Saturday, June 4, 2011

Setting up iptables on CentOS 5.5

Recently, I wrote a iptables-based firewall script which only allows SSH (22) and Apache web-server HTTPS (443) ports to be available on a CentOS 5.5 machine.

There is a very useful link from CentOS Wiki, that helped me in writing the script:
http://wiki.centos.org/HowTos/Network/IPTables

Link from Ubuntu documentation is also good:
https://help.ubuntu.com/community/IptablesHowTo"

Here is how my firewall script looks like:

#!/bin/sh

#first temporarily set the default policy on the INPUT chain to ACCEPT
/sbin/iptables -P INPUT ACCEPT

# Flush all the previous rules
/sbin/iptables -F

#Allow all incoming packets destined for the localhost interface to be accepted
/sbin/iptables -A INPUT -i lo -j ACCEPT

#ESTABLISHED and RELATED refers to incoming packets that
#are part of an already established connection or
#related to and already established connection
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#Allow SSH connections
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT

#Allow Apache Web server secure connections
/sbin/iptables -A INPUT -p tcp --dport 443 -j ACCEPT

#Drop all other IP packets
/sbin/iptables -P INPUT DROP

#Drop all the IP packets to be forwarded
/sbin/iptables -P FORWARD DROP

#Allow all the outgoing IP packets from this host.
/sbin/iptables -P OUTPUT ACCEPT

# Display the current chain rules.
/sbin/iptables -L -v

No comments:

Post a Comment