How do you set up your iptables?

opethdisciple · 20 Feb 2017 at 22:19

Do you set the default policy to accept and then include at the bottom of the rules a reject all, or is it better to set the default policy to drop but then add in your exclusions?

Leads me on to a second question which I haven't got my head round yet. We are having some issues at work with an IPS deny/blocking/dropping packets between clients and servers which makes it a tad more complex to work out what effect my iptables are having on connectivity.

Scenario is this:

I deployed a web app that has a section where you can set up LDAP authentication, which I have done and is working. It is this part that the IPS is getting fussy about and sometimes logging in takes ages/times out and others times it works.

Anyway.....

So I set up the iptables like this:

Chain INPUT (policy DROP 2 packets, 72 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo any anywhere anywhere
49 5844 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:tproxy

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy DROP 774 packets, 55134 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any lo anywhere anywhere
33 5009 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED

My question is, LDAP is configured to use port 389 to the Active directory. Will I need to open up these ports in the OUTPUT chain or will the fact that I have specified that any connection that is initiated first is allowed out also cover these connections?

Hard to tell if it's the firewall blocking LDAP authentication or if the IPS is the issue.

opethdisciple · 21 Feb 2017 at 12:53

In order for my server to make LDAP connections over port 389 does it look like I would have to open up this port on the OUTPUT chain?

opethdisciple · 21 Feb 2017 at 19:50

What I ended up doing was this:

# iptables -P INPUT ACCEPT
# iptables -F
# iptables -A INPUT -i lo -j ACCEPT
# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# iptables -A INPUT -p tcp --dport 8081 -j ACCEPT
# iptables -P INPUT DROP
# iptables -P FORWARD DROP
# iptables -P OUTPUT ACCEPT

But as an inexperienced admin not quite sure WHY this works. the web app I deployed using port 8081. I understand that part. But the LDAP connection it makes to authenticate users uses port 389. Explicitly opening UDP and TCP port 389 was unsuccessful, but the iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT statement seems to work.

The LDAP connections are not happening on the local machine but to a remote Domain Controller.

Is this because it is saying if the new incoming connection is part of an established connection already (i.e traffic already coming in on port 8081) then allow it through?

Still puzzled as I would have though the out bound connections would the one the LDAP connection is making. And that was already set to OUTPUT ACCEPT.

Anyway, it seems to work. Just don't understand why.

opethdisciple · 24 Feb 2017 at 15:43

Would you say that adding in iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT could be considered something you should do as standard?