Filter Question: Only allow telnet, DNS, DHCP in

Michael Ellerbeck mellerbeck at NationalFrozenFoods.com
Wed Aug 31 17:57:04 CEST 2005


Running Devil Linux so iptables is version 1.2.11
 
Trying to setup rules that will only allow connections in on telnet,
DNS, and DHCP Also the telnet rule should only allow connections that
are destined for 10.0.0.1
 
So setting all initials chains to drop
{$IPTABLES} -P INPUT DROP
{$IPTABLES} -P OUTPUT DROP
{$IPTABLES} -P FORWARD DROP
 
$IPTABLES -A INPUT -p tcp -i eth1 -d 10.0.0.1 --dport 23 -m state
--state NEW,ESTABLISHED -j ACCEPT
 
Is it OK to do this on the INPUT? This box is also a router, will the
iptables happen before any routing happens. I guess my question is one
of order. When a packet comes in will it be handled by the iptables
INPUT first?
 
How can I safely allow outgoing packets?
 
To allow DNS and DHCP in can I do something like
 
$IPTABLES -A INPUT -p tcp -i eth1 --dport 53 -m state --state
NEW,ESTABLISHED -j ACCEPT #DNS $IPTABLES -A INPUT -p tcp -i eth1 --dport
67 -m state --state NEW,ESTABLISHED -j ACCEPT #DHCP $IPTABLES -A INPUT
-p tcp -i eth1 --dport 68 -m state --state NEW,ESTABLISHED -j ACCEPT
#DHCP
 
How can I allow these ports out?
 
Thank you for your help!
 
-Michael
 


More information about the netfilter mailing list