Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This question already has an answer here:

Blocking all ports(in and out) is easy but it's hard with the word "except". I don't know any rules that satisfies the condition.

PS: I know this question is nothing new. But in fact, I didn't find anything helps. So, help me pls!

share|improve this question

marked as duplicate by Tog, Kevin Panko, BBlake, MariusMatutiae, Breakthrough Jun 20 '14 at 20:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
Can't you close ALL ports and then OPEN a single port in the next line? –  sinni800 Jun 17 '14 at 9:08
    
I do this: iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -I INPUT -p tcp --dport 80 -j ACCEPT ------ It's not work! –  user71169 Jun 17 '14 at 9:14

3 Answers 3

up vote 1 down vote accepted

First the ! is the NOT symbol.

iptables -A INPUT -p tcp -m tcp -m multiport ! --dports 80,443 -j DROP

Second, the rules you wrote may not have the expected results. You drop everything including the response to the connection on port 80. Therefore, you will not be able to connect to it says for the purposes of a web server.

These rules allow RELATED and ESTABLISHED connections so a web server should function, if that is in fact what your trying to do.

iptables -A INPUT -p tcp -m tcp -m multiport --dports 80,443 -j ACCEPT
<insert further allowed list here>
iptables -A INPUT -m conntrack -j ACCEPT  --ctstate RELATED,ESTABLISHED
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -j DROP
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -j DROP
share|improve this answer
    
Shouldn't ! be escaped like this \!, if the Bash shell is used? –  Cristian Ciupitu Jun 18 '14 at 2:02
    
@CristianCiupitu No it should not need to be escaped. You may have something weird going on, but on my bash I don't need to escape it. –  cybernard Jun 18 '14 at 2:06
    
I checked output of "iptables -nvL" to see packages in connection. It seems to work, your rules. But I can't check It's really work or not except using some apps which using those ports. An App use a port doesn't mean It use that port only. So, any suggest to check? –  user71169 Jun 18 '14 at 8:22
    
@cybernard, yes, you're right. A plain ! doesn't need to be escaped. Sorry about the false alarm. –  Cristian Ciupitu Jun 18 '14 at 9:20
    
@user71169 Yes. grc.com/x/ne.dll?bh0bkyd2 Click Proceed to have shields up scan the ports. It does not matter how many ports an app tries to use as my rules will prevent the traffic from reaching the other ports even if they are open/active. –  cybernard Jun 19 '14 at 4:43
# Set the default policy of the INPUT chain to DROP
iptables -P INPUT DROP

# Accept incomming TCP connections from eth0 on port 80 and 443
iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT

This should give you what you need

share|improve this answer

You can set your default action to DROP, and then create exception rules to allow 80 and 443, like so:

# Setting default policies:
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Exceptions to default policy
iptables -A INPUT -p tcp --dport 80 -j ACCEPT       # HTTP
iptables -A INPUT -p tcp --dport 443 -j ACCEPT      # HTTPS

iptables will go through the list of 'exceptions' until it finds a match. It will then perform the action specified by the -j parameter (ACCEPT in this case). If it doesn't find a match, it will fall back to the default policy and drop the packet.

Note that with this workaround any sub-domains will be locked out. For example with this method you will have it working on www.mydomain.com all right but your subdomain let's say www.sub.mydomain.com will not open for DNS errors.

share|improve this answer
    
It should be work but it's not. I'm so confuse. –  user71169 Jun 17 '14 at 9:24
    
What doesn't work? Does it allow all incoming packets, or none? Can you update your question with the output of iptables -nvL? –  mtak Jun 17 '14 at 10:05
    
Why the down vote? I have this running in production so I am 100% sure it works. –  mtak Jun 17 '14 at 11:50
    
Sorry! It's not me, someone did that :)) Yep, You sure like I am but It's not work. That why I have to make the question. –  user71169 Jun 18 '14 at 1:38
    
By the way the port numbers could be replaced with names from services i.e. http and https. –  Cristian Ciupitu Jun 18 '14 at 2:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.