Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm having problems with iptables. I am trying to block port 80 from the outside, basically plan is we just need to Tunnel via SSH then we can get on the GUI etc. on a server

I have this in my rule:


Chain OUTPUT (policy ACCEPT 28145 packets, 14M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       tcp  --  *      eth1    0.0.0.0/0            0.0.0.0/0           tcp dpt:80 state NEW,ESTABLISHED

And


Chain INPUT (policy DROP 41 packets, 6041 bytes)
    0     0 DROP       tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80 state NEW,ESTABLISHED

Any guys wanna share some insights?

share|improve this question

2 Answers 2

You should set your INPUT chain policy to DROP, your OUTPUT chain policy to ACCEPT, and then open up only those ports that you want to allow. Something like this:

/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD DROP   # Probably a good idea too.

/sbin/iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

# Now allow TCP SYN packets in to certain ports.  Once they are ACK'ed,
# the above rule for ESTABLISHED connections takes over and lets traffic flow.

/sbin/iptables -A INPUT -p tcp --syn --dport 22 -j ACCEPT
share|improve this answer
    
Thanks for the input Fran but what I dont understand though why my rules keeps letting me in port 80: iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP and iptables -A OUTPUT -o eth0 -p tcp --dport 80 -j DROP –  JoyIan Yee-Hernandez Aug 29 '12 at 15:36
1  
Are the packets coming in on eth0 or some other interface? Also check for some rule in front of the one you showed me that may allow the traffic. If that rule gets hit first, your rule never has any effect. –  Fran Aug 29 '12 at 15:42
    
BTW, your output in the question shows eth1 but now you're asking about eth0. Do you know which interface the packets arrive at? –  Fran Aug 29 '12 at 15:56

Don't use state for DROP rule.

If you don't know if your http server is tcp and/or udp you should drop udp too.

# Q:I dont understand though why my rules keeps letting me in
# A:clean the chains 1st
iptables -F
iptables -X
iptables -Z

# Set default policy to DROP if not matched by any rule
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Accept incoming connections only if previously established.
iptables -A INPUT -p tcp --dport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp --dport 80 -m state --state ESTABLISHED -j ACCEPT

# Allow to create/ESTABLISH outgoing connections.
iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

# Default policy is set to DROP so we don't need these
#iptables -A INPUT -p udp --dport 80 -j DROP
#iptables -A INPUT -p tcp --dport 80 -j DROP
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.