How to configure the Linux firewall iptables
The most important firewall rules are those for the incoming connections. This article puts the focus on the INPUT rules and not the OUTPUT rules.
### ipv4 rules # flush firewall rules iptables -F # allow connections on localhost iptables -A INPUT -i lo -p tcp -j ACCEPT # accept echo replies from ping iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT # allow remote login from certain ip addresses # example for heise.de and port 22 (ssh) iptables -A INPUT -p tcp --destination-port 22 -m iprange --src-range 192.129.8.2-192.129.8.4 -j LOG iptables -A INPUT -p tcp --destination-port 22 -m iprange --src-range 192.129.8.2-192.129.8.4 -j ACCEPT # allow packets from established connections iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT # allow responses from DNS queries - add a server with -s or --source iptables -A INPUT -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT # log and deny the rest iptables -A INPUT -j LOG iptables -A INPUT -j DROP # drop IPv6-in-IPv4 packets - not necessary with the previous rule iptables -A INPUT -p ipv6 -j DROP
To disable IPv6 use the following rules.
### ipv6 rules # flush the rules ip6tables -F # allow connections on localhost ip6tables -A INPUT -i lo -p tcp -j ACCEPT # disable the rest ip6tables -A INPUT -j LOG ip6tables -A INPUT -j DROP
To save your firewall settings install iptables-persistent.
# to make the rules persistent install: apt-get install iptables-persistent # see: /etc/iptables/rules.v4 /etc/iptables/rules.v6
Rules for RTMPsuck (Real Time Messaging Protocol, for internet music streams). Use this only if you need rtmpsuck.
# enable forwarding of packets echo 1 > /proc/sys/net/ipv4/ip_forward # create firewall rule to let rtmpsuck receive network traffic iptables -t nat -A OUTPUT -p tcp --dport 1935 -m owner \! --uid-owner root -j REDIRECT
To check your firewall use the port scanner from heise.de:
http://www.heise.de/security/dienste/portscan/test/go.shtml?scanart=1
To check your log files for potential attacks:
# check: /var/log/syslog /var/log/kern.log # the files depend on your syslog configuration # example line in the log file: May 1 18:43:19 computer kernel: [ 7717.667033] IN=eth0 OUT= MAC=31:9b:e9:8c:3c:ca:dc:c7:a6:8c:17:23:08:00 SRC=192.168.178.1 DST=192.168.178.20 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=54676 DF PROTO=TCP SPT=37552 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 # let a gxmessage window pop up with information about the attacker tailf /var/log/kern.log | \ grep --line-buffered DPT= | \ sed -u 's|^\(...............\).*'\ 'SRC=\([^ ]*\) DST.*DPT=\([^ ]*\) '\ '.*|IPTABLES: \1 fromIP: \2 toPort: \3|g' | \ xargs -i gxmessage -center -print "{}"
To check the ports look into /etc/services:
Persistent iptables rules in Linux Mint or other Linux distributions:
# set your iptables rules: iptables -A ... # save your rules iptables-save > /etc/firewall.conf vi /etc/rc.local iptables-restore < /etc/firewall.conf
With the parameter -A iptables rules are appended. With -I you can insert rules at the beginning of a chain.
# insert iptables rules: iptables -I INPUT ...
If you have problems with the configuration of iptables you can check where the packets go.
# check iptables: iptables -nvL # or just the INPUT chain: iptables -nvL INPUT # example output # 4 packets are accepted for TCP localhost: Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 4 200 ACCEPT tcp -- lo * 0.0.0.0/0 0.0.0.0/0
