newbie question about port blocking

newbie question about port blocking

[kenn murrah]

Sorry for the elementary nature of this question ... I've just installed
linux and have a transparent proxy working using iptables ... but my goal is
to block ALL non-http traffic in both directions ... that is, i want to
allow web access but no instant messenging, no ftp, etc.

is there a simple line or two that i can add to iptables?  please feel free
to tell me to RTFM, but the tutorial i just downloaded is 151 pages, and i
admit that i'm looking for a fast solution this morning ... (i'll study the
manual on the way home tonight on the train -- i promise!)

can anyone help me out?  all advice MOST appreciated.

Re: newbie question about port blocking

[Kim Jensen]

Hi Kenn,

A simple setup will be something like this:

iptables -i lo -j ACCEPT
iptables -p tcp --dport 80 -j ACCEPT
iptables -j DROP

If you are using a transparent proxy, ala Squid, you may have to add some more 
rules.

/Kim

On Thursday 17 April 2003 15:49, kenn murrah wrote:
> Sorry for the elementary nature of this question ... I've just installed
> linux and have a transparent proxy working using iptables ... but my goal
> is to block ALL non-http traffic in both directions ... that is, i want to
> allow web access but no instant messenging, no ftp, etc.
>
> is there a simple line or two that i can add to iptables?  please feel free
> to tell me to RTFM, but the tutorial i just downloaded is 151 pages, and i
> admit that i'm looking for a fast solution this morning ... (i'll study the
> manual on the way home tonight on the train -- i promise!)
>
> can anyone help me out?  all advice MOST appreciated.

Re: newbie question about port blocking

[kenn murrah]

Thanks, Kim.  I'll try that ...

BTW, i *AM* using squid, and my iptables already includes:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j
REDIRECT --to-port 3128

so, will the setup you describe be the only thing i need to add in order to
block non-http ports?

Thanks again,

Kenn



----- Original Message -----
From: "Kim Jensen" <kimj@dawn.dk>
To: "kenn murrah" <kenn@thebytebusiness.com>;
<netfilter@lists.netfilter.org>
Sent: Thursday, April 17, 2003 9:22 AM
Subject: Re: newbie question about port blocking


> Hi Kenn,
>
> A simple setup will be something like this:
>
> iptables -i lo -j ACCEPT
> iptables -p tcp --dport 80 -j ACCEPT
> iptables -j DROP
>
> If you are using a transparent proxy, ala Squid, you may have to add some
more
> rules.
>
> /Kim
>
> On Thursday 17 April 2003 15:49, kenn murrah wrote:
> > Sorry for the elementary nature of this question ... I've just installed
> > linux and have a transparent proxy working using iptables ... but my
goal
> > is to block ALL non-http traffic in both directions ... that is, i want
to
> > allow web access but no instant messenging, no ftp, etc.
> >
> > is there a simple line or two that i can add to iptables?  please feel
free
> > to tell me to RTFM, but the tutorial i just downloaded is 151 pages, and
i
> > admit that i'm looking for a fast solution this morning ... (i'll study
the
> > manual on the way home tonight on the train -- i promise!)
> >
> > can anyone help me out?  all advice MOST appreciated.
>
>

Re: newbie question about port blocking

[Kim Jensen]

Whoopsie,

Rules should be:
$ iptables -t filter -A INPUT -i lo -j ACCEPT
$ iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
$ iptables -t filter -A INPUT -j DROP
$ iptables -t filter -A FORWARD -p tcp --dport 80 -j ACCEPT
$ iptables -t filter -A FORWARD -j DROP

This allows nothing but web, however you may wish to open up other things as 
well, such as a few ICMP services, and as I mentioned - if you are using a 
transparent proxy, you have to add some additional rules to allow the proxy 
to work..

/Kim

On Thursday 17 April 2003 15:49, kenn murrah wrote:
> Sorry for the elementary nature of this question ... I've just installed
> linux and have a transparent proxy working using iptables ... but my goal
> is to block ALL non-http traffic in both directions ... that is, i want to
> allow web access but no instant messenging, no ftp, etc.
>
> is there a simple line or two that i can add to iptables?  please feel free
> to tell me to RTFM, but the tutorial i just downloaded is 151 pages, and i
> admit that i'm looking for a fast solution this morning ... (i'll study the
> manual on the way home tonight on the train -- i promise!)
>
> can anyone help me out?  all advice MOST appreciated.

Re: newbie question about port blocking

[Cedric Blancher]

Le jeu 17/04/2003 à 16:33, kenn murrah a écrit :
> BTW, i *AM* using squid, and my iptables already includes:
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j
> REDIRECT --to-port 3128
> so, will the setup you describe be the only thing i need to add in order to
> block non-http ports?

If you want to block everything else, than desactivate routing :

	echo 0 > /proc/sys/net/ipv4/ip_forward

You can also set FROWARD chain policy to DROP :

	iptables -P FORWARD DROP

This way, everything is denied, unless you use HTTP proxy.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE

Re: newbie question about port blocking

[kenn murrah]

well, i DID try this idea from Cedric ..
----- Original Message -----
From: "Cedric Blancher" <blancher@cartel-securite.fr>

Le jeu 17/04/2003 à 16:33, kenn murrah a écrit :
> BTW, i *AM* using squid, and my iptables already includes:
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j
> REDIRECT --to-port 3128
> so, will the setup you describe be the only thing i need to add in order
to
> block non-http ports?

You can also set FROWARD chain policy to DROP :

iptables -P FORWARD DROP

This way, everything is denied, unless you use HTTP proxy.



as well as THIS idea from Kim:

> Rules should be:
> $ iptables -t filter -A INPUT -i lo -j ACCEPT
> $ iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
> $ iptables -t filter -A INPUT -j DROP
> $ iptables -t filter -A FORWARD -p tcp --dport 80 -j ACCEPT
> $ iptables -t filter -A FORWARD -j DROP


but both of them resulted in my not being about to access HTTP, either ...
what am I doing wrong here?  Thanks again to both Cedric and Kim ... can you
or anybody else spot what I'm doing wrong ???

all replies appreciated.

Kenn