| View previous topic :: View next topic |
| Author |
Message |
Roxxor
Apprentice
Joined: 04 Jun 2003
Posts: 225
Location: Stockholm, Sweden
|
 Posted: Wed May 25, 2005 2:24 pm Post subject: open port 80 (iptables) |
 |
|
I have started to read about firewalls. Now I want to open port 80, and I have this line in my firewall:
| Code: |
/sbin/iptables -A INPUT -p tcp -i $INTERFACE --dport 80 -j ACCEPT |
But port 80 is still unaccessable.
Why?
| Code: |
#!/bin/sh
INTERFACE="eth0" # set this to your external (internet) interface
DENYMETHOD="DROP" # set this to your prefered deny method (DROP/DENY/REJECT)
SYNFLUD="3" # synflood protection max. x connects per second (keep +1)
MASQ="10.0.0.0/24" # define your ranges to apply masquarding on (aka nat)
# flush tables
/sbin/iptables -F
/sbin/iptables -F INPUT
/sbin/iptables -F OUTPUT
/sbin/iptables -F FORWARD
/sbin/iptables -F -t mangle
/sbin/iptables -X
/sbin/iptables -F -t nat
# create dump table
#
/sbin/iptables -N DUMP > /dev/null
/sbin/iptables -F DUMP
/sbin/iptables -A DUMP -p tcp -j REJECT --reject-with tcp-reset
/sbin/iptables -A DUMP -p udp -j DROP
/sbin/iptables -A DUMP -j DROP
# stateful table
#
/sbin/iptables -N STATEFUL > /dev/null
/sbin/iptables -F STATEFUL
/sbin/iptables -I STATEFUL -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A STATEFUL -m state --state NEW -i ! $INTERFACE -j ACCEPT
/sbin/iptables -A STATEFUL -j DUMP
/sbin/iptables -F FORWARD
/sbin/iptables -F INPUT
/sbin/iptables -F OUTPUT
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P INPUT ACCEPT
# loopback rules
#
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT
# synflood protection
#
/sbin/iptables -A OUTPUT -p tcp --syn -m limit --limit $SYNFLUD/s -j ACCEPT
/sbin/iptables -A INPUT -p tcp --syn -m limit --limit $SYNFLUD/s -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --syn -m limit --limit $SYNFLUD/s -j ACCEPT
# icmp block
#
/sbin/iptables -A FORWARD -i $INTERFACE -p icmp -s 0/0 -j $DENYMETHOD
/sbin/iptables -A INPUT -i $INTERFACE -p icmp --icmp-type destination-unreachable -j ACCEPT
/sbin/iptables -A INPUT -i $INTERFACE -p icmp --icmp-type time-exceeded -j ACCEPT
/sbin/iptables -A INPUT -i $INTERFACE -p icmp --icmp-type echo-reply -j ACCEPT
# block alien lans on the external interface
#
/sbin/iptables -A INPUT -i $INTERFACE -s 0.0.0.0/7 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 1.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 2.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 5.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 10.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 23.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 27.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 31.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 67.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 68.0.0.0/6 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 72.0.0.0/5 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 80.0.0.0/4 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 96.0.0.0/3 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 127.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 128.0.0.0/16 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 128.66.0.0/16 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 169.254.0.0/16 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 172.16.0.0/12 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 191.255.0.0/16 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 192.0.0.0/16 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 192.168.0.0/16 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 197.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 201.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 204.152.64.0/23 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 224.0.0.0/3 -j DUMP
/sbin/iptables -A INPUT -i $INTERFACE -s 240.0.0.0/8 -j DUMP
# block sendmail message port
#
/sbin/iptables -A INPUT -p tcp --dport 587 -j $DENYMETHOD
# initialize masq/nat
#
/sbin/iptables -t nat -F POSTROUTING
/sbin/iptables -t nat -A POSTROUTING -d ! $MASQ -j MASQUERADE
/sbin/iptables -A FORWARD -s $MASQ -j ACCEPT
/sbin/iptables -A FORWARD -d $MASQ -j ACCEPT
/sbin/iptables -A FORWARD -j $DENYMETHOD
#port forwarding
#/sbin/iptables -t nat -F PREROUTING
#napster
#/sbin/iptables -t nat -A PREROUTING -p tcp -d $INTERFACE --dport 6699 -j DNAT --to 192.168.0.1:6699
#smtp
