{"id":31,"date":"2017-10-10T05:08:00","date_gmt":"2017-10-10T05:08:00","guid":{"rendered":"https:\/\/linuxadmin.melberi.com\/uncategorized\/iptables-for-squid-samba-apache-ldap"},"modified":"2017-10-10T05:52:06","modified_gmt":"2017-10-10T05:52:06","slug":"iptables-for-squid-samba","status":"publish","type":"post","link":"https:\/\/www.melberi.com\/linuxadmin\/iptables\/iptables-for-squid-samba","title":{"rendered":"Iptables for Bind Squid Samba Apache Ldap Snmp Dhcp Smpt Webmin Tftp"},"content":{"rendered":"

Iptables Configuration Guide for Linux CentOS Fedora Lunux Redhat Ubuntu Debian for Bind, SSH, Squid, Samba, Apache, Ldap,\u00a0 Snmp, Dhcp, Smpt, SMTPS, Webmin, Tftp, HTTP HTTPS<\/p>\n

\"Iptables<\/div>\n

Iptables Basic Setup:<\/b><\/u><\/h2>\n

Here I have mentioned the basic configurations for enabling iptables in fedora linux.<\/p>\n

#iptables -L<\/b><\/div>\n

will list your current iptables configuration.<\/p>\n

1)\u00a0<\/b>To allow established sessions to receive traffic<\/p>\n

# iptables -A INPUT -m conntrack –ctstate ESTABLISHED,RELATED -j ACCEPT <\/b><\/p>\n

2) <\/b>You could start by blocking traffic, but you might be working over SSH, where you would need to allow SSH before blocking everything else.<\/p>\n

To allow incoming traffic on the default ssh port (22)<\/p>\n

# iptables -A INPUT -p tcp –dport 22 -j ACCEPT<\/b><\/p>\n

To allow incoming traffic on the default Squid port (3128)<\/p>\n

# iptables -A INPUT -p tcp –dport 3128 -j ACCEPT<\/b><\/p>\n

To allow incoming traffic on the default Apache port<\/p>\n

# iptables -A INPUT -p tcp –dport 80 -j ACCEPT<\/b><\/p>\n

To allow incoming traffic on the default samba port<\/p>\n

# iptables -A INPUT -p udp –dport 137 -j ACCEPT<\/b>
\n# iptables -A INPUT -p udp –dport 138 -j ACCEPT<\/b>
\n# iptables -A INPUT -p udp –dport 139 -j ACCEPT <\/b>
\n# iptables -A INPUT -p tcp –dport 139 -j ACCEPT<\/b>
\n# iptables -A INPUT -p tcp –dport 445 -j ACCEPT\u00a0\u00a0<\/b><\/p>\n

To allow incoming traffic on the default SNMP port\u00a0 (161)<\/p>\n

# iptables -A INPUT -p tcp –dport 161 -j ACCEPT<\/b>
\n# iptables -A INPUT -p udp –dport 161 -j ACCEPT<\/b><\/p>\n

Now check the current configuration<\/p>\n

# iptables -L<\/b>
\nChain INPUT (policy ACCEPT)<\/b>
\ntarget\u00a0\u00a0\u00a0\u00a0 prot opt source\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 destination<\/b>
\nACCEPT\u00a0\u00a0\u00a0\u00a0 all\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 state RELATED,ESTABLISHED
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp dpt:http
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 udp dpt:netbios-ns
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 udp dpt:netbios-dgm
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 udp dpt:netbios-ssn
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp dpt:netbios-ssn
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp dpt:snmp
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 udp dpt:snmp
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp dpt:microsoft-ds
\nACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp dpt:squid<\/div>\n

3)<\/b> Once we enabled the above port.we can drop all other incoming ports.<\/p>\n

