IPtables formatting

Ghillie-Up · 08-11-2014, 09:26 PM

So I have a set of firewall rules ready for a plesk instance on a CentOS6 box.

Can someone explain to me where the various syntax should be placed within a IPtables config. for example like Cisco are Rules read top to bottom with a deny all usually at the end?

Here is my current list -

Code:

-A INPUT -j DROP
-A FORWARD -j DROP
-A OUTPUT -j ACCEPT

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state --state INVALID -j DROP

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP

-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state INVALID -j DROP


-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A FORWARD -i lo -o lo -j ACCEPT


#Syn for all new TCP connections
-A INPUT -p tcp ! --syn -m state --state NEW -s 0.0.0.0/0 -j DROP

#Slowloris prevention attempt
iptables -A INPUT -p tcp –syn –dport 80 -m connlimit –connlimit-above 100 -j DROP


#SSH (Changed port via sshd_config)
-A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT

#Plesk-http
-A INPUT -p tcp -m tcp --dport 8880 -j ACCEPT

#Plesk-Secure
-A INPUT -p tcp -m tcp --dport 8443 -j ACCEPT

#Web server
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

#Web server secure
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

#Plesk Auto-installer
-A INPUT -p tcp -m tcp --dport 8447 -j ACCEPT

#FTP
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT

#FTP (data)
-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT

#SMTP
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT

#SMTP-Secure
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT

#POP
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT

#POP-Secure
-A INPUT -p tcp -m tcp --dport 995 -j ACCEPT

#IMAP
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT

#IMAP-Secure
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT

#DNS
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT

#106 poppassd (Localhost only)
-A INPUT -p tcp -m tcp --dport 106 -j ACCEPT

#MySQL
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT

#Mail message Submission
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT

#PING
-A INPUT -p icmp -m icmp --icmp-type 8/0 -j ACCEPT

Is there a better way to order such rules? I'm more concerned about the first part before the specific ports really.

Thanks.

unSpawn · 08-12-2014, 05:07 PM

Quote:

Originally Posted by Ghillie-Up

So I have a set of firewall rules ready for a plesk instance on a CentOS6 box.

If you can please avoid using web-based management panels. If you do use one then please realize being able to click yes/no buttons does not an admin make. Know the weaknesses of your system, its software and how to avoid or mitigate those.

Quote:

Originally Posted by Ghillie-Up

Can someone explain to me where the various syntax should be placed within a IPtables config. for example like Cisco are Rules read top to bottom with a deny all usually at the end?

It may require a bit of reading but there is no iptables tutorial more comprehensive than https://www.frozentux.net/documents/iptables-tutorial/, period. Indeed iptables rules when loaded are parsed first-to-last. (For example 'iptables -t filter -nL --line-numbers' will show the order.)

Quote:

Originally Posted by Ghillie-Up

Here is my current list

Couple of things in random order:
- If this is a regular web server then you should not forward traffic so a "-P FORWARD DROP" policy should be enough.
- You already use "--state ESTABLISHED" so also use "-m state --state NEW" to denote new connections.
- Avoid exposing certain ports like MySQL until you need to. When you do, try to limit them to IP addresses or subnets.
- Don't expose Plesk to world and limit it to your management IP (range), period. (Even better would be to use SSH with pubkey auth and tunnel for access.)
- Avoid exposing non-SSL ports like FTP, POP3, IMAP, etc, etc.
- I usually have loopback as the first device (and its allowed always) to get it out of the way. That way you know all other rules apply to all other Ethernet devices unless specified different.
- While having "--state INVALID" in the OUTPUT chain is laudable I'd rather you filter out bogon networks and ports you don't want to see traffic to like IRC, Bittorrent, etc, etc.
- Setting "-m connlimit" on TCP/80 is nice but you forgot TCP/443 and any other services users can access. Note the lower in the stack you can limit potential abuse the less chance it has of "hurting" application layer services.
- Note you can specify multiple ports in one line using "-m multiport --dports 20,21,22" etc, etc. (Yes, you also can combine multiple modules like "-m connlimit something -m multiport something".)

If you've read the frozentux tutorial and dig what I've said re-post your modified rule set.

Ghillie-Up · 08-12-2014, 06:06 PM

Thankyou for the comprehensive reply.

I appreciate the control panel advise, however it's handy to have everything under one (web accessible) roof especially as this is only running about 5 personal domains. I definitely need to read up on IPtables without question so will read through the link you supplied when I can.

Can you please elaborate on the first point you mentioned? I understand and have amended my rules to the rest of your advise but am having problems getting the following -

"- If this is a regular web server then you should not forward traffic so a "-P FORWARD DROP" policy should be enough."

Should I remove the following completely -
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -i lo -o lo -j ACCEPT

Can you give me an example with my config what you mean?

Thanks again!

unSpawn · 08-14-2014, 01:03 AM

Quote:

Originally Posted by Ghillie-Up

Should I remove the following completely -
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -i lo -o lo -j ACCEPT

Yes.

Quote:

Originally Posted by Ghillie-Up

Can you give me an example with my config what you mean?

I could but that wouldn't allow you to learn anything. So let's do this the other way around: you post your revised rule set based on what I suggested and then I'll correct it. Deal?

Stvrosky · 08-14-2014, 01:37 PM

Edit the /etc/sysconfig/iptables and put your rules there according "man iptables", then restart the service iptables with "service iptables restart" or install a wizard with "yum install system-config-firewall-tui" then execute "system-config-firewall-tui" and put your rules.

NOTE:

If you use the "system-config-firewall-tui" the rules in "/etc/sysconfig/iptables" will be rewrite so make a backup first.