Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Can anyone please point out to me whether, assuming that the needs for a given (Ubuntu 12.04) server are only SSH, NTP (client), HTTP(S) and system updates (apt-get or aptitude), the following set of rules is a decent one? My idea is to drop all traffic by default and open only the necessary ports on the necessary states and interfaces...

*filter

#------------------------------------------------------------------------------
# Defaults
#------------------------------------------------------------------------------

-P INPUT   DROP
-P OUTPUT  DROP
-P FORWARD DROP

#------------------------------------------------------------------------------
# Loopback
#------------------------------------------------------------------------------

-A INPUT  -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

#------------------------------------------------------------------------------
# SSH
#------------------------------------------------------------------------------

-A INPUT  -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED,RELATED     -j ACCEPT

#-------------------------------------------------------------------------------
# NTP
#-------------------------------------------------------------------------------

-A INPUT  -i eth0 -p udp --sport 123 -m state --state ESTABLISHED,RELATED     -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 123 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

#------------------------------------------------------------------------------
# DNS
#------------------------------------------------------------------------------

-A INPUT  -i eth0 -p udp --sport 53 -m state --state ESTABLISHED,RELATED     -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

#------------------------------------------------------------------------------
# Updates
#------------------------------------------------------------------------------

-A INPUT  -i eth0 -p tcp --sport 80  --dport 32768:61000 -m state --state ESTABLISHED,RELATED     -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 80  --sport 32768:61000 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A INPUT  -i eth0 -p tcp --sport 443 --dport 32768:61000 -m state --state ESTABLISHED,RELATED     -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 443 --sport 32768:61000 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

#------------------------------------------------------------------------------
# Logging
#------------------------------------------------------------------------------

-A INPUT -m limit --limit 125/min -j LOG --log-prefix "IPTABLES DENIED " --log-level 7

COMMIT

Am I overlooking something? Thank you very much.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Note that with this ruleset you are also restricting outbound traffic to specific ports only. You could run into problems because of this at some point (e.g. cloning a git repository). You may want to remove the -A OUTPUT rules and instead add the following before COMMIT:

## Allow inbound established and related outside communication
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

## Allow initiating outbound communications
-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT

You may also want to allow ICMP traffic (ping etc):

## Allow ICMP traffic
-A OUTPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Finally the following will drop packets from outsiders sending packets as localhost (add before the loopback rules):

## Drop outside packets with localhost address - anti-spoofing measure
-A INPUT -s 127.0.0.0/255.0.0.0 -i ! lo -j DROP
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.