Hey guys,
I don't understand whats going on with my rootserver...
I have reset iptables and just opened the port for ssh.
Now suddenly over night I see that there are a various of ports open:
21,80, 135, 139, 445, 3128
Could it be that vsftpd for example put rules in automatically to allow input on port 21?
I also tried disabling iptables with this command:
Code:
# iptables -X
# iptables
I used an online tool to create an iptables firewall. Basically I just need port 22 and 1194 open to the outside world. But I noticed this bash script has input, forward and output chains as accept by default. Is it blocking all traffic but those two ports? Thanks.
I'm trying to find out why changing my default iptables policy is affecting what nmap sees when it scans my host.
Consider the following iptables setup:
iptables -F
iptables -A INPUT -p tcp -s 10.1.0.0/20 --dport 22 -j ACCEPT
iptables -P INPUT ACCEPT
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j AC
when trying to open the ports 110 and 25 in my iptables for outlook-only users, i cant do it except by forwarding as such:
-I FORWARD -i eth0 -s 192.168.1.0/24 -j ACCEPT
-I FORWARD -i eth1 -d 192.168.1.0/24 -j ACCEPT
but doing so allows the rest of the users in my lan to bypass my squid proxy.
I'd like to allow mail through iptables and DROP policy but this script doesn't work what it is wrong here:
## FLUSH de reglas
iptables -F
iptables -X
iptables -Z
iptables -t nat -F
## policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
# localhost
iptables -A INPUT -i lo -j ACCEPT
# Allow my ip
iptables -A INPUT -s MY_IP -j ACCEPT
# 80 port
iptables -A I
I've just been wanting to share/discuss/improve my knowledge on iptables firewalls, so if you have any comments, critisms, or just ideas please comment.
Basic locked down workstation firewall. Only allows outgoing web browsing and pinging other machines.
Code:
#!/bin/bash
## First, set default policy and flush existing rules.
I am running a server which needs UDP ports 1000:11000 opened, as well as TCP 10011 and 30033 open to function.
I have a set of iptables rules set to allow SSH and those ports, and intentionally left out 2010 as I am getting attacked on that port. The server does not block the incoming IP even when told to do so.
I'm trying to set up iptables to block all traffic except ssh but, no matter what I do, it's blocking outgoing ssh. The commands that I'm using are shown below. Oddly, I can SSH into the box, just not out.
How to allow outgoing trafic only for http and ssh?
i've tried:
iptables -A OUTPUT -p tcp --dport ssh -j ACCEPT
iptables -A OUTPUT -p tcp --dport http -j ACCEPT
but as soon as i add
iptables -A OUTPUT -j DROP
nothing works, it blocks everything.
Email this page
