Hi - I'm using iptables v1.2.11 under Debian Sarge.
I'm trying to install a very basic firewall to lock down a secondary DNS/MX box, and having some problems. Specifically, the outgoing requests I want don't work (either timing out or getting not permitted):
Here's what I got - can anyone give me any tips? Any help much appreciated.
iptables -P INPUT DROP iptables -P OUTPUT DROP
iptables -F iptables -F INPUT iptables -F OUTPUT
iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i $ETHERNET -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -o $ETHERNET -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i $ETHERNET -s $MYIP -j DROP iptables -A OUTPUT -o $ETHERNET -s ! $MYIP -j DROP iptables -A INPUT -i $ETHERNET -s 10.0.0.0/8 -j DROP iptables -A INPUT -i $ETHERNET -s 172.16/12 -j DROP iptables -A INPUT -i $ETHERNET -s 192.168/16 -j DROP
# WHY DOES THIS NOT WORK GOING OUT? iptables -A INPUT -i $ETHERNET -p tcp -d $MYIP --dport 22 -j ACCEPT iptables -A OUTPUT -o $ETHERNET -p tcp -s $MYIP --sport 22 -j ACCEPT
iptables -A INPUT -i $ETHERNET -p udp -d $MYIP --sport 53 -j ACCEPT iptables -A OUTPUT -o $ETHERNET -p udp -s $MYIP --dport 53 -j ACCEPT iptables -A INPUT -i $ETHERNET -p tcp -d $MYIP --sport 53 -j ACCEPT iptables -A OUTPUT -o $ETHERNET -p tcp -s $MYIP --dport 53 -j ACCEPT
iptables -A OUTPUT -o $ETHERNET -p tcp -s $MYIP --dport 25 -j ACCEPT iptables -A INPUT -i $ETHERNET -p tcp -d $MYIP --sport 25 -j ACCEPT
iptables -A OUTPUT -o $ETHERNET -p udp -s $MYIP --dport 123 -j ACCEPT iptables -A INPUT -i $ETHERNET -p udp -d $MYIP --sport 123 -j ACCEPT
iptables -A INPUT -i $ETHERNET -p tcp -d $MYIP --sport 873 -j ACCEPT iptables -A OUTPUT -o $ETHERNET -p tcp -s $MYIP --dport 873 -j ACCEPT
iptables -A OUTPUT -o $ETHERNET -p tcp -s $MYIP -d mirror.bytemark.co.uk
--dport 80 -j ACCEPT iptables -A OUTPUT -o $ETHERNET -p tcp -s $MYIP -d security.debian.org
--dport 80 -j ACCEPT
iptables -A INPUT -d 255.255.255.255/0.0.0.255 -j DROP iptables -A INPUT -d 224.0.0.1 -j DROP
iptables -A INPUT -j LOG iptables -A OUTPUT -j LOG
[ends]