Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Two Complete iptables Startup Scripts

|

499

# NOTE: in practice this rule should be source-restricted to internal DNS

# servers (that perform recursive queries on behalf of internal users)

#

$IPTABLES -A FORWARD -p udp -s $NET_INT -m state --state NEW,RELATED --dport 53 -j ACCEPT

# Allow FTP from internal hosts to the outside world

$IPTABLES -A FORWARD -p tcp -s $NET_INT -m state --state NEW,RELATED --dport 21 -j ACCEPT

# Allow HTTP from internal hosts to the outside world

$IPTABLES -A FORWARD -p tcp -s $NET_INT -m state --state NEW --dport 80 -j ACCEPT

# Allow HTTPS from internal hosts to the outside world

$IPTABLES -A FORWARD -p tcp -s $NET_INT -m state --state NEW --dport 443 -j ACCEPT

# Allow SMTP from internal hosts to the outside world

# NOTE: in practice this should be source-restricted to internal mail servers

#

$IPTABLES -A FORWARD -p tcp -s $NET_INT -m state --state NEW --dport 25 -j ACCEPT

# Allow SSH from internal hosts to Woofgang

# NOTE: in practice this should be source-restricted to internal admin systems

#

$IPTABLES -A FORWARD -p tcp -s $NET_INT -d $WOOFGANG -m state --state NEW --dport 22 -j

ACCEPT

# Log anything not accepted above - if nothing else, for t-shooting

$IPTABLES -A FORWARD -j LOG --log-prefix "Dropped by default (FORWARD):"

$IPTABLES -A FORWARD -j DROP

# NAT: Post-Routing ...