How to configure iptables correctly

Question

I'm a newbie to linux.I just implemented the following commands in iptables which I found on a site for security (i don't understand much about how each rule works). The commands are as follows:

$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT DROP

$IPTABLES -A OUTPUT -m state --state INVALID -j DROP

$IPTABLES -A OUTPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
$IPTABLES -A OUTPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPTABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

$IPTABLES -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A OUTPUT -f -j DROP
$IPTABLES -A OUTPUT -p tcp --tcp-flags ALL ALL -j DROP
$IPTABLES -A OUTPUT -p tcp --tcp-flags ALL NONE -j DROP  

$IPTABLES -A INPUT -m state --state INVALID -j DROP

$IPTABLES -A INPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A INPUT -f -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP  

After implementing these i wasn't able to browse anything. How to correct my possible errors?

Answer 1

You must understand that the third first lines disabled all traffic from,to and through your computer by default (-P DROP).

If you are to use IP tables with these default rules, the subsequent rules are meant to allow traffic. This is done using ACCEPT rules somewhere.

For example, you could allow incoming port 80 packets:

-A INPUT -p tcp --dport 80 -j ACCEPT

On the other hand, you can proceed the other way, that is to say, allow all traffic by default -P ACCEPT, then write the particular things you need to disallow.

There is not much I can do for you but suggest that you read the iptables manual to understand how it works. You won't get security off the shelf with iptables.

Answer 2

As you're starting out I would suggest ditching everything that you have right now and starting with some basics that you will give you the biggest wins.

For example:

:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

# Drop a persistent nuisance
-A INPUT -s 89.163.185.170 -j DROP

# Accept established connections and loopback traffic

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT

# Allow ssh from our IP address 1.2.3.4 (but also use hosts.allow and hosts.deny files)
-A INPUT -s 1.2.3.4 -i eth0 -m tcp -p tcp --dport 22 -j ACCEPT

# Allow web traffic on port 80 and 443 from everywhere
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT

# Block everything else
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

You can build on this easily.

Answer 3

You missed allowing ESTABLISHED connections. Try adding this at the end of your script

iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Also I woud start restricting the incoming data first. You output rules only prevent special "hand-crafted" packages from being sent. When you worry about malicious software this does not help much, as these usually simply connect to remote servers using ordinary "correct" packets.