# iptables -A INPUT -j DROP<\/b><\/p>\n

Now check the rule<\/p>\n

# iptables -L<\/b><\/div>\n

For Interface based access for eth0 specify -i eth0<\/b><\/p>\n

4)<\/b> In the final step we have to enable loopback interface. After all the traffic has been dropped. We need to insert this rule before that. Since this is a lot of traffic, we’ll insert it as the first rule so it’s processed first.<\/p>\n

#iptables -I INPUT 1 -i lo -j ACCEPT<\/b><\/p>\n

5)<\/b> To enabling logging<\/p>\n

# iptables -I INPUT 5 -m limit –limit 5\/min -j LOG –log-prefix “iptables denied: ” –log-level 7<\/b><\/p>\n

6)<\/b> To save this configuration<\/p>\n

# iptables-save >\u00a0 \/etc\/sysconfig\/iptables<\/b>
\nor <\/b>
\n#service iptables save\u00a0 <\/b>
\n<\/b><\/div>\n
#service iptables start<\/b><\/div>\n

This configuration will enable ssh port and disable all other incoming ports.<\/p>\n

To manually edit iptables config<\/a><\/p>\n

Also you can manual edit\u00a0 \/etc\/sysconfig\/iptables<\/p>\n

IP Tables configuration for other Services<\/b><\/u><\/h3>\n

1) Iptables\u00a0 for LDAP \/ LDAPS \/ OPENLDAP
\n<\/b><\/u><\/h4>\n

# iptables -A INPUT -p tcp –dport 389 -j ACCEPT<\/b>
\n# iptables -A INPUT -p tcp –dport 636 -j ACCEPT<\/b><\/p>\n

or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n

-A INPUT -p tcp -m tcp –dport\u00a0 389 -j ACCEPT <\/b><\/p>\n

2) IP tables for SMTP \/ SMTPS
\n<\/b><\/u><\/h4>\n

\u00a0#iptables -A INPUT -p tcp –dport 25 -j ACCEPT<\/b>
\n\u00a0#iptables -A INPUT -p tcp –dport 465 -j ACCEPT<\/b><\/p>\n

or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n

-A INPUT -p tcp -m tcp –dport\u00a0 25 -j ACCEPT\u00a0<\/b>
\n-A INPUT -p tcp -m tcp –dport\u00a0 465 -j ACCEPT <\/b><\/p>\n

3) iptables for POP3 \/ POP3S<\/b><\/u><\/h4>\n

\u00a0#iptables -A INPUT -p tcp –dport 110 -j ACCEPT<\/b>
\n\u00a0#iptables -A INPUT -p tcp –dport 995 -j ACCEPT<\/b><\/p>\n

or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n

-A INPUT -p tcp -m tcp –dport\u00a0 110 -j ACCEPT <\/b>
\n-A INPUT -p tcp -m tcp –dport\u00a0 995 -j ACCEPT <\/b><\/p>\n

4) iptables for IMAP \/ IMAPS<\/b><\/u><\/h4>\n

\u00a0#iptables -A INPUT -p tcp –dport 143 -j ACCEPT<\/b>
\n\u00a0#iptables -A INPUT -p tcp –dport 993 -j ACCEPT\u00a0 <\/b><\/p>\n

or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n

-A INPUT -p tcp -m tcp –dport\u00a0 143 -j ACCEPT <\/b>
\n-A INPUT -p tcp -m tcp –dport\u00a0 993 -j ACCEPT <\/b><\/p>\n

5) iptables for WEBMIN default port <\/b><\/u><\/h4>\n

\u00a0#iptables -A INPUT -p tcp –dport 10000 -j ACCEPT<\/b><\/p>\n

or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n

-A INPUT -p tcp -m tcp –dport\u00a0 1000 -j ACCEPT <\/b><\/p>\n

6) IPtables for BIND \/NAMED\/ DNS<\/b><\/u><\/h4>\n

\u00a0#iptables -A INPUT -p tcp –dport 53 -j ACCEPT<\/b>
\n\u00a0#iptables -A INPUT -p udp –dport 53 -j ACCEPT\u00a0<\/b><\/p>\n

or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n

-A INPUT -p tcp -m tcp –dport\u00a0 53 -j ACCEPT <\/b>
\n-A INPUT -p udp -m udp –dport\u00a0 53 -j ACCEPT <\/b><\/p>\n

