The following example allows all incoming SSH, HTTP and HTTPS traffic. When you are allowing incoming connections from the outside world to multiple ports, instead of writing individual rules for each and every port, you can combine them together using the multiport extension as shown below. Combine Multiple Rules Together using MultiPorts # iptables -A OUTPUT -o eth0 -p tcp –sport 443 -m state –state ESTABLISHED -j ACCEPTġ4. # iptables -A INPUT -i eth0 -p tcp –dport 443 -m state –state NEW,ESTABLISHED -j ACCEPT The following rules allow all incoming secure web traffic. # iptables -A OUTPUT -o eth0 -p tcp –sport 80 -m state –state ESTABLISHED -j ACCEPT # iptables -A INPUT -i eth0 -p tcp –dport 80 -m state –state NEW,ESTABLISHED -j ACCEPT The following rules allow all incoming web traffic. In the above example, instead of /24, you can also use the full subnet mask. # iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT The following rules allow incoming ssh connections only from network. # iptables -A OUTPUT -o eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPTġ2.Allow Incoming SSH only from a Sepcific Network # iptables -A INPUT -i eth0 -p tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT The following rules allow ALL incoming ssh connections on eth0 interface. Open port 5666 # iptables -I INPUT -p tcp -m tcp –dport 5666 -j ACCEPT White list an IP # iptables -A INPUT -i eth0 -s -j ACCEPTġ0. Allow port 2222 for inbound tcp connections # iptables -A INPUT -p tcp –dport 2222 -j ACCEPTĩ. Block outbound IP:PORT # iptables -A OUTPUT -p tcp -d –dport -j DROPĨ. Block outbound PORT # iptables -A OUTPUT -p tcp –dport -j DROPħ. Block outbound IP address # iptables -A OUTPUT -d -j DROPĦ. Allow an IP for inbound connection # iptables -A INPUT -s 192.168.1.5 -j ACCEPTĥ. # iptables -A INPUT -i eth0 -p tcp -s “$BLOCK_THIS_IP” -j DROPĤ. Block an IP for inbound connection # iptables -A INPUT -s 192.168.1.5 -j DROP All inbound connections will be allowed # iptables -P INPUT ACCEPTģ. i.e one for incoming and one for outgoing.Ĭhange default policy for INPUT/OUTPUT/FORWARD to ACCEPT. When you make both INPUT and OUTPUT chain’s default policy as DROP, for every firewall rule requirement you have, you should define two rules. Change this to DROP for all INPUT, FORWARD, and OUTPUT chains as shown below. Use the iptables flush command as shown below to do this. Delete Existing Rulesīefore you start building a new set of rules, you might want to clean-up all the default rules and existing rules. If you view this file, you’ll see all the default rules. Please note that the iptables rules are stored in the /etc/sysconfig/iptables file.
0 kommentar(er)
