Hi
I enable the IPtables but port 80 was not working. Below is my active configuration
It needs to be above the REJECT line
I don't understand the logic why it was not working if i put after reject.
---------- Post updated at 12:19 PM ---------- Previous update was at 12:18 PM ----------
I want to add some more attack tables where i need to add. all are DROP
It goes through them in order. "If this, do that, if this, jump there, if this, do that, otherwise, reject and quit".
So a REJECT line stops it cold.
Ok then i think i will place REJECT @ below of all lines. And all DROP will be placed after ACCEPT it will right
If you put an ACCEPT before a DROP the DROP will never happen either. ACCEPT and DROP both kind of stop right there.
That list of DROP, you posted previously, can be added right before:
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
This line:
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
place it right after or before:
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
Is this correct
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Bring that line to just above -A INPUT -p icmp -j ACCEPT and below
iptables -A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP
That appears to be a solution.
Some issue if add the DROP before accept i am not able to restart the iptables
This is the format of how the saved rules get stored in permanent disk like /etc/sysconfig/iptables
#ALL ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
#ALL REJECT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p all -j REJECT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
These are the individual commands for a script or cli that would load these rules to the current running iptables service:
# Reject spoofed packets
iptables -A INPUT -s 10.0.0.0/8 -j DROP
iptables -A INPUT -s 169.254.0.0/16 -j DROP
iptables -A INPUT -s 172.16.0.0/12 -j DROP
iptables -A INPUT -s 127.0.0.0/8 -j DROP
iptables -A INPUT -s 224.0.0.0/4 -j DROP
iptables -A INPUT -d 224.0.0.0/4 -j DROP
iptables -A INPUT -s 240.0.0.0/5 -j DROP
iptables -A INPUT -d 240.0.0.0/5 -j DROP
iptables -A INPUT -s 0.0.0.0/8 -j DROP
iptables -A INPUT -d 0.0.0.0/8 -j DROP
iptables -A INPUT -d 239.255.255.0/24 -j DROP
iptables -A INPUT -d 255.255.255.255 -j DROP
If you load these rules via a script you have to save them permanently.
In RedHat: iptables-save > /etc/sysconfig/iptables
Or you just can drop the iptables part and place that in the file /etc/sysconfig/iptables directly. Then, reload the iptables service:
service iptables restart