Printable View
How do I block incoming connections only using iptables? I'm trying to block an entire range, i'm using iptables -A INPUT -m iprange --src-range 21.86.0.0-21.86.255.255 -j DROP. And that does the job, but also blocks outgoing connections too. If it makes a difference, i'm using this to block certain ftp sites from fxping to my machine.
I don't see an obvious reason why that should block outgoing connections. Post your entire ruleset?
# iptables -nvL
Put it in code blocks so that it's readable.
I know ftp isn't the best way of testing, so I tried sshing between boxs, it definetely doesn't connect from either side.
Code:Chain INPUT (policy ACCEPT 3814K packets, 3408M bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 source IP range 21.86.0.0-21.86.255.255
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 3311K packets, 2255M bytes)
pkts bytes target prot opt in out source destination
iptables -I INPUT -s 21.86.0.0/16 -p tcp --dport 21 -j DROP --tcp-flags ALL SYNQuote:
Originally Posted by BL4CKFIRE64
Whit this line you'll drop all incoming tcp traffic with rised SYN flag from 21.86.0.0-21.86.255.255 targeted at your port 21 (FTP)...
Tcp handshake is initiated by a SYN flagged packed... by dropping those packets you'll ban the access to your services, but won't actually deny your connection attempts at that range...
Cheers,
Ventsi
The idea to block incoming tcp SYN packets to port 21 is nice and precise, but I'm still curious why OP's outbound connections were being blocked. There should be nothing in that tiny ruleset causing it.
This should fix your firewall problems. It allows only connections you started in and everything you do out:
Code:
/sbin/iptables -Z
/sbin/iptables -X
/sbin/iptables -F
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -j DROP
/sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -m state --state NEW -j ACCEPT
Simple, because there was no statement to allow connections from those ip addresses back in. Those ip's were dropped unconditionally.Quote:
Originally Posted by anomie
The policy on his INPUT chain is ACCEPT, and he has only one rule that targets a specific subnet. Maybe OP should define what is meant by "blocks outgoing connections". To what??
Good suggestion on the stateful rules.
Here's the ruleset to use, IMO:
Flush, allow loopback traffic, allow stateful, drop new connections from the subnet OP specified to tcp 21. Simple.Code:# iptables -F
# iptables -A INPUT -i lo -j ACCEPT
# iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -A INPUT -s 21.86.0.0/16 -p tcp -m state --state NEW -m tcp --dport 21 -j DROP
<other rules go here>
<set policy for chain as appropriate>
I didn't see anything in his requirements about making changes to the OUTPUT chain policy or rules.
Well i'm not trying to block traffic to my actual ftp port, but i'm trying to block FXP'ing (ftp to ftp), which would be transfers to my passive ports. But instead of blocking everything, I want to do only incoming transfers (from other servers, to mine).
[root@localhost root]# iptables -A input -s 127.0.0.1 -p icmp -j DENY
iptables v1.2.9: Couldn't load target `DENY':/lib/iptables/libipt_DENY.so: cannot open shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
[root@localhost root]#
some body can u help me, because i am new at linux sistem
i used fedora core 2
thanks
lefter