Re: filtering ruleset help sought

[Grant Taylor <gtaylor@riverviewtech.net>]

Yesh!  That snippet of firewall code is, um, well interesting to say the least if not broken.  (I'm very tired if I come off a bit crass.)

To do what you are wanting to do I would attempt something like the following:

iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP

iptables -t filter -N InternetTraffic
iptables -t filter -A InternetTraffic -d <IP of site 1> -j ACCEPT
iptables -t filter -A InternetTraffic -d <IP of site 2> -j ACCEPT
...
iptables -t filter -A InternetTraffic -d <IP of site n> -j ACCEPT
iptables -t filter -A InternetTraffic -j DROP

iptables -t filter -A INPUT -i eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT -i eth1 -j ACCEPT

iptables -t filter -A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -i eth0 -o eth1 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -i eth1 -o eth0 -p tcp --dport 80 -j InternetTraffic
iptables -t filter -A FORWARD -i eth1 -o eth0 -p tcp --dport 443 -j InternetTraffic

iptables -t filter -A OUTPUT -o eth0 -p tcp --dport 80 -j InternetTraffic
iptables -t filter -A OUTPUT -o eth0 -p tcp --dport 443 -j InternetTraffic
iptables -t filter -A OUTPUT -o eth1 -j ACCEPT

One word to the wise.  You will likely need to have DNS somewhere for your systems to be able to find the hosts that they want to get to.  If said DNS needs to pass through your firewall you will need to update the rules accordingly to allow it.



Grant. . . .

Barry Fawthrop wrote:
> Hi
> 
> I was given a iptables ruleset (that I think was generated by firestarter)
> I don't have GUI nor do I want to so I have no means to test it.
> It runs on a gateway machine ETH0 = Wan and ETH1 = LAN NICs
> 
> I'm looking for a simple ruleset that will deny all outgoing traffic 
> accept to a list of IP addresses found in a file
> and only on port 80 for HTTP access only.
> 
> I have this:
> 
> $IPT -t filter -A INPUT -s $INNET -d 0/0 -j DROP
> $IPT -t filter -A OUTPUT -s $INNET -d 0/0 -j DROP
> $IPT -t filter -A OUTPUT -p icmp -s $INNET -d 0/0 -j DROP
> 
> while read s1 s2
>     do
>           $IPT -t filter -A INPUT  -s $INNET -d $s1 --dport 80 -j ACCEPT
>           $IPT -t filter -A OUTPUT -s $INNET -d $s1 --dport 80 -j ACCEPT
>           $IPT -t filter -A OUTPUT -p icmp -s $INNET -d $s1 -j ACCEPT
>     done < /allowed-hosts
> 
> 1) doesn't work complains about --dport
> 2) I can still ping other ip addresses not found in the allowed-hosts file?
> 
> Any help, most welcome
> Thank You
> Barry