Keeping remote attackers out of a LAN is an important aspect of
network security, if not the most
important. The integrity of a LAN should be protected from
malicious remote users through the use of stringent firewall rules.
However, with a default policy set to block all incoming, outgoing,
and forwarded packets, it is impossible for the firewall/gateway
and internal LAN users to communicate with each other or with
external resources. To allow users to perform network-related
functions and use networking applications, administrators must open
certain ports for communication.
For example, to allow access to port 80 on
the firewall, append the following rule:
iptables -A INPUT -p tcp -m tcp --sport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
|
This allows regular Web browsing from websites that communicate
via port 80. To allow access to secure websites (such as
https://www.example.com/), you must open port 443, as well.
iptables -A INPUT -p tcp -m tcp --sport 443 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
|
 |
Important |
| |
When creating an iptables ruleset, it
is critical to remember that order is important. For example, if
one chain that specifies that any packets from the local
192.168.100.0/24 subnet be dropped, and then another chain is
appended (-A) to allow packets from
192.168.100.13 (which is within the dropped restricted subnet),
then the appended rule is ignored. You must set a rule to allow
192.168.100.13 first, and then set a drop rule on the subnet.
To arbitrarily insert a rule in an existing chain of rules, use
-I, followed by the chain in
which to insert the rule, and a rule number (1,2,3,...,n) for where
the rule should reside. For example:
iptables -I INPUT 1 -i lo -p all -j ACCEPT
|
The rule is inserted as the first rule in the INPUT chain to
allow local loopback device traffic.
|
There may be times when you require remote access to the LAN
from outside the LAN. Secure services such as SSH, can be used for
encrypted remote connection to LAN services. For administrators
with PPP-based resources (such as modem banks or bulk ISP
accounts), dial-up access can be used to circumvent firewall
barriers securely, as modem connections are typically behind a
firewall/gateway because they are direct connections. However, for
remote users with broadband connections, special cases can be made.
You can configure iptables to accept
connections from remote SSH clients. For example, to allow remote
SSH access, the following rules may be used:
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p udp --sport 22 -j ACCEPT
|
There are other services for which you may need to define rules.
Refer to the Red Hat Enterprise Linux
Reference Guide for comprehensive information on iptables and its various options.
These rules allow incoming and outbound access for an individual
system, such as a single PC directly connected to the Internet or a
firewall/gateway. However, they do not allow nodes behind the
firewall/gateway to access these services. To allow LAN access to
these services, you can use NAT with iptables filtering rules.
