Introduction to iptables

Introduction

iptables is a powerful tool that every system administrator should know and use. But as a web developer, it is sometimes difficult to take advantage of all the functionalities that this huge firewall offers.

The following is an example of a restrictive and useful iptables configuration, in which we will close all ports and open the necessary ones according to our personal needs.

The first thing to do is to specify what kind of rules we are going to add. This is done by marking the start and end:

*filter

# Here are our rules

COMMIT

Basic rules

We will use a restrictive policy where we will close all ports by default:

-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP

If a connection already got permission to interact with our machine, we let it continue to have them:

-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

We also allow loopback connections from our machine:

-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

And finally we configure the logging system:

-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A OUTPUT -j LOG --log-prefix "[Output Log] "

Common rules

The rules are fairly simple: specify the protocol, the port and include INPUT if you want incoming connections and/or OUTPUT if you want outgoing connections.

For example, if our server runs an HTTP service (Apache, Nginx, etc), we generally want port 80 (HTTP) and 443 (HTTPS) to be accessible from the outside:

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

And in turn, if we want to browse from our server to the outside (e.g. with lynx or another browser), we will need to create the same rule but this time changing INPUT to OUTPUT:

-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT

Simple, isn't it? Here is a list of common rules that we might be interested in adding.

-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT

-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT

-A INPUT -p udp -m udp --dport 53 -j ACCEPT

-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT

-A OUTPUT -p tcp -m tcp --dport 873 -j ACCEPT

-A OUTPUT -p tcp -m tcp --dport 9418 -j ACCEPT

-A INPUT -p icmp -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT

Summary

If you want to copy and paste the entire rules file, remember that it is available at articles/introduction-to-iptables/rules.

In the blog repository on GitHub you will find all the content associated with this and other articles.

To load the rules in iptables just save these rules in a file and then run iptables-restore < file.

Once we have loaded the rules in iptables, if we want to replace the rules with new ones or if we want to delete the current ones, we must execute a series of commands:

iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT

This will remove the existing rules and allow access to everything again.