![\"Iptables](\"https:\/\/www.melberi.com\/linuxadmin\/wp-content\/uploads\/sites\/3\/2015\/10\/iptables.jpg\" "\\"Iptables")
<\/div>\nIptables Basic Setup:<\/b><\/u><\/h2>\n
Here I have mentioned the basic configurations for enabling iptables in fedora linux.<\/p>\n
will list your current iptables configuration.<\/p>\n
1)\u00a0<\/b>To allow established sessions to receive traffic<\/p>\n
# iptables -A INPUT -m conntrack –ctstate ESTABLISHED,RELATED -j ACCEPT <\/b><\/p>\n
2) <\/b>You could start by blocking traffic, but you might be working over SSH, where you would need to allow SSH before blocking everything else.<\/p>\n
To allow incoming traffic on the default ssh port (22)<\/p>\n
# iptables -A INPUT -p tcp –dport 22 -j ACCEPT<\/b><\/p>\n
To allow incoming traffic on the default Squid port (3128)<\/p>\n
# iptables -A INPUT -p tcp –dport 3128 -j ACCEPT<\/b><\/p>\n
To allow incoming traffic on the default Apache port<\/p>\n
# iptables -A INPUT -p tcp –dport 80 -j ACCEPT<\/b><\/p>\n
To allow incoming traffic on the default samba port<\/p>\n
# iptables -A INPUT -p udp –dport 137 -j ACCEPT<\/b>
\n# iptables -A INPUT -p udp –dport 138 -j ACCEPT<\/b>
\n# iptables -A INPUT -p udp –dport 139 -j ACCEPT <\/b>
\n# iptables -A INPUT -p tcp –dport 139 -j ACCEPT<\/b>
\n# iptables -A INPUT -p tcp –dport 445 -j ACCEPT\u00a0\u00a0<\/b><\/p>\n
To allow incoming traffic on the default SNMP port\u00a0 (161)<\/p>\n
# iptables -A INPUT -p tcp –dport 161 -j ACCEPT<\/b>
\n# iptables -A INPUT -p udp –dport 161 -j ACCEPT<\/b><\/p>\n
Now check the current configuration<\/p>\n
\nChain INPUT (policy ACCEPT)<\/b>
\ntarget\u00a0\u00a0\u00a0\u00a0 prot opt source\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 destination<\/b>
\nACCEPT\u00a0\u00a0\u00a0\u00a0 all\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 state RELATED,ESTABLISHED
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp dpt:http
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 udp dpt:netbios-ns
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 udp dpt:netbios-dgm
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 udp dpt:netbios-ssn
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp dpt:netbios-ssn
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp dpt:snmp
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 udp dpt:snmp
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp dpt:microsoft-ds
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp dpt:squid<\/div>\n
3)<\/b> Once we enabled the above port.we can drop all other incoming ports.<\/p>\n
# iptables -A INPUT -j DROP<\/b><\/p>\n
Now check the rule<\/p>\n
For Interface based access for eth0 specify -i eth0<\/b><\/p>\n
4)<\/b> In the final step we have to enable loopback interface. After all the traffic has been dropped. We need to insert this rule before that. Since this is a lot of traffic, we’ll insert it as the first rule so it’s processed first.<\/p>\n
#iptables -I INPUT 1 -i lo -j ACCEPT<\/b><\/p>\n
5)<\/b> To enabling logging<\/p>\n
# iptables -I INPUT 5 -m limit –limit 5\/min -j LOG –log-prefix “iptables denied: ” –log-level 7<\/b><\/p>\n
6)<\/b> To save this configuration<\/p>\n This configuration will enable ssh port and disable all other incoming ports.<\/p>\n To manually edit iptables config<\/a><\/p>\n Also you can manual edit\u00a0 \/etc\/sysconfig\/iptables<\/p>\n # iptables -A INPUT -p tcp –dport 389 -j ACCEPT<\/b> or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n -A INPUT -p tcp -m tcp –dport\u00a0 389 -j ACCEPT <\/b><\/p>\n \u00a0#iptables -A INPUT -p tcp –dport 25 -j ACCEPT<\/b> or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n -A INPUT -p tcp -m tcp –dport\u00a0 25 -j ACCEPT\u00a0<\/b> \u00a0#iptables -A INPUT -p tcp –dport 110 -j ACCEPT<\/b> or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n -A INPUT -p tcp -m tcp –dport\u00a0 110 -j ACCEPT <\/b> \u00a0#iptables -A INPUT -p tcp –dport 143 -j ACCEPT<\/b> or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n -A INPUT -p tcp -m tcp –dport\u00a0 143 -j ACCEPT <\/b> \u00a0#iptables -A INPUT -p tcp –dport 10000 -j ACCEPT<\/b><\/p>\n or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n -A INPUT -p tcp -m tcp –dport\u00a0 1000 -j ACCEPT <\/b><\/p>\n \u00a0#iptables -A INPUT -p tcp –dport 53 -j ACCEPT<\/b> or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n -A INPUT -p tcp -m tcp –dport\u00a0 53 -j ACCEPT <\/b> \u00a0#iptables -A INPUT -p udp –dport 69 -j ACCEPT <\/b><\/p>\n or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n -A INPUT -p udp -m udp –dport\u00a0 69 -j ACCEPT <\/b><\/p>\n #iptables -A INPUT -p udp –dport 67 -j ACCEPT\u00a0<\/b> or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n -A INPUT -p udp -m udp –dport\u00a0 67 -j ACCEPT <\/b> \u00a0#iptables -A INPUT -p udp –dport 123 -j ACCEPT <\/b><\/p>\n or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n -A INPUT -p udp -m udp –dport\u00a0 123 -j ACCEPT <\/b><\/p>\n \u00a0#iptables -A INPUT -p tcp –dport 80 -j ACCEPT<\/b> or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n -A INPUT -p tcp -m tcp –dport 80 -j ACCEPT <\/b> \u00a0#iptables -A INPUT -p tcp –dport 3128 -j ACCEPT <\/b><\/p>\n or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n -A INPUT -p tcp -m tcp –dport 3128 -j ACCEPT <\/b><\/p>\n # iptables -A INPUT -p tcp –dport 161 -j ACCEPT<\/b> # iptables -A INPUT -d 10.1.1.1 -p udp –dport 137 -j DROP <\/p>\n For Other Services<\/span><\/strong><\/p>\n NFS, SSH, FTP Refer the below Related Post Links.<\/p>\n","protected":false},"excerpt":{"rendered":" Iptables Configuration Guide for Linux CentOS Fedora Lunux Redhat Ubuntu Debian for Bind, SSH, Squid, Samba, Apache, Ldap,\u00a0 Snmp, Dhcp, Smpt, SMTPS, Webmin, Tftp, HTTP HTTPS Iptables Basic Setup: Here… Read more »<\/a><\/p>\n","protected":false},"author":1,"featured_media":196,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[104],"tags":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.melberi.com\/linuxadmin\/wp-json\/wp\/v2\/posts\/31"}],"collection":[{"href":"https:\/\/www.melberi.com\/linuxadmin\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.melberi.com\/linuxadmin\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.melberi.com\/linuxadmin\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.melberi.com\/linuxadmin\/wp-json\/wp\/v2\/comments?post=31"}],"version-history":[{"count":6,"href":"https:\/\/www.melberi.com\/linuxadmin\/wp-json\/wp\/v2\/posts\/31\/revisions"}],"predecessor-version":[{"id":622,"href":"https:\/\/www.melberi.com\/linuxadmin\/wp-json\/wp\/v2\/posts\/31\/revisions\/622"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.melberi.com\/linuxadmin\/wp-json\/wp\/v2\/media\/196"}],"wp:attachment":[{"href":"https:\/\/www.melberi.com\/linuxadmin\/wp-json\/wp\/v2\/media?parent=31"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.melberi.com\/linuxadmin\/wp-json\/wp\/v2\/categories?post=31"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.melberi.com\/linuxadmin\/wp-json\/wp\/v2\/tags?post=31"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nor <\/b>
\n#service iptables save\u00a0 <\/b>
\n<\/b><\/div>\nIP Tables configuration for other Services<\/b><\/u><\/h3>\n
1) Iptables\u00a0 for LDAP \/ LDAPS \/ OPENLDAP
\n<\/b><\/u><\/h4>\n
\n# iptables -A INPUT -p tcp –dport 636 -j ACCEPT<\/b><\/p>\n2) IP tables for SMTP \/ SMTPS
\n<\/b><\/u><\/h4>\n
\n\u00a0#iptables -A INPUT -p tcp –dport 465 -j ACCEPT<\/b><\/p>\n
\n-A INPUT -p tcp -m tcp –dport\u00a0 465 -j ACCEPT <\/b><\/p>\n3) iptables for POP3 \/ POP3S<\/b><\/u><\/h4>\n
\n\u00a0#iptables -A INPUT -p tcp –dport 995 -j ACCEPT<\/b><\/p>\n
\n-A INPUT -p tcp -m tcp –dport\u00a0 995 -j ACCEPT <\/b><\/p>\n4) iptables for IMAP \/ IMAPS<\/b><\/u><\/h4>\n
\n\u00a0#iptables -A INPUT -p tcp –dport 993 -j ACCEPT\u00a0 <\/b><\/p>\n
\n-A INPUT -p tcp -m tcp –dport\u00a0 993 -j ACCEPT <\/b><\/p>\n5) iptables for WEBMIN default port <\/b><\/u><\/h4>\n
6) IPtables for BIND \/NAMED\/ DNS<\/b><\/u><\/h4>\n
\n\u00a0#iptables -A INPUT -p udp –dport 53 -j ACCEPT\u00a0<\/b><\/p>\n
\n-A INPUT -p udp -m udp –dport\u00a0 53 -j ACCEPT <\/b><\/p>\n7) iptables\u00a0 for TFTP server<\/b> <\/u><\/h4>\n
8) iptable configuration for DHCP server<\/b><\/u><\/h4>\n
\n\u00a0#iptables -A INPUT -p udp –dport 68 -j ACCEPT
\n<\/b><\/p>\n
\n-A INPUT -p udp -m udp –dport\u00a0 68 -j ACCEPT <\/b><\/p>\n9) iptables\u00a0 for NTP server<\/b> <\/u><\/h4>\n
10) iptables for Apache HTTP \/ HTTPS<\/b><\/u><\/h4>\n
\n\u00a0#iptables -A INPUT -p tcp –dport 443 -j ACCEPT\u00a0 <\/b><\/p>\n
\n-A INPUT -p tcp -m tcp –dport\u00a0 443 -j ACCEPT <\/b><\/p>\n11) iptables\u00a0 for Squid Proxy server<\/b> <\/u><\/h4>\n
12) iptables\u00a0 for SNMP<\/b> <\/u><\/h4>\n
\n# iptables -A INPUT -p udp –dport 161 -j ACCEPT<\/b><\/p>\n13) iptables\u00a0 for SAMBA \/ SMBD NMBD WINBIND
\n<\/b><\/u><\/h4>\n
\n# iptables -A INPUT -d 10.1.1.1 -p udp –dport 138 -j DROP
\n# iptables -A INPUT -d 10.1.1.1 -p tcp –dport 139 -j DROP
\n# iptables -A INPUT -d 10.1.1.1 -p tcp –dport 445 -j DROP<\/p>\n