| Linode Forum https://forum.linode.com/ |
|
| iptables question https://forum.linode.com/viewtopic.php?f=19&t=6304 |
Page 1 of 1 |
| Author: | icanbob [ Sun Nov 21, 2010 7:18 pm ] |
| Post subject: | iptables question |
My Linode was recently hacked into. I'd like to lock down all my unused ports and then only open access to those I need. In the firewall guides there is a description of how to do this. If I understand the iptables commands they first drop everything, then open those that are needed. I want to type these command manually to check them out first. My question is if I'm on an ssh session and I drop everything, how can I continue to implement the rest of my table? Thanks in advance for your help. bob |
|
| Author: | pclissold [ Sun Nov 21, 2010 7:49 pm ] |
| Post subject: | |
Use Lish to connect to your Linode's console instead of using SSH to connect to your Linode. |
|
| Author: | vonskippy [ Sun Nov 21, 2010 8:43 pm ] |
| Post subject: | |
IPTABLES rules are processed top down. If your first rule is DROP EVERYTHING - that's the ONLY rule that will ever be applied. |
|
| Author: | icanbob [ Mon Nov 22, 2010 11:03 am ] |
| Post subject: | |
I was planning to use a variation of the commands listed in the iptables Linode document as below: ====== begin snip from iptables Linode document ==== Block All Traffic and Allow Traffic on Specific Ports Link One common approach to firewall architecture involves blocking all traffic to the system by default and then allowing traffic on specific ports. Consider the following sequence of commands: iptables -P INPUT DROP iptables -P FORWARD DROP iptables -A INPUT -p tcp -m multiport --destination-ports 22,25,53,80,433,465,5222,5269,5280,8999:9003 -j ACCEPT iptables -A INPUT -p udp -m multiport --destination-ports 53 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT ====== end quote ======= If I'm manually entering these on a terminal session do I need to enter them in reverse order? Thanks again for your help. bob |
|
| Author: | vonskippy [ Mon Nov 22, 2010 5:52 pm ] |
| Post subject: | |
icanbob wrote: If I'm manually entering these on a terminal session do I need to enter them in reverse order?
No, that would probably not give you the results you're looking for. Best to just type in the script, and run it all at once. Better yet - google around for a few iptables tutorials and use those to parse what the scripts you're looking at actually does - that way instead of blinding following something that is suppose to secure your box, you'll actually know what it's doing. Like most sysadmin stuff - the basics of iptables is not all that hard to grasp - it just takes a bit of reading (and of course it won't hurt to setup a local VM and play around with it in a sandbox safe environment). |
|
| Author: | bryanw [ Mon Nov 22, 2010 6:02 pm ] |
| Post subject: | |
What distro are you using? If Ubuntu, I'd suggest looking into ufw. Then you would just create a rule to allow ssh before enabling ufw. |
|
| Author: | otherbbs [ Sun Nov 28, 2010 4:56 pm ] |
| Post subject: | |
icanbob wrote: iptables -P INPUT DROP
iptables -P FORWARD DROP iptables -A INPUT -p tcp -m multiport --destination-ports 22,25,53,80,433,465,5222,5269,5280,8999:9003 -j ACCEPT iptables -A INPUT -p udp -m multiport --destination-ports 53 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT Bob, based on the above, the rule for OUTPUT is not necessary, unless you omitted setting the policy for OUTPUT to DROP. I would suggest adding a rule to allow traffic on the local interface. -- Travis |
|
| Page 1 of 1 | All times are UTC-04:00 |
| Powered by phpBB® Forum Software © phpBB Group http://www.phpbb.com/ |
|