New to iptables need a check on my rules

brandon88tube · 2012-01-22 00:10:11

I'm completely new to iptables and most of what I have I gathered is from different examples online. I wanted to know if these rules would be good for a machine that will only be doing web browsing.

I would like it if people could pick out any problems whether they be security or performance related. So please be as harsh as possible and go to town tearing it apart in the hopes of helping me make it as good as possible.

# Default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Not sure on what this one is exactly doing besides accepting everything ESTABLISHED or RELATED
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow the loopback interface
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow outgoing DNS(53), HTTP(80), HTTPS(443)
# Do I need UDP as well as TCP and is using NEW needed or even a good idea?
iptables -A OUTPUT -p tcp -m multiport --dport 53,80,443 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

brandon88tube · 2012-01-23 00:37:09

Anyone? I even commented areas I wasn't sure about...

BentB · 2012-01-23 17:08:48

brandon88tube wrote:

# Allow outgoing DNS(53), HTTP(80), HTTPS(443)
# Do I need UDP as well as TCP and is using NEW needed or even a good idea?
iptables -A OUTPUT -p tcp -m multiport --dport 53,80,443 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

You definitely need UDP for DNS. Most of the DNS traffic uses UDP, only large zone transfers use tcp.

You should use NEW on OUTPUT, but really you don't need any connection tracking on OUTPUT. That will be taken care of in the INPUT chain. I would use these two rules:

iptables -A OUTPUT -p tcp -m multiport --dport 53,80,443 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

Have you given any thoughts to what to do with ICMP?

Bent

brandon88tube · 2012-01-24 04:14:57

Bent, first off, thanks for replying and second I really don't know what ICMP is. Also, I'm a little confused on how NEW, ESTABLISHED or RELATED on the OUTPUT will be handled by the INPUT. Like I said, I'm completely new to this so sorry.

ewaller · 2012-01-24 04:55:36

ICMP is described here
And Here
.
.
.
But you probably don't want this one

fukawi2 · 2012-01-24 08:14:24

brandon88tube wrote:

...I really don't know what ICMP is.

See links from ewaller about WHAT it is, then allow it in your rules. It is called Internet Control Message Protocol for a reason. I hate it when people insist on outright blocking all ICMP traffic.

iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT

I usually like to rate-limit them to thwart any (historic) security risk:

iptables -A INPUT -p icmp -m limit --limit 1/sec -j ACCEPT

brandon88tube wrote:

Also, I'm a little confused on how NEW, ESTABLISHED or RELATED on the OUTPUT will be handled by the INPUT.

You really don't need to define OUTPUT rules for a desktop style system. OUTPUT is traffic that originates from the local machine, so it's usually fairly safe to set the policy to ACCEPT

iptables -P OUTPUT ACCEPT

I'm a little paranoid and put explicit blocks for some things (on servers). For example, block IRC connections:

iptables -I OUTPUT -p tcp --dport 6666:6669 -j REJECT

EDIT: grammar.

Last edited by fukawi2 (2012-01-24 08:15:42)

brandon88tube · 2012-01-25 03:40:34

ewaller, thanks for the links.

fukawi2, I sometimes live in a "foil" world myself and realize I would rather not have some "smurfs" knocking at my door. So I may just leave out the ICMP as all I really see it being used for ping and other net utilities. If there are some necessary or some desired programs that may use it, then by all means please enlighten me on the subject. As for the OUTPUT, I thought it would be a little better to have some safeguard in case I did have something that was sending stuff out that I may not want to. Not sure what, but like I said I tend to live in a "foil" world at times.

If I am incorrect in any of my statements please feel free to correct me.

R00KIE · 2012-01-25 21:32:06

I guess you could google for "linux ip stack hardening" and maybe implement some of those suggestions (after understanding what they do of course, in case of doubt don't touch it )

On another note, the wiki as examples with 'iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT', quite a long time ago it had something like 'iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT', any difference between the two and is there any reason to prefer one over the other?

brandon88tube · 2012-01-26 01:25:22

I also wondered that myself when I was originally making these rules so I searched around and found the Ubuntu wiki points this out. As they put it,

If the line above doesn't work, you may be on a castrated VPS whose provider has not made available the extension, in which case an inferior version can be used as last resort:

brandon88tube · 2012-01-26 20:38:30

Anyone else want to throw in their two cents or should I be fine with what I have or if I were to use some of the suggested help? I'm just asking because I haven't gotten a lot of replies letting me know if what I have is ok or has flaws.

gregor · 2012-01-26 21:19:13

i do this; make a file... edit this into it

#!/bin/bash

iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -F # flush
iptables -X # delete-chain
iptables -A INPUT -i lo --source 127.0.0.1 --destination 127.0.0.1 -j ACCEPT
iptables -A INPUT -m state --state "ESTABLISHED,RELATED" -j ACCEPT
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A INPUT -j DROP

save it ,and name it what ever you want don't forget to make it executable and 'run' the file

FULL STEALTH works for me.....

