Skip to main content

IPTABLE rules for a Secure App Host



Incoming Rules:

Re-route HTTP,HTTPS connections to different port:


 iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 8080
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 443 -j REDIRECT --to-port 8443

Allow IP block for SSH connection:

iptables -A INPUT -i eth1 -p tcp -s 10.190.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

Allow IP block for HTTP,HTTPS connection:

iptables -A INPUT -i eth1 -p tcp -m multiport --dports 8080,8443 -m state --state NEW,ESTABLISHED -j ACCEPT

Allow IP block for ICMP:

iptables -A INPUT -p icmp --icmp-type 8 -s 10.190.0.0/16 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Outgoing rules:

Allow outgoing DB connection:

iptables -A OUTPUT -o eth1 -p tcp -m tcp --dport 1521 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT  -i eth1 -p tcp -m tcp --sport 1521 -m state --state NEW,ESTABLISHED -j ACCEPT

Allow outgoing SSH,HTTP,HTTPS,SMTP connection:

iptables -A OUTPUT -o eth1 -p tcp -m multiport --dports 22,80,443,25,8080 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT  -i eth1 -p tcp -m multiport --sports 22,80,443,25,8080 -m state --state NEW,ESTABLISHED -j ACCEPT

Allow outgoing ICMP request:

iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp  --icmp-type echo-reply -j ACCEPT

Allow outgoing DNS connection:

iptables -A OUTPUT -p udp -o eth1 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -i eth1 --sport 53 -j ACCEPT

Allow outgoing FTP connection:

iptables -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT

 iptables -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT

Drop all other incoming traffic:

iptables -A INPUT -j LOG
iptables -A INPUT -j DROP
Labels:

Comments

Post a Comment

Popular posts from this blog

Nginx startup script

#!/bin/sh # # nginx - this script starts and stops the nginx daemon # # chkconfig:   - 85 15 # description:  NGINX is an HTTP(S) server, HTTP(S) reverse \ #               proxy and IMAP/POP3 proxy server # processname: nginx # config:      /etc/nginx/nginx.conf # config:      /etc/sysconfig/nginx # pidfile:     /var/run/nginx.pid # Source function library. . /etc/rc.d/init.d/functions # Source networking configuration. . /etc/sysconfig/network # Check that networking is up. [ "$NETWORKING" = "no" ] && exit 0 nginx="/usr/local/nginx/sbin/nginx" prog=$(basename $nginx) NGINX_CONF_FILE="/usr/local/nginx/conf/nginx.conf" [ -f /etc/sysconfig/nginx ] && . /etc/sysconfig/nginx lockfile=/var/lock/subsys/nginx make_dirs() {    # make required directories    user=`$nginx -V 2>&1 | grep "configure arguments:.*--user=" | sed...
Post a Comment
Read more

Tomcat NIO Connector and How to Configure It

In  HTTP 1.1 , all connections between the browser and the server are considered persistent unless declared otherwise. Persistence, in this context, means to use a single TCP connection to send and receive multiple HTTP requests/responses, as opposed to opening a new connection for every single request/response pair. In tomcat, the default HTTP connector is blocking and follows a one thread per connection model. This means that in order to serve 100 concurrent users, it requires 100 active threads. We end up wasting resources (the thread) because connections may not be used heavily, but just enough to avoid a timeout. Opposed to this is the relatively new NIO or non blocking connector. This connector has a couple of poller threads used to keep the connection alive for all connected users while worker threads are called whenever data (a new HTTP request) is available. This model leads to a much better sharing of resources (threads) and a larger number of concurrent users can ...
Post a Comment
Read more

Java + HTTPS: Unable to Find Valid Certification Path to Requested Target

Run  InstallCert.java , with your hostname and https port, and press “ 1 ” when ask for input. It will add your “localhost” as a trusted keystore, and generate a file named “ jssecacerts “. C : \ > java InstallCert localhost : 8443 Loading KeyStore C : \Program Files\Java\jre6\lib\security\cacerts . . . Opening connection to localhost : 8443 . . . Starting SSL handshake . . . javax . net . ssl . SSLHandshakeException : sun . security . validator . ValidatorException : PKIX path building failed : sun . security . provider . certpath . SunCertPathBuilderException : unable to find valid certification path to requested target at com . sun . net . ssl . internal . ssl . Alerts . getSSLException ( Unknown Source ) at com . sun . net . ssl . internal . ssl . SSLSocketImpl . fatal ( Unknown Source ) at com . sun . net . ssl . internal . ssl . Handshaker . fatalSE ( Unknown Source ) at com . sun . net . ssl . internal . ssl . Handshaker...
Post a Comment
Read more