7) iptables\u00a0 for TFTP server<\/b> <\/u><\/h4>\n

\u00a0#iptables -A INPUT -p udp –dport 69 -j ACCEPT <\/b><\/p>\n

or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n

-A INPUT -p udp -m udp –dport\u00a0 69 -j ACCEPT <\/b><\/p>\n

8) iptable configuration for DHCP server<\/b><\/u><\/h4>\n

#iptables -A INPUT -p udp –dport 67 -j ACCEPT\u00a0<\/b>
\n\u00a0#iptables -A INPUT -p udp –dport 68 -j ACCEPT
\n<\/b><\/p>\n

or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n

-A INPUT -p udp -m udp –dport\u00a0 67 -j ACCEPT <\/b>
\n-A INPUT -p udp -m udp –dport\u00a0 68 -j ACCEPT <\/b><\/p>\n

9) iptables\u00a0 for NTP server<\/b> <\/u><\/h4>\n

\u00a0#iptables -A INPUT -p udp –dport 123 -j ACCEPT <\/b><\/p>\n

or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n

-A INPUT -p udp -m udp –dport\u00a0 123 -j ACCEPT <\/b><\/p>\n

10) iptables for Apache HTTP \/ HTTPS<\/b><\/u><\/h4>\n

\u00a0#iptables -A INPUT -p tcp –dport 80 -j ACCEPT<\/b>
\n\u00a0#iptables -A INPUT -p tcp –dport 443 -j ACCEPT\u00a0 <\/b><\/p>\n

or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n

-A INPUT -p tcp -m tcp –dport 80 -j ACCEPT <\/b>
\n-A INPUT -p tcp -m tcp –dport\u00a0 443 -j ACCEPT <\/b><\/p>\n

11) iptables\u00a0 for Squid Proxy server<\/b> <\/u><\/h4>\n

\u00a0#iptables -A INPUT -p tcp –dport 3128 -j ACCEPT <\/b><\/p>\n

or manually edit \/etc\/sysconfig\/iptables and add the below mentioned line<\/p>\n

-A INPUT -p tcp -m tcp –dport 3128 -j ACCEPT <\/b><\/p>\n

12) iptables\u00a0 for SNMP<\/b> <\/u><\/h4>\n

# iptables -A INPUT -p tcp –dport 161 -j ACCEPT<\/b>
\n# iptables -A INPUT -p udp –dport 161 -j ACCEPT<\/b><\/p>\n

13) iptables\u00a0 for SAMBA \/ SMBD NMBD WINBIND
\n<\/b><\/u><\/h4>\n

# iptables -A INPUT -d 10.1.1.1 -p udp –dport 137 -j DROP
\n# iptables -A INPUT -d 10.1.1.1 -p udp –dport 138 -j DROP
\n# iptables -A INPUT -d 10.1.1.1 -p tcp –dport 139 -j DROP
\n# iptables -A INPUT -d 10.1.1.1 -p tcp –dport 445 -j DROP<\/p>\n

 <\/p>\n

For Other Services<\/span><\/strong><\/p>\n

NFS, SSH, FTP Refer the below Related Post Links.<\/p>\n","protected":false},"excerpt":{"rendered":"

Iptables Configuration Guide for Linux CentOS Fedora Lunux Redhat Ubuntu Debian for Bind, SSH, Squid, Samba, Apache, Ldap,\u00a0 Snmp, Dhcp, Smpt, SMTPS, Webmin, Tftp, HTTP HTTPS Iptables Basic Setup: Here… Read more »<\/a><\/p>\n","protected":false},"author":1,"featured_media":196,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[104],"tags":[],"class_list":["post-31","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-iptables"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t