Last edited by gregor (2012-01-26 21:19:54)

fukawi2 · 2012-01-26 22:56:55

brandon88tube wrote:

fukawi2, I sometimes live in a "foil" world myself and realize I would rather not have some "smurfs" knocking at my door. So I may just leave out the ICMP as all I really see it being used for ping and other net utilities. If there are some necessary or some desired programs that may use it, then by all means please enlighten me on the subject.

"ICMP is way, way more than traceroute and ping"; I can't explain it any better than this: http://serverfault.com/questions/84963/ … block-icmp
At the very least, allow these types of ICMP: destination-unreachable, time-exceeded, echo-request, echo-reply
You won't get anywhere in an IPv6 world without allowing ICMPv6 as IPv6 relies on it even more than IPv4.

brandon88tube wrote:

As for the OUTPUT, I thought it would be a little better to have some safeguard in case I did have something that was sending stuff out that I may not want to. Not sure what, but like I said I tend to live in a "foil" world at times.

Chances are that anything malicious is going to be doing something very similar to what you do in your normal use... For example sending mail (or spam), web browsing (or downloading extra malicious tools) etc.

R00KIE wrote:

On another note, the wiki as examples with 'iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT', quite a long time ago it had something like 'iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT', any difference between the two and is there any reason to prefer one over the other?

conntrack/--ctstate is supposed to be a replacement for state/--state (similar to iproute2 replaced net-tools) but it hasn't quite happened fully yet... So if you have conntrack/--ctstate, use that.

Last edited by fukawi2 (2012-01-26 22:57:59)

brandon88tube · 2012-01-27 02:08:42

If I'm just restricting ICMP to those four do I need them for both INPUT and OUTPUT or just one of them? I'm honestly quite paranoid when it comes to things I don't quite understand and ICMP seems to fall under that category so that is why my first guess was to just block it all in an attempt to be more safe, but it seems at least a bare minimum is greatly suggested.

Going forward with allowing some ICMP, would it be unwise to block any ping requests from anything, but in the network? I'm not running a server here, so I don't see why the rest of the world should be able to ping me.

nomorewindows · 2012-01-27 14:43:07

The internet connection side of my router (not directly connected to the internet) is given a DHCP address by the wireless router.
The other side of my connection gives out DHCP addresses from the arch machine.
The DHCP being given on the internet connection side prevents me from having to do anything since most of the services don't like anything but a static address. Anything from the Internet side doesn't go through the iptables firewall to the local side unless it originated from the local side first. Had I set a static address on both sides that would be a different story.

All I had to do was write one iptables rule that MASQUERADES the local side to the internet side, most default options don't have to be redone. That's in the internet connection sharing wiki.

fukawi2 · 2012-01-27 22:31:26

brandon88tube wrote:

If I'm just restricting ICMP to those four do I need them for both INPUT and OUTPUT or just one of them?

Allow them in both.

brandon88tube wrote:

Going forward with allowing some ICMP, would it be unwise to block any ping requests from anything, but in the network? I'm not running a server here, so I don't see why the rest of the world should be able to ping me.

a) You probably only have 1 public IP Address (on your router/modem) and private addresses "inside" so the "whole world" won't be able to ping you anyway.
b) Being able to ping when you're debugging is worth much more than any perceived increase in security gained by blocking it.

Leonid.I · 2012-01-27 22:45:05

fukawi2 wrote:

"ICMP is way, way more than traceroute and ping"; I can't explain it any better than this: http://serverfault.com/questions/84963/ … block-icmp
At the very least, allow these types of ICMP: destination-unreachable, time-exceeded, echo-request, echo-reply
You won't get anywhere in an IPv6 world without allowing ICMPv6 as IPv6 relies on it even more than IPv4.

Thanks for this link... I just need t convey it to our IT for them to finally allow pings.

brandon88tube · 2012-01-28 23:46:01

I'm still not quite getting when to use NEW, but that aside would it be correct how I have these icmp rules set?

iptables -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/s -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 0 -j ACCEPT

I'm also unsure of how to setup the unreachable:3 and the timeout:11

fukawi2 · 2012-01-29 11:19:16

brandon88tube wrote:

I'm still not quite getting when to use NEW,

NEW is used to identify packets that the kernel connection tracking considers to be part of a "new" connection (ie, a connection it doesn't already know about). Consider that iptables evaluates every *packet*. But often we only care about firewalling a *connection* (or session). Many packets make up a single session; The kernel (attempts) to track each session so it can identify subsequent packets and accept them (with appropriate "ESTABLISHED" and "RELATED" rules) without having to evaluate every packet through all the rules. You can cat /proc/net/ip_conntrack to see a list of connections that the kernel is "tracking".