#/sbin/iptables -t nat -A PREROUTING -p tcp -d $INTERFACE --dport 25 -j DNAT --to 192.168.0.2:25
#auth
#/sbin/iptables -t nat -A PREROUTING -p tcp -d $INTERFACE --dport 113 -j DNAT --to 192.168.0.1:113
#camarades
#/sbin/iptables -t nat -A PREROUTING -p tcp -d $INTERFACE --dport 2049 -j DNAT --to 192.168.0.5
# setup kernel options (ping block, broadcast block and more synflood protection)
#
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "1" >/proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
# block spoofed packets on wrong interface
#
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ] ; then
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $i
done
fi
# drop invalid packets
/sbin/iptables -A INPUT -i $INTERFACE -p TCP -m state --state INVALID -j $DENYMETHOD
#uncomment to give this ip full access to our services
#/sbin/iptables -A INPUT -p tcp -s 212.202.233.181 -j ACCEPT
# uncomment to open ports
#
#/sbin/iptables -A INPUT -p tcp -i $INTERFACE --dport 113 -j ACCEPT
#/sbin/iptables -A INPUT -p tcp -i $INTERFACE --dport 22 -j ACCEPT
#/sbin/iptables -A INPUT -p tcp -i $INTERFACE --dport 443 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -i $INTERFACE --dport 80 -j ACCEPT
# all other packets goto /dev/null
#
/sbin/iptables -A INPUT -i $INTERFACE -j STATEFUL
|
|
|
| Back to top |
|
 |
peka
l33t
Joined: 16 Mar 2005
Posts: 773
Location: Płońsk, Poland
|
| Posted: Wed May 25, 2005 2:33 pm Post subject: |
|
|
this my sound silly, but:
did you apply your new rules after changing them? i.e. did you run the script file in which you store your firewall script?
did you restart iptables? i.e. did you do /etc/init.d/iptables restart?
run iptables --list to see what;s applied
_________________
p3k4
Seize the time, Meribor. Live now; make now always the most precious time. Now will never come again...
Jean-Luc Picard, Star Trek TNG - The Inner Light |
|
| Back to top |
|
|
Roxxor
Apprentice
Joined: 04 Jun 2003
Posts: 225
Location: Stockholm, Sweden
|
| Posted: Wed May 25, 2005 5:19 pm Post subject: |
|
|
Yes.
Look, this is the output I get when I try to write this command directly in console:
| Code: |
bash-2.05b# /sbin/iptables -A INPUT -p tcp -i $INTERFACE --dport 80 -j ACCEPT
Warning: wierd character in interface `--dport' (No aliases, :, ! or *).
Bad argument `80'
Try `iptables -h' or 'iptables --help' for more information.
|
Why doesn't it work? |
|
| Back to top |
|
|
ter_roshak
Apprentice
Joined: 31 Jan 2004
Posts: 171
Location: Everett, WA
|
| Posted: Wed May 25, 2005 9:12 pm Post subject: |
|
|
You have to define $INTERFACE with a valid interface on your system if you are going to run this from the console. Something to the effect of 'export INTERFACE=eth0' or something like that. Otherwise, this is a good command.
| Code: |
export INTERFACE=eth0
iptables -A INPUT -p tcp -i $INTERFACE --dport 80 -j ACCEPT
|
What makes you think that this port is not open after you run the script to apply the rules?
_________________
Josh Miller -- RHCE, VCP
Ditree Consulting
http://ditree.com/
Registered Linux User #318200 |
|
| Back to top |
|
|
jamapii
l33t
Joined: 16 Sep 2004
Posts: 637
|
| Posted: Wed May 25, 2005 9:15 pm Post subject: |
|
|
$INTERFACE isn't set, so your test can't work. But it's set in the script, your script must have a different problem.
You need either INPUT *and* OUTPUT or FORWARD rules (maybe not all of them if you use STATEFUL), it depends whether you are on the router or on the real server. If you need DNAT, you need the DNAT rule to do the NAT and a FORWARD rule to allow the traffic.
Do you ever -j STATEFUL (jump to the STATEFUL chain)? |
|
| Back to top |
|
|
corley
Tux's lil' helper
Joined: 12 May 2005
Posts: 78
|
| Posted: Mon May 30, 2005 3:23 pm Post subject: a few things |
|
|
well, you have a few things wrong..
Actually there is a typo in your iptables, which is why you have an error. The reason port 80 is still unaccessable is because you need to change the order some of these rules are being applied I would imagine. With long rules like you have covering the 'gamit' you can't just come in later and type a rule like that and expect it to work. IPTABLES and others go on a first come first serve basis.. so you really have to think about the order you want your rules to be in. I would suggest starting off with a much simpler set of firewall rules. and get it going first, then start adding in all the other stuff. |
|
| Back to top |
|
|
|
Networking & Security
