1

I try to understand how iptables works but after a lot of hours and readinga lot of articles I have stuck. What I want to do is DROP INPUT & FORWARD policy and open some ports. More specifically, I would like to open 80 & 443 ports in order to have http & https respectively. Also keep in mind that I have Arch Linux OS and I use Wi-Fi.

I have set the below rules in iptables.rules.

:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [972:60914]
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --doprt 443 -j ACCEPT
COMMIT

When I set the above rules I haven't incoming requests at all!

Also I have tried the below but didn't work either:

:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [972:60914]
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --doprt 443 -j ACCEPT
-A INPUT -j DROP
COMMIT

Also I have tried this tutorial https://wiki.archlinux.org/index.php/Iptables. So my rules are those:

:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [972:60914]
:TCP - [0:0]
:UDP - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
-A TCP -p tcp -m tcp --dport 80 -j ACCEPT
-A TCP -p tcp -m tcp --dport 443 -j ACCEPT
-A TCP -p tcp -m tcp --dport 22 -j ACCEPT
-A UDP -p udp -m udp --dport 53 -j ACCEPT
COMMIT

The above example works but I am not sure if it works right and how it works. For instance, I stay on to have incoming request if I remove these lines:

-A TCP -p tcp -m tcp --dport 80 -j ACCEPT
-A TCP -p tcp -m tcp --dport 443 -j ACCEPT
-A TCP -p tcp -m tcp --dport 22 -j ACCEPT
-A UDP -p udp -m udp --dport 53 -j ACCEPT

1 Answer 1

1

A few things seem apparent:

  • the main difference between the crude examples and the working one is that state RELATED,ESTABLISHED part - it allows the outgoing connections from your machine to return safely, as opposed to being dropped
  • letting through anything from the loopback lo interface also helps unclog things because it helps prevent random obstruction of local connections
  • allowing incoming ICMP type 8 - Echo - packets allows your machine to be pinged, which is usually helpful for debugging
  • letting through arbitrary new SSH (22/tcp) and DNS (53/udp) is not what you said you want - you should review those lines

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .