Problem whit iptables configuration policy drop (Debian 7.2.0 x64)

Kaele Panda · 11-04-2013, 09:14 AM

Hi, I'm new here
I'm setting up an virtual mysql server whit dropbox (whit a Bridge network configuration)

since it is a database server, I decide to set the firewall settings on policy drop, here are the settings, I'm not sure if the mysql rule is ok (i won't that only the 192.168.1.0/ network can communicate whit the database) but I'm pretty sure I've written well the ssh and http rule, but can't access (for example) at apt, or use ssh and also i can't ping the localhost, and I don't understand why since I've defined that the connection on lo are acepted

Code:

#!/bin/sh

iptables -X
iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP

iptables -A INPUT -i lo -j ACCEPT


###http
iptables -A INPUT -p tcp --dport 80 --sport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 --sport 80 -j ACCEPT
iptables -A INPUT -p udp --dport 80 --sport 80 -j ACCEPT
iptables -A OUTPUT -p udp --dport 80 --sport 80 -j ACCEPT

###ssh
iptables -A INPUT -p tcp --dport 22 --sport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 --sport 22 -j ACCEPT


###mysql
iptables -A INPUT -p tcp --dport 3306 --sport 3306 -d 192.168.1.0/24 -s 192.168.1.0/24 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 3306 --sport 3306 -d 192.168.1.0/24 -s 192.168.1.0/24 -j ACCEPT

grim76 · 11-04-2013, 10:41 AM

I would probably take a different approach:

Code:

iptables -X
iptables -F
iptables -P INPUT DROP
iptables -N HTTP
iptables -N SSH
iptables -N DB_ACCESS
iptables -A INPUT -m state --state established,related -m comment --comment "Allow established related connections" -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -m comment --comment "Move HTTP traffic to its own chain" -j HTTP
iptables -A INPUT -p tcp --dport 22 -m comment --comment "Move SSH traffic to its own chain" -j SSH
iptables -A INPUT -p tcp --dport 3306 -m comment --comment "Move DB Access to its own chain" -j DB_ACCESS
iptables -A HTTP -p tcp --dport 80 -m comment --comment "Allow http access" -j ACCEPT
iptables -A SSH -p tcp --dport 22 -m comment --comment "Allow ssh access" -j ACCEPT
iptables -A DB_ACCESS -p tcp --dport 3306 -s 192.168.1.0/24 -m comment --comment "Only allow DB access from 192.168.1.0/24 subnet" -j ACCEPT
iptables -A DB_ACCESS -m comment --comment "Log prior to reject" -j LOG --log-prefix "DB_ACCESS DENY: "
iptables -A DB_ACCESS -m comment --comment "Properly reject traffic" -j REJECT

This would allow you some flexibility to allow, reject, log traffic as well.

Kaele Panda · 11-04-2013, 12:15 PM

I desire to block also the output connection beacouse it would be possible that i can allow to access at the server also some ssh user, so I want set also the OUTPUT policy as DROP.
an other question is how can I set also for the output the interface lo?

grim76 · 11-04-2013, 12:36 PM

ok that would be

Code:

iptables -X
iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -N HTTP
iptables -N SSH
iptables -N DB_ACCESS
iptables -A INPUT -m state --state established,related -m comment --comment "Allow established related connections" -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -m comment --comment "Move HTTP traffic to its own chain" -j HTTP
iptables -A INPUT -p tcp --dport 22 -m comment --comment "Move SSH traffic to its own chain" -j SSH
iptables -A INPUT -p tcp --dport 3306 -m comment --comment "Move DB Access to its own chain" -j DB_ACCESS
iptables -A HTTP -p tcp --dport 80 -m comment --comment "Allow http access" -j ACCEPT
iptables -A SSH -p tcp --dport 22 -m comment --comment "Allow ssh access" -j ACCEPT
iptables -A DB_ACCESS -p tcp --dport 3306 -s 192.168.1.0/24 -m comment --comment "Only allow DB access from 192.168.1.0/24 subnet" -j ACCEPT
iptables -A DB_ACCESS -m comment --comment "Log prior to reject" -j LOG --log-prefix "DB_ACCESS DENY: "
iptables -A DB_ACCESS -m comment --comment "Properly reject traffic" -j REJECT
iptables -A OUTPUT -i lo -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -m comment --comment "Allow DNS lookup" -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m state --state established -m comment --comment "Allow SSH return traffic" -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -m state --state established -m comment --comment "Allow HTTP return traffic" -j ACCEPT
iptables -A OUTPUT -p tcp --sport 3306 -m state --state established -m comment --comment "Allow MySQL return traffic" -j ACCEPT
iptables -A OUTPUT -m comment --comment "Log before proper reject" -j LOG --log-prefix "OUTPUT DENY: "
iptables -A OUTPUT -m comment --comment "Properly reject traffic -j REJECT

I am not 100% sure about the output rules. I am typically only restricting access to the servers, and not what the server can access.