I'm just trying to get a simple firewall going. I'll probably add to it, but I want to check how to do it right. I've got a webpage and email service hosted here, so this is what I've done.

#!/bin/bash

iptables -F
iptables -Z
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 25,80,110,143 -i eth0 -j ACCEPT


Basically, I was trying to avoid needing to put a seperate line for each open incoming port, but I'm not sure if it's right. It does seem to work ok, but I don't know if I can shorten 'multiport' to 'mport', and wether it should be '--dports' or '--dport'. I've got a hardware firewall/modem as well.

I found
http://www.aboutdebian.com/
has an excellent tutorial - have a look there!
Also look for an IPTables tutorial if you want to check
about your commands!

Riddick

Thanks. I have looked at various how-tos on the netfilter website. I think what I've done is ok, I just wanted a bit of clarification. I assumed 'multiport' and 'mport' were the same thing, but 'mport' doesn't seem to work.

It's all here!
http://iptables-tutorial.frozentux.n...-tutorial.html
there doesn't seem to be an "mport" but I do remember it!

Strange!

Riddick

That's the tutorial I was following! Thanks.

mport is obsolete
netfilter/iptables - Patch-o-Matic Listing - obsolete

Check out http://www.linuxguruz.com/iptables/ . They have a section on scripts. I use them for a basic start and fine tune from there to fit per client.

Brian1

good link -- that's one to keep!