iptable accept all issue

From: John Cox (scrrsec_at_sc.rr.com)
Date: 03/03/04

  • Next message: marco: "Re: Linux and Digital Camera's" 
    Date: Wed, 03 Mar 2004 18:47:33 GMT

    I am trying to lock down my box with iptables but I'm missing something. If
    I remove the accept all command (that is input by default) none of the rest
    of my accept commands work. My goal is to allow access to ssh, dns, and
    nessus. I seem to be able to filter one port at a time, but I am having
    problems accepting only one port at a time. I have included a copy of
    iptables -L and an nmap.

    Chain RH-Lokkit-0-50-INPUT (2 references)
    target prot opt source destination
    DROP tcp -- anywhere anywhere tcp dpt:x11
    DROP tcp -- anywhere anywhere tcp dpt:sunrpc
    ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
    flags:SYN,RST,ACK/SYN
    ACCEPT all -- anywhere anywhere
    ACCEPT udp -- clmasc-dns-cac-01-dmfe0.sc.rr.com anywhere
    udp spt:domain
    ACCEPT udp -- clmasc-dns-cac-02-dmfe0.sc.rr.com anywhere
    udp spt:domain
    ACCEPT udp -- coxjohnd.com anywhere udp spt:domain
    REJECT tcp -- anywhere anywhere tcp
    flags:SYN,RST,ACK/SYN reject-with icmp-port-unreachable
    REJECT udp -- anywhere anywhere udp reject-with
    icmp-port-unreachable
    [root@minihp root]# nmap xx.xxx.xxx.xxx

    Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
    Interesting ports on mypc.com (xx.xxx.xxx.xxx):
    (The 1596 ports scanned but not shown below are in state: closed)
    Port State Service
    22/tcp open ssh
    53/tcp open domain
    111/tcp filtered sunrpc
    1241/tcp open msg
    6000/tcp filtered X11 

    --
John D Cox
  • Next message: marco: "Re: Linux and Digital Camera's"

    Relevant Pages

    • Re: opening a port in iptables
      ... I run a genealogy database that needs port 2317 open. ... How do I issue a command or edit a config file to accomplish this? ... it was working, but it is not now, so I took the lines out of the iptables ...
      (comp.os.linux.security)
    • Re: Re: iptables how to close mysql port 3306
      ... can someone please provide the command line for using iptables to ... close off port 3306 so remote ... the command line on the box. ... to specify a port, you have to use --dport $port ...
      (RedHat)
    • Re: How to protect our RedHat 7.2 from port scanning?
      ... > We have a RedHat 7.2 box in Internet. ... I have modified the default tcp port ... You should probably use the packet filter, ... but don't use it since it is replaced with "iptables". ...
      (comp.os.linux.security)
    • RE: redhat-list Digest, Vol 4, Issue 38
      ... Re: Iptables: port 22 open only for my IP ... Windows Services for Unix 3.5 ... It does absolutely nothing if you have a rampant application on your Windows box that opens a port to the outside world. ...
      (RedHat)
    • Firewall Rules Summary
      ... Subject: Firewall Rules Summary ... This script is provided "as is" with no implied warranty. ... this came from various howtos and articles on iptables that existed around ... #specific port denies>1024 tcp ...
      (Focus-Linux)
    Loading