LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 07-12-2011, 02:28 AM   #1
splinux
Member
 
Registered: Jun 2011
Location: Sri Lanka
Distribution: centos,redhat,ubuntu
Posts: 90

Rep: Reputation: Disabled
Require iptables rules for web server


i have hosted a web server on cent os 5.6.
i need to write the rules for that server.

1. 1st how can i flush the iptables ?
i used this command
iptables -F
iptables -X
iptables -t nat -F PREROUTING
iptables -t nat -F POSTROUTING
iptables -t mangle -F PREROUTING
iptables -t mangle -F POSTROUTING

flush the tables. but when i type the iptables -L it is not displaying any rules.

vim /etct/sysconfig/iptables.save
some rules are existing.. how can i flush whole rules ?
 
Old 07-12-2011, 03:01 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
you are flushing the rules and then are complaining that there are no rules when you run "iptables -L" ?? well you just flushed them... of course there aren't any...

if you have rules written to file just change the file, it's often easiest to just edit the sysconfig file and restart iptables, no need to save etc.
 
Old 07-12-2011, 03:14 AM   #3
splinux
Member
 
Registered: Jun 2011
Location: Sri Lanka
Distribution: centos,redhat,ubuntu
Posts: 90

Original Poster
Rep: Reputation: Disabled
if i go vim /etc/sysconfig/iptables.save
there are some rules existing.. how can i flush all the rules ?
we cant flush those rules also ?
 
Old 07-12-2011, 03:16 AM   #4
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
you don't "flush" those rules, it's just a text file. edit it.
 
Old 07-12-2011, 03:21 AM   #5
splinux
Member
 
Registered: Jun 2011
Location: Sri Lanka
Distribution: centos,redhat,ubuntu
Posts: 90

Original Poster
Rep: Reputation: Disabled
I have hosted a intranet web server(php,mysql) on centos 5.6 final
basically what are the rules require ?

I need allow http 192.168.5.110 and DNS from only 192.168.5.0/24
block unwanted death ping
block the unwanted ports
i should able to login over ssh from that 192.168.5.110
allow access the

what are the other rules require ?

Last edited by splinux; 07-12-2011 at 03:23 AM.
 
Old 07-12-2011, 04:01 AM   #6
Noway2
Senior Member
 
Registered: Jul 2007
Distribution: Gentoo
Posts: 2,125

Rep: Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781
You already seem to know a little bit about iptables, such as that it is made up of the various chains. For your purposes, first be aware that a firewall is meant to be a secondary layer of protection that is used in addition to proper configuration of your services. For example, if you want SSH to only allow from a particular host, configure SSH for that purpose and do NOT rely on a firewall to provide that restriction. Always apply security in layers.

Here is a link to the most comprehensive tutorial I have seen on iptables: http://www.frozentux.net/iptables-tutorial/chunkyhtml/ It is probably a little much for you to start with, but once you get the basic idea of how to work with iptables, it will serve you well. For a more introductory approach try this one: http://bodhizazen.net/Tutorials/iptables

Writing iptables for your purpose is quite easy, but to write exact rules requires more information than you have provided, such as what ethernet interface(s) you are using. Please do not just answer this question and ask us to write your rules. Try writing your own and if you have a question, we will try to answer it.

As I mentioned, iptables consists of chains, input, output, forward. For your purpose, the primary one of interest will be input. You can add rules to this chain with the -A (Add) command and remove them with the -D (Drop) command. You can include various paramaters, such as the protocol, source, destination, and interface to qualify the rule. At the end, you specify an action, typically drop with the -j command. When writing your rules, it is best to think of it in terms of what you want to allow, not what you want to block. While you can write your rules in terms of NOT logic, this isn't the best practice. The rules will also flow from top to bottom and if a matching rule is fired, it will not check against the other rules, so order is important. At the end, you will want to set the default rule to drop everything else. Alternatively, you can set the policy to drop, but this can cause you to get locked out if you flush the rules and require one to allow access. So, here is an example, to allow your SSH traffic and block everything else. The other rules will follow similarly, but be sure to read at least the Bodhi Zazen tutorial before starting.

As root run the following:
iptables -A INPUT -s 192.168.5.110 -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

As you can see, the above command specifies the desired port, protocols, address and rules and puts this in the input chain. Below that is the rule that drops all other traffic, that doesn't match this rule. Your other rules will be similar. You can also specify port ranges, and cider notation for ip addresses. You do not, however, want to specify host names as this can be very inefficient.
 
Old 07-12-2011, 04:59 AM   #7
splinux
Member
 
Registered: Jun 2011
Location: Sri Lanka
Distribution: centos,redhat,ubuntu
Posts: 90

Original Poster
Rep: Reputation: Disabled
ok thx for advice.. how to stop the death ping ?
 
Old 07-12-2011, 05:11 AM   #8
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
http://lmgtfy.com/?q=death+ping+iptables
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Linux Router: Iptables rules and dhcp server on eth1 Sum1 Linux - Networking 5 09-25-2009 03:05 AM
iptables rules for an FTP server jsmith6 Slackware 0 07-30-2009 03:58 PM
iptables rules for web server email server,ftp and ssh,please help lightwing Linux - Networking 1 03-25-2009 08:58 PM
Some iptables rules are not working on Ubuntu 8.10 server PossumJerky Linux - Security 1 02-04-2009 07:47 AM
Dynamic change of iptables rules using web interface OgeeN Linux - Security 1 09-07-2007 06:03 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 02:46 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration