1

EDIT: Working script to use iptables to block all incoming/outgoing traffic except for ssh (port 22) and RDP (port 3389):

#!/bin/sh
# Block all incoming/outgoing traffic except for ssh and rdp

iptables -Z # zero counters
iptables -F # flush (delete) rules
iptables -X # delete all extra chains

# Set default filter policy to DROP
iptables -P INPUT   DROP
iptables -P OUTPUT  DROP
iptables -P FORWARD DROP

# Allow DNS
iptables -A INPUT --proto udp --sport 53 --jump ACCEPT
iptables -A OUTPUT --proto udp --dport 53 --jump ACCEPT
iptables -A OUTPUT --proto tcp --dport 53 --jump ACCEPT

# Allow unlimited traffic on loopback (localhost)
iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow ssh (22) and rdp (3389)
iptables -A INPUT  -p tcp -m multiport --dports 22,3389 -j ACCEPT

# Continue accepting packets after connection is established (and moved to some random >1024 port)
iptables -A INPUT --match state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT --match state --state ESTABLISHED,RELATED -j ACCEPT

Undo:

#!/bin/sh

# Set default filter policy to ACCEPT
iptables -P INPUT   ACCEPT
iptables -P OUTPUT  ACCEPT
iptables -P FORWARD ACCEPT

iptables -Z # zero counters
iptables -F # flush (delete) rules
iptables -X # delete all extra chains
0
1

You miss something like:

iptables -A INPUT  --match state --state ESTABLISHED,RELATED --jump ACCEPT
iptables -A OUTPUT --match state --state ESTABLISHED,RELATED --jump ACCEPT

to continue accepting packets after connection is established. When it happens connection is moved on the server side to some random >1024 port, that's why accepting packets on port 22 and 3389 is not enough.

To allow DNS lookups:

iptables -A INPUT  --proto udp --sport 53 --jump ACCEPT
iptables -A OUTPUT --proto udp --dport 53 --jump ACCEPT
iptables -A OUTPUT --proto tcp --dport 53 --jump ACCEPT

To set rule for several ports at once (so --sports or --dports) you have to enable multiport module. Otherwise iptables will complain about unknown option "--dports". So to allow SSH and RDP incoming connections in one line:

iptables -A INPUT --proto tcp -m multiport --dports 22,3389 --jump ACCEPT

Also since you set default policy to DROP, you don't need last two lines where you additionally set DROP for in/out connections. I do understand they make you feel safer, but it's like setting hostname, and also cron job to set it just in case on every minute. In fact this can lead to problems in the future, when you forget about those two lines and append some other rules, and will be puzzled why they don't work.

6
  • Thanks for the reply. This helped clear things up, but I'm still having trouble. I made the changes you mentioned, and I added logic to allow outgoing DNS lookups (edited the script in the original post to reflect this). Unfortunately, I'm still unable to ssh to this box. Any idea what else could be wrong? Mar 28 '17 at 21:57
  • @BennettLynch thank you for updating the question, please check my edit about DNS lookups. and let me know if it helped.
    – rsm
    Mar 28 '17 at 22:35
  • @BennettLynch If this answers your question, please award it the green tick (and possibly an upvote for being helpful), otherwise please explain what is still not working.
    – rsm
    Mar 29 '17 at 14:57
  • Really appreciate your help, but I'm still not having any luck unfortunately. I've updated my original post with the current version of the script I'm using. Would you mind trying to execute it if you have an environment to safely test it in? Currently I'm running this on an EC2 instance and trying to ssh to the instance afterwards, but my ssh attempt keeps timing out. I have to reboot the instance to reset the iptables every time. Mar 29 '17 at 22:23
  • @BennettLynch i was testing it for ssh only, that's why i missed the --dports issue. please check my updated answer, part about multiport.
    – rsm
    Mar 30 '17 at 12:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.