You can also use it for sanity checking; for example in any valid new TCP session, the first packet should have the "SYN" flag set, so you can combine the kernel tracking and the flag checking match to make sure that is the case:

iptables -A INPUT -m state --state NEW -p tcp ! --syn -j DROP

The above will DROP any packet that the kernel believes is attempting to initiate a new connection (ie, it hasn't seen any other packets to do with this (non-existent) connection), but doesn't have the SYN flag set.

brandon88tube wrote:

but that aside would it be correct how I have these icmp rules set?
iptables -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/s -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 0 -j ACCEPT

Yes, assuming you meant to omit the rate-limit on echo-reply. You need to monitor and adjust the rate-limit to suit your usage. Normal usage might average 2/second for you for example.

brandon88tube wrote:

I'm also unsure of how to setup the unreachable:3 and the timeout:11

iptables -A INPUT -p icmp --icmp-type destination-unreachable -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p icmp --icmp-type time-exceeded -m limit --limit 1/s -j ACCEPT

Last edited by fukawi2 (2012-01-29 11:21:35)

brandon88tube · 2012-01-29 14:48:02

Am I missing anything for icmp? It seems odd that 3 are INPUT and only 1 is OUTPUT

fukawi2 · 2012-01-29 22:47:33

brandon88tube wrote:

Am I missing anything for icmp? It seems odd that 3 are INPUT and only 1 is OUTPUT

You should add them to both so your computer can both receive and send them.

brandon88tube · 2012-01-30 02:55:06

I feel kind of stupid constantly asking these questions that are probably obvious, but I'll ask anyways. Do I set a rate limit on all of them or just the INPUT ones to prevent getting a DOS attack?

fukawi2 · 2012-01-30 22:39:01

brandon88tube wrote:

I feel kind of stupid constantly asking these questions that are probably obvious, but I'll ask anyways.

Stupid questions are the ones that aren't asked... It's what the forums are here for

brandon88tube wrote:

Do I set a rate limit on all of them or just the INPUT ones to prevent getting a DOS attack?

Just putting it on INPUT is fine. If your computer wants to send 100/sec (via OUTPUT), then you probably want to investigate and fix the cause, rather than just prevent it from actually doing it.

brandon88tube · 2012-01-31 02:25:27

I want to thank you again for helping me out. Now onto my next question ;D

Do I need to check for state on the INPUT for icmp instead of just accepting everything from it?

fukawi2 · 2012-01-31 22:40:04

brandon88tube wrote:

Do I need to check for state on the INPUT for icmp instead of just accepting everything from it?

ICMP is stateless, so it won't match an "ESTABLISHED" rule, but it may match a RELATED rule*.

Personally, I just allow them with the rate-limit and without bothering to check state.

* Your computer attempts to contact Host B on port 12345 but port 12345 is closed. Assuming Host B is allowing ICMP packets like a good netizen, then it should send back an icmp-port-unreachable to you. This packet isn't part of the actual TCP connection, but it is related.

brandon88tube · 2012-01-31 23:57:52

Again, thanks! I'll combine some more things and clean up my iptables.

Arch Linux

#1 2012-01-22 00:10:11

New to iptables need a check on my rules

#2 2012-01-23 00:37:09

Re: New to iptables need a check on my rules

#3 2012-01-23 17:08:48

Re: New to iptables need a check on my rules

#4 2012-01-24 04:14:57

Re: New to iptables need a check on my rules

#5 2012-01-24 04:55:36

Re: New to iptables need a check on my rules

#6 2012-01-24 08:14:24

Re: New to iptables need a check on my rules

#7 2012-01-25 03:40:34

Re: New to iptables need a check on my rules

#8 2012-01-25 21:32:06

Re: New to iptables need a check on my rules

#9 2012-01-26 01:25:22

Re: New to iptables need a check on my rules

#10 2012-01-26 20:38:30

Re: New to iptables need a check on my rules

#11 2012-01-26 21:19:13

Re: New to iptables need a check on my rules

#12 2012-01-26 22:56:55

Re: New to iptables need a check on my rules

#13 2012-01-27 02:08:42

Re: New to iptables need a check on my rules

#14 2012-01-27 14:43:07

Re: New to iptables need a check on my rules

#15 2012-01-27 22:31:26

Re: New to iptables need a check on my rules

#16 2012-01-27 22:45:05

Re: New to iptables need a check on my rules

#17 2012-01-28 23:46:01

Re: New to iptables need a check on my rules

#18 2012-01-29 11:19:16

Re: New to iptables need a check on my rules

#19 2012-01-29 14:48:02

Re: New to iptables need a check on my rules

#20 2012-01-29 22:47:33

Re: New to iptables need a check on my rules

#21 2012-01-30 02:55:06

Re: New to iptables need a check on my rules

#22 2012-01-30 22:39:01

Re: New to iptables need a check on my rules

#23 2012-01-31 02:25:27

Re: New to iptables need a check on my rules

#24 2012-01-31 22:40:04

Re: New to iptables need a check on my rules

#25 2012-01-31 23:57:52

Re: New to iptables need a check on my rules

Board footer