport 5353 -j ACCEPT
iptables -A OUTPUT -s 192.168.1.8 -p udp -m udp --dport 5353 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -A INPUT -p icmp -j REJECT --reject-with icmp-port-unreachable
iptables -A INPUT -p icmp -f -j DROP
iptables -t filter -A INPUT -p tcp --tcp-flags ALL NONE -j LOG --log-prefix "IPTABLES NULL-SCAN:"
iptables -t filter -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -t filter -A INPUT -p tcp --tcp-flags ALL ALL -j LOG --log-prefix "IPTABLES XMAS-SCAN:"
iptables -t filter -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -t filter -A INPUT -p tcp --tcp-flags ALL SYN,FIN -j LOG --log-prefix "IPTABLES SYNFIN-SCAN:"
iptables -t filter -A INPUT -p tcp --tcp-flags ALL SYN,FIN -j DROP
iptables -t filter -A INPUT -p tcp --tcp-flags ALL URG,PSH,FIN -j LOG --log-prefix "IPTABLES NMAP-XMAS-SCAN:"
iptables -t filter -A INPUT -p tcp --tcp-flags ALL URG,PSH,FIN -j DROP
iptables -t filter -A INPUT -p tcp --tcp-flags ALL FIN -j LOG --log-prefix "IPTABLES FIN-SCAN:"
iptables -t filter -A INPUT -p tcp --tcp-flags ALL FIN -j DROP
iptables -t filter -A INPUT -p tcp --tcp-flags ALL URG,PSH,SYN,FIN -j LOG --log-prefix "IPTABLES NMAP-ID:"
iptables -t filter -A INPUT -p tcp --tcp-flags ALL URG,PSH,SYN,FIN -j DROP
iptables -t filter -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "IPTABLES SYN-RST:"
iptables -t filter -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -t filter -N syn-flood
iptables -t filter -A INPUT -i eth0 -p tcp --syn -j syn-flood
iptables -t filter -A syn-flood -m limit --limit 1/sec --limit-burst 4 -j RETURN
iptables -t filter -A syn-flood -j LOG --log-prefix "IPTABLES SYN-FLOOD:"
iptables -t filter -A syn-flood -j DROP
iptables -t filter -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "IPTABLES SYN-FLOOD:"
iptables -t filter -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -j DROP
iptables -t filter -N port-scan
iptables -t filter -A INPUT -i eth0 -p tcp --tcp-flags SYN,ACK,FIN,RST RST -j port-scan
iptables -t filter -A port-scan -m limit --limit 1/s --limit-burst 4 -j RETURN
iptables -t filter -A port-scan -j LOG --log-prefix "IPTABLES PORT-SCAN:"
iptables -t filter -A port-scan -j DROP
iptables -A INPUT -p tcp --dport 22 -j DROP
EVERYTHING work fine, would u suggest ADD or Remove rules?

Attached Thumbnails

 

If you are happy I am Happy. I am sure it could be tweaked a bit.