Re: How to block all ports except port 21,22,80,8080 ???

["Alexander W. Janssen" <yalla@ynfonatic.de>]

[-- Attachment #1: Type: text/plain, Size: 1285 bytes --]

On Tue, Feb 18, 2003 at 11:15:21AM +0100, Patrick Maartense wrote:
> it would be MUCH better to
> 
> iptables -p INPUT DROP # default drop
> then allow only these ports
> iptables -A INPUT -p tcp -m multiport  --dport 21,22,80,8080 -j ACCEPT
> 
> safe thinking: Default : drop, allow only what needed.

And it's allways a good idea to allow traffic from loopback:

iptables -A INPUT -i lo -j ACCEPT

I heard people telling that ssh is using 22/udp as well. I'm not sure if
that's true, though i haven't found any sshd which ever bind()ed to 22/udp.
Anyone more information?

Allowing ICMP should be mandatory as well, otherwise you'll create another
PMTU blackhole and you'll miss almost all error messages. And sending real
errormessages like tcp-reset and ICMP port unreachable is a good thing, too.
You can limit them, if you like.

iptables -A INPUT -p icmp -m limit --limit 5/s -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset # limit if you like
iptables -A INPUT -j REJECT     # and that one as well
# implicit DROP due to default policy should happen here

Alex.
 

-- 
"Mr Data, when I said 'Fire at Will', I didn't mean for you to be so literal."
Instructions for use of this post: Insert tounge in cheek. Read as normal.

[-- Attachment #2: Type: application/pgp-signature, Size: 248 bytes --]