3

On my machine there are web services which can be accessed from any PC connected to the same network segment (WiFi for example). I want to use IPtables on the machine to prevent any web services from being accessed by hosts on the Internet at large.

  • What rules should I configure IPtables with?

  • How can I protect a port which is always open?

Improve this question

2 Answers 2

Reset to default
3
  1. Set the default policy to deny everything. (iptables -P INPUT DENY)
  2. Allow ICMP
  3. Add the minimum rulesets required for the services you need.

If you've got ports that are used only by local machines, set allow rules for that combination of port and IP range only.

iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT

Outbound traffic needs rules as well (permit DNS queries, permit services to respond to connections, etc). Using related / established rules can help with this. Even among otherwise locked-down firewalls, allowing all outbound traffic for simplicity is common.

If you've got the time, an ideal albeit laborious case would be using SELinux to restrict things even further such as by only allowing the DNS resolver libraries to query DNS, etc.

As for "protecting an open port" that comes down to configuring the software listening to it correctly and ensuring any security issues within it are addressed.

Improve this answer
11
  • it is worth mentioning here that iptables is vulnerable to spoofing as well.
    – Saladin
    Commented Mar 4, 2013 at 19:34
  • @asadz Can you explain how it's vulnerable to spoofing? Especially on TCP, the packets must be able to get back via the router in order to make a connection. If you're allowing the local network anyway, no big deal.
    – Jeff Ferland ♦
    Commented Mar 4, 2013 at 20:57
  • Spoofing IP address 192.168.1.2 would let me access the homepage? Right considering I'm in the same vlan
    – Saladin
    Commented Mar 4, 2013 at 21:23
  • @asadz Detecting that is a job for the local router, not for the server. The server has no way to know about spoofing, it's up to the router to block connections IP packets with a source address of 192.168.1.0/24 coming from its external interface.
    – Gilles 'SO- stop being evil'
    Commented Mar 4, 2013 at 21:30
  • they are just basic packet filtering routers which uses ACL to identify access control. These ACLs are infact vulnerable to spoofing
    – Saladin
    Commented Mar 5, 2013 at 6:29
1

iptables is suited to this, but there are a couple of approaches I would take first;

  1. Listening interface; Tell your web services to listen only on your local ip. Typically they are set to listen to all interfaces (0.0.0.0, or simply *). Instead you would set this to 192.168.0.88 or similar.
  2. Web Service configuration; You can tell the web service itself to only allow certain source IPs. This is somewhat less secure than the other methods, as the connection is still established, then dropped by the webserver. However it is an easy and quick method and perfectly fine for most scenarios. In apache, this would be with the Allow From directive. Other web daemons have other configuration mechanisms.

Finally, if you want to use iptables you are looking for a pair of rules that look like;

iptables -A INPUT -p tcp --dport 80 --source 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .