IPTables configuration help
- by Sam
I'm after some help with setting up IPTables. Mostly the configuration is working, but regardless of what I try I cannot allow localhost to access the local Apache only (i.e. localhost to access localhost:80 only).
Here is my script:
!/bin/bash
Allow root to access external web and ftp
iptables -t filter -A OUTPUT -p tcp --dport 21 --match owner --uid-owner 0 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 80 --match owner --uid-owner 0 -j ACCEPT
Allow DNS queries
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
Allow in and outbound SSH to/from any server
iptables -A INPUT -p tcp -s 0/0 --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp -d 0/0 --sport 22 -j ACCEPT
Accept ICMP requests
iptables -A INPUT -p icmp -s 0/0 -j ACCEPT
iptables -A OUTPUT -p icmp -d 0/0 -j ACCEPT
Accept connections from any local machines but disallow localhost access to networked machines
iptables -A INPUT -s 10.0.1.0/24 -j ACCEPT
iptables -A OUTPUT -d 10.0.1.0/24 -j DROP
Drop ALL other traffic
iptables -A OUTPUT -p tcp -d 0/0 -j DROP
iptables -A OUTPUT -p udp -d 0/0 -j DROP
Now I have tried many permutations and I'm obviously missing everything. I place them above the in/out bound SSH to/from, so it's not the precedence order.
If someone could give me the heads up on allowing only the local machine to access the local web server, that'd be great.
Cheers guys.
