[Solved] Simple State Firewall

HungGarTiger · 2012-07-24 05:28:19

I just set up my firewall following the wiki, just the basics down to the knocking section.

After I restarted my connection Firefox works which is great, although so does Transmission.. This leads me to think maybe my firewall is not working correctly, as the only ports I opened were 80 and 53.

Here is my iptables.rules

Generated by iptables-save v1.4.14 on Tue Jul 24 12:54:01 2012
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:TCP - [0:0]
:UDP - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p ipv6 -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
-A TCP -p tcp -m tcp --dport 80 -j ACCEPT
-A UDP -p udp -m udp --dport 53 -j ACCEPT
COMMIT

Any input here would be great, this is my first time setting up with iptables. On my previous distros I've always used ufw, and have never been able to get Transmission to work

Last edited by HungGarTiger (2012-07-24 08:24:15)

xartii · 2012-07-24 06:55:22

Transmission may be working because using bittorrent you're connecting to other people so this is OUTPUT connection. After your iptables rules I see the all the output traffic is accepted, so your firewall accepts everything that goes out of your computer. You only limited the INPUT chain which is responsible for incoming connections, in other words when you acts as a server. If you'd like to block Transmission you'd have to limit the OUTPUT chain (i.e. set policy to DROP and then allow only port 80 and established connections).

HungGarTiger · 2012-07-24 07:32:52

No, I am very happy with Transmission working.

It's just with my experience of firewalls (ufw), transmission was a bitch to get working. So I assumed that when it worked, I'd obviously done something wrong and the post I pulled up in search seemed to suggest that he had opened specific ports to get Transmission working

Gcool · 2012-07-24 08:14:05

As already indicated by xartii, you're allowing all outgoing traffic and then allowing all incoming reply traffic:

:OUTPUT ACCEPT [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

If you want to narrow down connectivity originating from your box, look into setting up rules for the OUTPUT chain.

HungGarTiger · 2012-07-24 08:23:53

OK I'll mark this thread as [solved] since you guys agree. As stated this is my first time using a 'state' firewall, so I didn't really know how it would function compared to the setups I've done with UFW.

Thanks for your help

Arch Linux

#1 2012-07-24 05:28:19

[Solved] Simple State Firewall

#2 2012-07-24 06:55:22

Re: [Solved] Simple State Firewall

#3 2012-07-24 07:32:52

Re: [Solved] Simple State Firewall

#4 2012-07-24 08:14:05

Re: [Solved] Simple State Firewall

#5 2012-07-24 08:23:53

Re: [Solved] Simple State Firewall

Board footer