Help with iptables rules

rejeep · 04-04-2007, 03:25 AM

Hi!

I need some help with my iptables rules.
I want to reject all incomming and forwarding traffic and allow all outgoing traffic.
I want to drop some ports and I want to allow SSH.

The problem is that I can't log in through SSH with there rules.

Code:

#!/bin/bash

IPTABLES = /sbin/iptables

# Clear and flush tables.
$IPTABLES -F
$IPTABLES -Z

# Reject all incomming and forwarding traffic. Accept all outgoing traffic.
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -A INPUT -j REJECT
$IPTABLES -A FORWARD -j REJECT

# Drop traffic on ports: 135, 137, 138, 139 and 445
$IPTABLES -A INPUT -p tcp --destination-port 135 -j DROP
$IPTABLES -A INPUT -p tcp --destination-port 137:139 -j DROP
$IPTABLES -A INPUT -p tcp --destination-port 445 -j DROP

# Accept SSH.
$IPTABLES -A INPUT -p tcp --destination-port 22 -j ACCEPT

I would also like to know which kernel options I need to have to be able to use this.

Code:

$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Thanks!

acid_kewpie · 04-04-2007, 03:32 AM

well you're alreeady rejecting the traffic in the rule above, yeah? move it higher and it'll take presedence ans it 'll be matched first.

rejeep · 04-04-2007, 03:38 AM

Quote:

Originally Posted by acid_kewpie

well you're alreeady rejecting the traffic in the rule above, yeah? move it higher and it'll take presedence ans it 'll be matched first.

Ohhh... I have got this all wrong.

I thought that the onces below had presedence over the above.

Thanks for clearing that out for me...

So... I quess this work better then!

Code:

#!/bin/bash

IPTABLES=/sbin/iptables

# Clear and flush tables.
$IPTABLES -F
$IPTABLES -Z

# Accept all outgoing traffic.
$IPTABLES -P OUTPUT ACCEPT

# Drop traffic on ports: 135, 137, 138, 139 and 445
$IPTABLES -A INPUT -p tcp --destination-port 135 -j DROP
$IPTABLES -A INPUT -p tcp --destination-port 137:139 -j DROP
$IPTABLES -A INPUT -p tcp --destination-port 445 -j DROP

# Accept SSH.
$IPTABLES -A INPUT -p tcp --destination-port 22 -j ACCEPT

# Reject all incomming and forwarding traffic.
$IPTABLES -A INPUT -j REJECT
$IPTABLES -A FORWARD -j REJECT

rejeep · 04-04-2007, 05:15 AM

It is now fixed! Thanks!