nexoBlogs network
Anonymous Anonymous

Basic and simple iptables configurations for home users

Tuesday, 12 de June del 2007
filed under , ,

OpenBSD has been always my prefered distribution when I have to install a firewall based on a *NIX machine. The PF rules are what I am used to see. But last year I had to write several configurations for a debian machine using iptables which I am not really used to. Since I tend to forget these things, I paste here a basic configuration, if you want to use it, paste this in your desired starting script.

Configuration #1: Basic firewall accepting web, ssh and ftp

#delete tables
iptables -F
iptables -X

#default policies
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

#Accept loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -i lo -j ACCEPT

#Keep State for already stablished traffic
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#Serveis que permetem (web,ssh,ftp,icmp):
iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp --dport 22 -j ACCEPT
iptables -A FORWARD -p tcp --dport 21 -j ACCEPT
iptables -A FORWARD -p icmp -j ACCEPT
#Pings to firewall:
iptables -A INPUT -p icmp -j ACCEPT

Configuration 2: Only pings to firewall

#delete tables
iptables -F
iptables -X

#default policies
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

#Keep State for already stablished traffic
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

#Pings to firewall:
iptables -A INPUT -p icmp -j ACCEPT

Was this post interesting?

Related posts

Leave your comment

Leave your comment
You need javascript to be activated on irder to leave comments

Login in OboLog, or create free blog if you don't have one yet.

Then we'll remember your data and show your avatar in your comments.

Sponsors

Comments

Subversion (svn) 1.5 para Mac OS X (alombarte)
Estamos dejados de la mano de Dios.... ains!...(13 Nov)
Subversion (svn) 1.5 para Mac OS X (obokaman)
Ais... ¿cuándo alguien se va a currar un cliente GUI tan completo como TortoiseSVN ...(12 Nov)
U*Blog: blog posting from the pda (icoft)
Worldwide client base in the mobile communications space.See the details at ...(08 Nov)
U*Blog: blog posting from the pda (icoft)
WORLDWIDE client base in the cell phone sector. Tremendous opportunity to get in the stock now. ...(08 Nov)
Cómo reiniciar o resetear un ipod colgado (fermin)
necesito saber como hacer eso pero para mi ipod touch no puedo se quedo trabado  mientras le...(06 Nov)

Login

Otros blogs de nexoBlogs: