Configure iptables to Allow Access to Common Services on Linux

This article gives the steps to open firewall ports on CentOS 6.x in Iptables IPv4.

Basics

  • Iptables rules can be changed on the fly by using the iptables binary.
  • The rules that are set using iptables command are in memory only and will vanish when the daemon is restarted.
  • The firewall rules added on the fly can be saved to the configuration file easily in CentOS/RHEL with the command service iptables save
    • This is no need to edit the configuration file unless you really want to.
  • The following examples are aimed at hardening the inbound traffic, but allowing all outbound traffic.
    • You can completely lock down all inbound, outbound and forwarded traffic if needed. It generally just causes a lot more administration and usually isn’t necessary.

Basic Commands

  • iptables –flush delete all firewall rules from memory.
  • iptables –list List current firewall policies
  • service iptables save (CentOS/RHEL) save current rules in memory to configuration file (/etc/sysconfig/iptables)
  • service iptables restart restart iptables daemon and load firewall rules from configuration file.
  • iptables-save > /root/firwallrules.fw save firewall rules in memory to a specific configuration file.
  • iptables-restore > /root/firwallrules.fw restore firewall rules from a specific configuration file to memory.

Basic iptables Command Parameters

  • -A append to policy chain
  • INPUT | OUTPUT | FORWARD policy chain identifiers
  • -p protocol
  • -m match
  • -s source
  • –dport destination port
  • –state connection state
  • -j jump target ACCEPT | DROP

Backup Current Iptables Configuration to File

Before you begin, it is recommended to backup your current firewall rules.

iptables-save > /path/to/somewhere/filename

Example:

iptables-save > /home/user1/iptable-rules-20130308.fw

Remove All Current Rules

iptables --flush

Set Policy Chains Default Rule

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

Allow Loopback

iptables -A INPUT -i lo -j ACCEPT

Allow All Established and Related Connections

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Allow ICMP “ping” from LAN (TCP Port 22)

iptables -A INPUT -p icmp -m icmp -s 192.168.0.0/24 --icmp-type echo-request -j ACCEPT

Allow SSH from LAN (TCP Port 22)

iptables -A INPUT -p tcp -m tcp -s 192.168.0.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

Allow RSYNC from LAN (TCP Port 873)

iptables -A INPUT -p tcp -m tcp -s 192.168.0.0/24 --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT

Allow HTTP (TCP Port 80)

iptables -A INPUT -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

Allow HTTPS (TCP Port 443)

iptables -A INPUT -p tcp -m tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT

Allow MySQL Server Access from LAN (TCP Port 3306)

iptables -A INPUT -p tcp -m tcp -s 192.168.0.0/24 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT

Allow Nagios NRPE Client Access from Nagios Server (TCP Port 5666)

iptables -A INPUT -s 192.168.0.100 -p tcp -m tcp --dport 5666 -m state --state NEW,ESTABLISHED -j ACCEPT

Save Current Rules in Memory to Configuration File

service iptables save

Restart Service

service iptables restart

Script

I create a BASH script to rewrite the firewall rules how I prefer. Then run the script and test. If everything tests good, then I save the configuration.

Example:

#!/bin/sh

# Delete All Existing Rules
iptables --flush

# Set Default Chain Policies
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

## Allow Loopback
iptables -A INPUT -i lo -j ACCEPT

## Allow Established and Related Connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

## Allow SSH (From LAN)
iptables -A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

## Allow ICMP "ping" (From LAN)
iptables -A INPUT -s 192.168.0.0/24 -p icmp -m icmp --icmp-type echo-request -j ACCEPT

## Allow RSYNC (From LAN)
iptables -A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT

## Allow HTTP
iptables -A INPUT -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

## Allow HTTPS
iptables -A INPUT -p tcp -m tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT

## Allow MySQL (From LAN)
iptables -A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT

## Allow NRPE Client Access (From Nagios Server)
iptables -A INPUT -s 192.168.0.100 -p tcp -m tcp --dport 5666 -m state --state NEW,ESTABLISHED -j ACCEPT


## Prevent HTTP DoS Attack
#> -m limit: This uses the limit iptables extension
#> --limit 25/minute: This limits only maximum of 25 connection per minute. Change this value based on your specific requirement
#> --limit-burst 100: This value indicates that the limit/minute will be enforced only after the total number of connection have reached the limit-burst level.
iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

Restore Iptables Rules from Backup File

If you made a backup file or pulling a copy of rules from another system and wish to restore/replace the rules then use the following command.

iptables-restore < /path/to/somewhere/filename

Example:

iptables-restore < /home/user1/iptable-rules-20130308.fw

Restart Service

service iptables restart

Source

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s