Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm sure this is mostly my misunderstanding of how iptables works, but I've set up some rules...

-A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT

And my output of iptables -L -n -v is:

Chain INPUT (policy ACCEPT 603K packets, 272M bytes)
pkts bytes target     prot opt in     out     source               destination
19382 1874K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22 state NEW,ESTABLISHED
1241K  205M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           multiport dports 80,443 state NEW,ESTABLISHED

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 628K packets, 120M bytes)
pkts bytes target     prot opt in     out     source               destination
22575 3769K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:22 state ESTABLISHED
1085K  888M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           multiport sports 80,443 state ESTABLISHED

Unfortunately, with this setup, connections like FTP can still connect. What I wanted was for these rules to be the only available options for connecting. In other words, basically deny anything but access via SSH and common webserver ports.

How would I modify my settings to accomplish this kind of configuration?

share|improve this question

1 Answer 1

You need to either change the default policy to something other than ACCEPT or you need to add rules to block packets. (See the iptables -P command.)

If the end of a built-in chain is reached or a rule in a built-in chain with target RETURN is matched, the target specified by the chain policy determines the fate of the packet.

Make sure you have some other way to access the machine in case you mess something up when changing chain policies or adding broad rules to block packets.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.