Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to allow traffic only for httpd(nginx), port 2710 and ssh.

I've tried the following, but it didn't work and apparently all httpd, traffic was blocked and I couldn't access ssh as well. There wasn't any error.

# Generated by iptables-save v1.4.7 on Sun Dec 29 01:18:59 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1670:508953]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 2710 -j ACCEPT 
-A INPUT -j DROP 
COMMIT
# Completed on Sun Dec 29 01:18:59 2013

iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:22 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:webcache 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:sso-service 
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain ISPMGR (0 references)
target     prot opt source               destination 

iptables -xnvL

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
      52     3808 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22 
    1876   260008 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80 
     737    44220 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:8080 
    1495   181034 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:2710 
    1439    91560 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 4859 packets, 330086 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
x.x.x.x         0.0.0.0         255.255.255.0   U     0      0        0 eth0
x.x.x.x         0.0.0.0         255.255.0.0     U     1002   0        0 eth0
0.0.0.0         x.x.x.x         0.0.0.0         UG    0      0        0 eth0

nmap -p 80 x.x.x.x

Starting Nmap 5.51 ( http://nmap.org ) at 2013-12-29 02:14 EET
Nmap scan report for myhost.com (x.x.x.x)
Host is up (0.000038s latency).
PORT   STATE SERVICE
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds

tcpdump -i eth0

listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
^C
1 packets captured
3165 packets received by filter
3134 packets dropped by kernel
share|improve this question
    
Are you sure you want to use chain INPUT and not chain FORWARD ? Means, do you want to connect to port 80,2710 and 22 directly onto your firewall or onto another server ? –  user2196728 Dec 27 '13 at 16:01
    
I want to connect directly. –  Orlo Dec 27 '13 at 16:04
    
ok. Filter table is all you have ? (i mean no nat, mangle or raw) ? Does tcpdump reports some incoming packets on port 80 (for sample) ? –  user2196728 Dec 27 '13 at 16:18
    
What did you do to test if the rules work? What error do you get? Also, please provide iptables -xnvL so we can see counters for which rules hit. –  Teun Vink Dec 27 '13 at 16:35
    
If you have no rules active, does it work? –  ultrasawblade Dec 27 '13 at 16:36
show 8 more comments

2 Answers

This is a very ill-posed question. httpd is a daemon, generally it indicates a Web-Server. You do not state which Web-server you are using (Apache, Nginx, lighttpd, thttpd,...). If what you wish is to use Apache Tomcat, you will have to open also port 8243.

But if you are in doubt, on the machine hosting the Web server, issue as sudo the following command:

  ss -lntp

this will list the ports on which the pc is listening, including for instance ssh. Beside each port, you will see the process listening on it. This will give you the full list of ports to be opened.

And, if you do not have ccess to the machine on which the Web server is running, this command (again as sudo)

  nmap -T4 -A IP_address_of_Web_server

will list all open ports.

share|improve this answer
    
nginx with apache as backend –  Orlo Dec 27 '13 at 17:06
add comment

Don't you need some stanza like:

$IPTABLES -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A INPUT  -p tcp -m tcp  -s 192.168.1.35  --dport 22  -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m tcp  -d 192.168.1.35  --sport 22  -m state --state ESTABLISHED,RELATED -j ACCEPT
share|improve this answer
    
Not needed. His output policy is ACCEPT by default as can be seen in the output. Allowing only ESTABLISHED and RELATED connections even breaks it, it wouldn't allow external hosts to setup a connection, which is what you want on a webserver. –  Teun Vink Dec 27 '13 at 16:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.