iptables help

cashton2k · 12-06-2005, 02:58 PM

i know this may be a stupid question but i need to be absolutley sure.

i log in to my firewall using ssh if i use the following commands will i block myself out?

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

cheers for any help

imitheos · 12-06-2005, 03:20 PM

Quote:

Originally Posted by cashton2k

i know this may be a stupid question but i need to be absolutley sure.

i log in to my firewall using ssh if i use the following commands will i block myself out?

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

cheers for any help

"-P" option sets the default policy.
So, these 3 commands set the default policy for INPUT,OUTPUT,FORWARD chains to DROP.
In other words, nothing will work.(Yes, you will block yourself out)
You need to put other rules too.

have you read the iptables manpage ? It explains a lot of things.
Also visit http://iptables-tutorial.frozentux.net

dimsh · 12-06-2005, 03:22 PM

in general, the first and second rule in iptables firewall should be

Quote:

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

also for the OUTPUT chain

Quote:

iptables -A OUTPUT -i lo -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT

then you can specify the default policy you want (with -P) and will not block your self accessing SSH

cashton2k · 12-06-2005, 03:26 PM

cheers for help guys much appreciated, any idea on rules to allow RFC1918 filtering with iptables?

win32sux · 12-19-2005, 06:52 PM

Quote:

Originally Posted by cashton2k

any idea on rules to allow RFC1918 filtering with iptables?

something like this should get you started:

Code:

iptables -A INPUT -i $EXT_IFACE -s 192.168.0.0/16 -j DROP
iptables -A INPUT -i $EXT_IFACE -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i $EXT_IFACE -s 10.0.0.0/8 -j DROP

(where $EXT_IFACE is your *Internet* interface...)

BTW, if you are asking about this because of packet spoofing, you should consider using the rp_filter kernel tweak, which makes the rules above kinda pointless AFAIK...

Code:

echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

http://www.google.com/linux?&q=rp_filter

just my $0.02...