0

I have 2 servers, one for web requests (I named it the web) and another one is for database (I named it the db). Both servers are CentOS 7.

I want to make these rules in iptables:

  • all request to db server should be blocked (all IPs on all ports);
  • just web server (y.y.y.y) can access the db server on ports 5432 and 6379;
  • just a static ip (x.x.x.x) can access port 22.

So I wrote these rules but I'm not sure they are correct

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -p tcp --dport 5432 -s y.y.y.y -j ACCEPT
iptables -A INPUT -p tcp --dport 6379 -s y.y.y.y -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -s x.x.x.x -j ACCEPT

1 Answer 1

0

While those rules looks correct (assuming they go to the db server`), you're missing an important rule, which is:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Without that rule, and with the default INPUT policy as DROP, your db server itself won't be able to access the network, for example to install upgrades or ping/traceroute reachability checks, etc.

So a complete iptables ruleset should be

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 5432 -s y.y.y.y -j ACCEPT
iptables -A INPUT -p tcp --dport 6379 -s y.y.y.y -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -s x.x.x.x -j ACCEPT

Please make sure not to do iptables -P INPUT DROP via ssh as it will lock you out of your server.

2
  • Thank you, so should I use my rules plus your rule ?
    – MajAfy
    Oct 30, 2018 at 11:26
  • @MajAfy I've update my answer with full ruleset. Oct 30, 2018 at 11:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .