#Iptables netmap example how to#
#Iptables netmap example series#

Since this is for the response rule (for the corresponding incoming request) that goes out from the server, this should be OUTPUT.

iptables -A OUTPUT: Append the new rule to the OUTPUT chain.

iptables -A OUTPUT -o eth0 -p tcp -sport 22 -m state -state ESTABLISHED -j ACCEPT Next, Allow outgoing (ESTABLISHED state only) SSH connection response (for the corresponding incoming SSH connection request). ESTABLISHED state is used for all further request from the client to the server. The 1st time when a SSH connection request is initiated from the client to the server, NEW state is used. In this example, only NEW and ESTABLISHED states are allowed.

–state NEW, ESTABLISHED: Options for the “state” matching module.

We’ll discuss more about “-m” option (and all available matching modules for iptables) in future article.

-m state: This indicates that the “state” matching module is used.

–dport 22: This refers to the destination port for the incoming connection.

-p tcp: Indicates that this is for TCP protocol.

For incoming connections, this always has to be ‘-i’.

-i eth0: This refers to the input interface.

For incoming connection request, this always has to be INPUT.

iptables -A INPUT: Append the new rule to the INPUT chain.

iptables -A INPUT -i eth0 -p tcp -dport 22 -m state -state NEW,ESTABLISHED -j ACCEPT Once the incoming ssh connection is allowed, we also need to allow the response back for that incoming ssh connection.įirst, Allow incoming SSH connection request, as shown below. First, we need to allow incoming new SSH connections. i.e You can ssh to your server from outside. This is to allow SSH connection from outside to your server.

Response rule: This is for the response that goes out from the server to the client (for the corresponding incoming request).Request rule: This is the request that comes from the client to the server for the incoming connection.When the default policy is DROP for INPUT and OUTPUT chains, for every incoming firewall rule, you need to specify the following two rules. The allow ssh incoming connection rule will not work anymore, because all the outgoing packets are dropped. # iptables -Līut there is a problem here. Now, if you add the allow ssh rule: “iptables -A INPUT -i eth0 -p tcp –dport 22 -j ACCEPT”, and do iptables -L, you’ll notice that it says “(policy DROP)” next to all the three chains. Iptables -A FORWARD -j DROP Option 2: Change the default chain policy to DROPĪt the beginning, execute the following three commands that will change the chain’s default policy to DROP. If you do this, the default chain policy is still ACCEPT, which shouldn’t matter, as you are dropping all the packets at the end anyway. Option 1: Add drop rulesĪt the end, add the following three drop rules that will drop all incoming, outgoing, and forward packets (except those that are defined above these three rules). # iptables -LĪCCEPT tcp - anywhere anywhere tcp dpt:ssh This indicates that the default chain policy is ACCEPT. However, we didn’t restrict the outgoing traffic.Īs you notice below, it says “(policy ACCEPT)” next to all the three chain names (INPUT, OUTPUT, and FORWARD). In the above 3 steps we dropped all incoming packets at the end (except incoming ssh).

So, both the INPUT and OUTPUT chain’s default policy is ACCEPT. If you don’t what what a chain means, you better read our iptables introduction article. One problem with the above steps is that it doesn’t restrict the outgoing packets. Drop all other incoming packets: “iptables -A INPUT -j DROP”.Allow only incoming SSH: “iptables -A INPUT -i eth0 -p tcp –dport 22 -j ACCEPT”.Delete all existing rules: “iptables -F”.On a high-level, it involves following 3 steps.

#Iptables netmap example how to#

We also explained how to allow incoming SSH connection.

#Iptables netmap example series#

In our previous IPTables firewall series article, we reviewed how to add firewall rule using “iptables -A”.