Here’s a little
iptables primer, because the syntax is bizarre and I always forget it.
This is my
/etc/iptables/iptables.rules on this server (Arch Linux):
# Comments start with a #, but must not share a line with a command. *filter # Not sure what *filter is for. :INPUT DROP [0:0] # The default policy for all incoming connections is to DROP (refuse them) :FORWARD DROP [0:0] # Likewise for all forwarded connections (is this even used?) :OUTPUT ACCEPT [0:0] # Outgoing connections are all accepted. If I was really paranoid I might change this. # All localhost interface traffic is OK -A INPUT -i lo -j ACCEPT # All ICMP (management protocol, for ping and stuff I think) is OK -A INPUT -p icmp -j ACCEPT # I think this says "Don't boot me off if I've already got a connection". Not sure though. -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT # The next 8 commands just say accept all incoming TCP traffic on these ports # (iptables knows a few keywords like http and https, # but I could have just as well have said 80 and 443) -A INPUT -p tcp --dport ssh -j ACCEPT -A INPUT -p tcp --dport http -j ACCEPT -A INPUT -p tcp --dport 8080 -j ACCEPT -A INPUT -p tcp --dport https -j ACCEPT # 110=pop3 143=imap 585=secure-imap 995=secure-pop3 -A INPUT -p tcp --dport 110 -j ACCEPT -A INPUT -p tcp --dport 143 -j ACCEPT -A INPUT -p tcp --dport 585 -j ACCEPT -A INPUT -p tcp --dport 995 -j ACCEPT # Yeah not really sure what these were so I just commented them out. #-A INPUT -p tcp -j REJECT --reject-with tcp-reset #-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable #-A INPUT -j REJECT --reject-with icmp-proto-unreachable COMMIT
The file in itself doesn’t really do anything, but the
rc.d script to start it reads it in with
A few other useful commands:
sudo iptables -L -v # print out the current rules sudo /etc/rc.d/iptables restart # restart iptables
If you want to autoload some config settings, put them (the output of
iptables-save) in some file,
/etc/firewall.conf or whatever, and then in
/etc/network/if-up.d/iptables (apparently this is like an optional-init.d-addendum for upstart, keyed off the filename, as far as I can tell), put this:
#!/bin/sh iptables-restore < /etc/firewall.conf
chmod +x the file.