• Choose a category
• All
• Classic-Fiction

--dport 22 -j ACCEPT

# ACCEPT new incoming FTP connections from 192.168.1/24.

iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 192.168.1/24 \

--dport 21 -j ACCEPT

# ACCEPT new incoming FTP connections from spaghetti.vpizza.com,

# which has IP address 10.21.2.4.

iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.21.2.4 \

--dport 21 -j ACCEPT

# ACCEPT new incoming FTP connections from *.vpizza.com.

# They have two networks: 172.18.1.0 and 172.25.3.0.

iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 172.18.1/24 \

--dport 21 -j ACCEPT

iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 172.25.3/24 \--dport 21 -j ACCEPT

The ruleset specifically accepts all packets that belong to an existing connection. This is needed in the case of FTP, in which the client and server may negotiate an alternate port for the data transfer connection. The connection tracking module (specified with -m state in the rules) ensures that the data transfer connection can be accepted.

IP filtering to protect an entire network

The previous example demonstrated IP filtering on a single host. In this section, we deal with the case where a network of machines (such as all the machines in a home or small office) are connected to the Internet through a gateway machine. We can write netfilter rules to filter the traffic between the Internet and the internal network. In Example 26-2, we place rules on both the INPUT and FORWARD chains. Recall that INPUT is used to filter incoming packets destined for this host, whereas FORWARD is used for packets being forwarded by the gateway (i.e., packets destined for the internal network or the Internet). Here, we assume that the gateway machine uses the ppp0 interface to communicate with the Internet.

Example 26-2. Using netfilter to protect an IP network

# Load the connection tracking modules if they're not compiled into the

# kernel.

modprobe ip_conntrack

modprobe ip_conntrack_ftp

# Set default policy on INPUT and FORWARD chains to DROP.

iptables -P INPUT DROP

iptables -P FORWARD DROP

# ACCEPT all packets from the loopback interface.

iptables -A INPUT -i lo -j ACCEPT

# Create a new user-defined chain. This chain will contain rules

# relevant to both INPUT and FORWARD, so by grouping them together on

# a single chain we avoid stating the rules twice.

iptables -N allowfwdin

# ACCEPT packets belonging to an existing connection.

# Note that this rule (and subsequent rules) are placed

# on the user-defined chain.

iptables -A allowfwdin -m state --state ESTABLISHED,RELATED -j ACCEPT

# ACCEPT new connection requests from machines on the internal network.

# This allows machines on the internal network to establish connections

# to the Internet, but not the other way around. Note the use of

# '-i ! ppp0' to specify packets coming from interfaces other than ppp0.

iptables -A allowfwdin -m state --state NEW -i ! ppp0 -j ACCEPT

# ACCEPT new incoming connections to port 22 (ssh).

iptables -A allowfwdin -m state --state NEW -m tcp -p tcp \

--dport 22 -j ACCEPT

# ACCEPT new incoming FTP connections from 192.168.1/24.

iptables -A allowfwdin -m state --state NEW -m tcp -p tcp -s 192.168.1/24 \

--dport 21 -j ACCEPT

# ACCEPT new incoming FTP connections from spaghetti.vpizza.com.

iptables -A allowfwdin -m state --state NEW -m tcp -p tcp -s 10.21.2.4 \

--dport 21 -j ACCEPT

# ACCEPT new incoming FTP connections from *.vpizza.com.

iptables -A allowfwdin -m state --state NEW -m tcp -p tcp -s 172.18.1/24 \

--dport 21 -j ACCEPT

iptables -A allowfwdin -m state --state NEW -m tcp -p tcp -s 172.25.3/24 \

fs

# Any packets that have passed through the user-defined chain are now

# subject to the action LOG, which causes them to be logged.

# Use the 'limit' module to prevent logging blocked packets too

# rapidly.

iptables -A allowfwdin -m limit --limit 2/sec -j LOG

# Set default action on the user-defined chain to DROP.

iptables -A allowfwdin -j DROP

# Direct all packets received for INPUT