setting iptables

bijuhpd · 03-16-2005, 06:50 AM

hi guys,
i am in need of help from you guys to set a rule in iptables
i want to set iptables in two machines to accept the packets from the server only and not from anyother machines
i am in doubt to use the ACCEPT , DROP rules.

thanks in advance

win32sux · 03-16-2005, 08:08 AM

Quote:

Originally posted by bijuhpd
i want to set iptables in two machines to accept the packets from the server only and not from anyother machines

are the clients and the server on the same LAN? if so, you could filter using the mac and ip address of the server, but what kind of input are you looking to allow from the server???

let's say the server is 192.168.0.1 with mac address xx:yy:zz:xx:yy:zz...

Code:

/sbin/modprobe ipt_mac

iptables -P INPUT DROP
iptables -A INPUT -s 192.168.0.1 -m mac --mac-source xx:yy:zz:xx:yy:zz -j ACCEPT

this would do what you are asking (accept ALL input coming from the server), but that isn't really a good thing, as the purpose of a firewall is to allow only needed traffic...

also, why does the server need to connect to the clients?? it's usually the other way around...

=/

win32sux · 03-16-2005, 08:14 AM

IMHO, it would make more sense to limit outgoing traffic on the clients so that they can only establish connectons with the server, and block all incoming connections:

Code:

iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -P OUTPUT DROP
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT -d 192.168.0.1 -m state --state NEW -j ACCEPT

running these rules on the clients would make them able to only connect with the server, and even if the server would get OWNED or infected with a worm, it wouldn't be able to attack the clients...

;-)

bijuhpd · 03-16-2005, 11:28 PM

hi guys,
thanks a lot
how can i make A's IP address trusted so that it has access to B/C but no one else does. will the above rule enough.( i am having a remote object in B/C.only the program in A need to access B/C and restict all others as all ports will be open)

thanks in advance

win32sux · 03-17-2005, 12:24 PM

if A is the server, then using the above rules on B and C would work:

Code:

/sbin/modprobe ipt_mac

iptables -P INPUT DROP
iptables -A INPUT -s 192.168.0.1 -m mac --mac-source xx:yy:zz:xx:yy:zz -j ACCEPT

this would allow all input coming from A (192.168.0.1)... keep in mind this is really insecure...