[SOLVED] IPtables rule

szboardstretcher · 02-24-2011, 11:42 AM

Could anyone provide me with an IP tables command that will:

Quote:

Clear all IPtable rules
Allow anything incoming
Allow anything outgoing to 192.168.100.0/24 network
Do not Allow any outgoing anywhere else

More or less, I only want this server to be able to communicate with the 192.168.100/24 network, and nothing else.

Thank you

Noway2 · 02-24-2011, 12:23 PM

Try the following:

To clear: iptables -F (F is for flush)
Then set the policy for input and output as accept and drop respectively
iptables --policy INPUT accept
iptables --policy OUTPUT drop

Then on your output table set it to accept for the dport for the range of interest
iptables -p tcp --dport 192.168.100.0/24 -j ACCEPT

Once you have it running, use the iptables-save to save the configuration and iptables-restore to restore it automatically.

You may want to set the input to accept established and related instead of accept unless you think that nothing inbound from other sources will be a problem.

szboardstretcher · 02-24-2011, 12:28 PM

iptables -p tcp --dport 192.168.100.0/24 -j ACCEPT

this doesnt seem to work -- dport looks like it means destinate port. how do i specify destination network or something similar.

Noway2 · 02-24-2011, 12:33 PM

Sorry about the capitalization. It is hard to remember with iptables what has to be capitalized and what doesn't.

szboardstretcher · 02-24-2011, 12:47 PM

Quote:

Originally Posted by Noway2

Sorry about the capitalization. It is hard to remember with iptables what has to be capitalized and what doesn't.

Actually.. this doesnt work at all. Except the "clear/flush" part.

Again, what I would like is this:

Quote:

Clear all IPtable rules
Allow anything incoming (so we can hit ssh, web etc..)
Allow anything outgoing to 192.168.100.0/24 network (so we can pull files from trust)
Do not Allow any outgoing anywhere else (so it doesnt go anywhere else)
Allow loopback (is that needed?)

lazydog · 02-24-2011, 01:22 PM

This should do waht you are looking for.

Code:

iptables -F
iptables -X
iptables -Z
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -d 192.168.100.0/24 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j DROP

If you let me know what you are trying to do I will be able to build you a better firewall.
You could also look at lokkit for building your firewall.

win32sux · 02-24-2011, 06:45 PM

Quote:

Originally Posted by szboardstretcher

I only want this server to be able to communicate with the 192.168.100/24 network, and nothing else.

Then it seems rather odd that you want to allow inbound packets from any network.

May I ask why you want your INPUT chain rules to be so lax, or rather, non-existent?

coolsreejith · 02-24-2011, 07:30 PM

iptables -F
iptables -A OUTPUT -d ! 192.168.100.0/24 -j REJECT
service iptables save