iptables Drop Policy will drop my accept rules [closed]

StackOverflow https://stackoverflow.com/questions/23649658

  •  22-07-2023
  •  | 
  •  

Pergunta

I have set up several iptables rules , and at the end I set The Policies to Drop But It will Drop every thing even my rules

iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT   -p tcp -s 127.0.0.1 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT  -p tcp -d 127.0.0.1 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT   -p tcp -s x.x.x.x --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT  -s 127.0.0.1 -p tcp -m state --state NEW,ESTABLISHED -m multiport --sports 110,25,143 -j ACCEPT
iptables -A INPUT  -p tcp -s x.x.x.x --dport 3690 -j ACCEPT
iptables -A OUTPUT  -p tcp -s 127.0.0.1 --sport 3690 -j ACCEPT
iptables -A INPUT  -p tcp -s 0/0 --sport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s x.x.x.x  --sport 22 --dport 22 -j ACCEPT  

iptables -P INPUT  DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

but I cant access my website or ssh . Please help, thanks in advance

Iptables -nvL :

Chain INPUT (policy ACCEPT 3158 packets, 285K bytes)

pkts bytes target prot opt in out source destination

0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0


0     0 ACCEPT     tcp  --  *      *       127.0.0.1            0.0.0.0/0

tcp dpt:3306 state NEW,ESTABLISHED

0     0 ACCEPT     tcp  --  *      *       82.115.26.145        0.0.0.0/0            tcp dpt:3306 state NEW,ESTABLISHED

0     0 ACCEPT     tcp  --  *      *       82.115.26.145        0.0.0.0/0            tcp dpt:3690

0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp spt:80 state NEW,ESTABLISHED

0     0 ACCEPT     tcp  --  *      *       82.115.26.145        0.0.0.0/0            tcp spt:22 dpt:22

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 1152 packets, 160K bytes)

pkts bytes target prot opt in out source destination

0     0 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0

0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            127.0.0.1            tcp dpt:3306 state NEW,ESTABLISHED

0     0 ACCEPT     tcp  --  *      *       127.0.0.1            0.0.0.0/0            state NEW,ESTABLISHED multiport sports 110,25,143


0     0 ACCEPT     tcp  --  *      *       127.0.0.1            0.0.0.0/0  tcp spt:3690

but assume the policy is DROP for all chains

Foi útil?

Solução

You have the fundamentals there but they are a little mixed up. INPUT needs a source ip and destination port and OUTPUT needs a destination ip and source port. Traffic coming in will be NEW or ESTABLISHED and traffic going out from server services (in a client/server design) will be ESTABLISHED.

iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A INPUT  -p tcp -s x.x.x.x --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d x.x.x.x --sport 3306 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT  -p tcp -s x.x.x.x --dport 3690 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d x.x.x.x --sport 3690 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT  -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT  -p tcp -s x.x.x.x --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d x.x.x.x --sport 22 -m state --state ESTABLISHED -j ACCEPT

iptables -P INPUT  DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
Licenciado em: CC-BY-SA com atribuição
Não afiliado a StackOverflow
scroll top