Dear all forumer, I would like to set the INPUT, Forward and OUTPUT chain default policy to drop and enable outgoing connection only but when i set the INPUT chain policy to drop, my intellij IDE automation testing script is not able to run. Now, I need to set three chains to ACCEPT policy.
I don't have sshd nor web server. It just a workstation.
Why is like this? How to properly set the iptables block all incoming and allow all outgoing? Please share the rules and command.
Below is the example rules getting from internet:
Quote:
iptables -A INPUT -j DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -m tcp -dport 80 -m state-state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp -dport 443 -m state-state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
iptables -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
----------------------------------------------------------
iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --sport 53 -j ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
iptables -N LOGGING
iptables-save > /etc/sysconfig/iptables
|
By the way, I'm using Centos Stream 9 with firewalld-cmd enable. Is the firewalld strong enough to block incoming hacking connection.
I'm reading some articles about iptables saying When you make both INPUT, and OUTPUT chain’s default policy as DROP, for every firewall rule requirement you have, you should define two rules. i.e
one for incoming and one for outgoing.
How to do that?
https://www.thegeekstuff.com/2011/06...ules-examples/
Please help. Thanks in advance.
iptables INPUT Chain default policy to drop block Intellij IDE connection
