Linux Security Cookbook

2.4. Blocking Incoming Traffic

Problem

You want to block all incoming network traffic, except from your system itself. Do not affect outgoing traffic.

Solution

For iptables :

# iptables -F INPUT
# iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
# iptables -A INPUT -j REJECT

For ipchains :

# ipchains -F input
# ipchains -A input -i lo -j ACCEPT
# ipchains -A input -p tcp --syn -j REJECT
# ipchains -A input -p udp --dport 0:1023 -j REJECT

Discussion

The iptables recipe takes advantage of statefulness, permitting incoming packets only if they are part of established outgoing connections. All other incoming packets are rejected.

The ipchains recipe accepts all packets from yourself. The source can be either your actual IP address or the loopback address, 127.0.0.1; in either case, the traffic is delivered via the loopback interface, lo. We then reject TCP packets that initiate connections (—syn) and all UDP packets on privileged ports. This recipe has a disadvantage, however, which is that you have to list the UDP port numbers. If you run other UDP services on nonprivileged ports (1024 and up), you’ll have to modify the port list. But even so there’s a catch: some outgoing services allocate a randomly numbered, nonprivileged port for return packets, and you don’t want to block it.

Don’t simply drop all input packets, e.g.:

# ipchains -F input
# ipchains -A input -j REJECT

as this will block responses returning from your legitimate outgoing connections.

iptables also supports the —syn ...