#iptables-restore

The most important firewall rules are those for the incoming connections. This article puts the focus on the INPUT rules and not the OUTPUT rules.

### ipv4 rules # flush firewall rules iptables -F # allow connections on localhost iptables -A INPUT -i lo -p tcp -j ACCEPT # accept echo replies from ping iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT # allow remote login from certain ip addresses # example for heise.de and port 22 (ssh) iptables -A INPUT -p tcp --destination-port 22 -m iprange --src-range 192.129.8.2-192.129.8.4 -j LOG iptables -A INPUT -p tcp --destination-port 22 -m iprange --src-range 192.129.8.2-192.129.8.4 -j ACCEPT # allow packets from established connections iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT # allow responses from DNS queries - add a server with -s or --source iptables -A INPUT -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT # log and deny the rest iptables -A INPUT -j LOG iptables -A INPUT -j DROP # drop IPv6-in-IPv4 packets - not necessary with the previous rule iptables -A INPUT -p ipv6 -j DROP

To disable IPv6 use the following rules.

### ipv6 rules # flush the rules ip6tables -F # allow connections on localhost ip6tables -A INPUT -i lo -p tcp -j ACCEPT # disable the rest ip6tables -A INPUT -j LOG ip6tables -A INPUT -j DROP

To save your firewall settings install iptables-persistent.

# to make the rules persistent install: apt-get install iptables-persistent # see: /etc/iptables/rules.v4 /etc/iptables/rules.v6

Rules for RTMPsuck (Real Time Messaging Protocol, for internet music streams). Use this only if you need rtmpsuck.

# enable forwarding of packets echo 1 > /proc/sys/net/ipv4/ip_forward # create firewall rule to let rtmpsuck receive network traffic iptables -t nat -A OUTPUT -p tcp --dport 1935 -m owner \! --uid-owner root -j REDIRECT

To check your firewall use the port scanner from heise.de: http://www.heise.de/security/dienste/portscan/test/go.shtml?scanart=1

To check your log files for potential attacks:

# check: /var/log/syslog /var/log/kern.log # the files depend on your syslog configuration # example line in the log file: May 1 18:43:19 computer kernel: [ 7717.667033] IN=eth0 OUT= MAC=31:9b:e9:8c:3c:ca:dc:c7:a6:8c:17:23:08:00 SRC=192.168.178.1 DST=192.168.178.20 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=54676 DF PROTO=TCP SPT=37552 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 # let a gxmessage window pop up with information about the attacker tailf /var/log/kern.log | \ grep --line-buffered DPT= | \ sed -u 's|^\(...............\).*'\ 'SRC=\([^ ]*\) DST.*DPT=\([^ ]*\) '\ '.*|IPTABLES: \1 fromIP: \2 toPort: \3|g' | \ xargs -i gxmessage -center -print "{}"

To check the ports look into /etc/services:

grep 5353 /etc/services

Persistent iptables rules in Linux Mint or other Linux distributions:

# set your iptables rules: iptables -A ... # save your rules iptables-save > /etc/firewall.conf vi /etc/rc.local iptables-restore < /etc/firewall.conf

With the parameter -A iptables rules are appended. With -I you can insert rules at the beginning of a chain.

# insert iptables rules: iptables -I INPUT ...

If you have problems with the configuration of iptables you can check where the packets go.