ServerComputing: Firewall

Showing posts with label Firewall. Show all posts

Howto Open Port Range In iptables Firewall

Author

FREQUENTLY ASKED QUESTIONS (Firewall/iptables)

Q: How to open a port range in iptables firewall?

Opening a port range in iptables firewall for example open TCP ports40 to port 50. Run the below commands from terminal as root user.

Open a Port Range in iptables
[root@server~]# iptables -I INPUT -m state --state NEW -m tcp -p tcp --dport 40:50 -j ACCEPT

[root@server ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]

[root@server ~]# service iptables restart
iptables: Flushing firewall rules: [ OK ]
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Unloading modules: [ OK ]
iptables: Applying firewall rules: [ OK ]

Test the Opened ports
Check the opened ports by connecting to appropriate ports of the server. And also check all the changes are written to the iptables configuration file located in etc/sysconfig/iptables
[root@server ~]# cat /etc/sysconfig/iptables

Sample output displayed below

Check Related Posts:

Read more »

How to Open ports in iptables firewall

Author

No comments

FREQUENTLY ASKED QUESTIONS (Firewall/iptables)
Q: How to open a port in Firewall or iptables in Linux ?

The default iptables rules in a freshly installed linux OS (Fedora, Redhat, CentOS, etc) will allow only incomming SSH (Secure Shell) connections on port 22 TCP. And not allowing any FORWARD connections and allowing all OUTPUT connections. Check the below iptables example screenshot of a freshly installed Linux(CentOS 6)

[root@server ~]# cat /etc/sysconfig/iptables

Click on image to enlarge

To open port 80 TCP in linux iptables

After installing a web server in linux using Apache, you need to open port 80/TCP to listening to web requests. Run the commands below as root user.
[root@server ~]# iptables -I INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

[root@server ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]

[root@server ~]# service iptables restart
iptables: Flushing firewall rules: [ OK ]
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Unloading modules: [ OK ]
iptables: Applying firewall rules: [ OK ]

Check the screenshot below: Here the port 80 TCP is opened in server and listen to all requests from all clients.

[root@server ~]# cat /etc/sysconfig/iptables

Click on image to enlarge

Check Related Posts:

Read more »

Change iptables Default Policy to DROP

Author

1 comment

FREQUENTLY ASKED QUESTIONS (Firewall/iptables)
Q: How to change iptables default policy to DROP?

Default Iptables Chain Policy
The Default linux iptables chain policy is ACCEPT for all INPUT, FORWARD and OUTPUT policies. You can easily change this default policy to DROP with below listed commands.
You must login as a root user to run all the commands.
[root@server ~]# iptables -P INPUT DROP
[root@server ~]# iptables -P FORWARD DROP
[root@server ~]# iptables -P OUTPUT DROP

After changing the INPUT, FORWARD, OUTPUT policies to DROP, All the incomming/outgoing/forwarding connections are dropped(Denied) by firewall. So you need to open every INPUT, FORWARD, OUTPUT connections in firewall/iptables with rules. If you change the default OUTPUT policy to DROP you cannot communicate with other systems/networks .

Allow All Outgoing connections
Allow all outgoing connections from the Linux machine. This applicable to all connections/packets generated from the system itself.
[root@server ~]# iptables -A OUTPUT -j ACCEPT

[root@server ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]

[root@server ~]# service iptables restart

iptables: Flushing firewall rules: [ OK ]
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Unloading modules: [ OK ]
iptables: Applying firewall rules: [ OK ]

Open Ports for incoming connections
For example open port 21 in iptables for allowing ftp connections from all networks.
[root@server~]# iptables -I INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

[root@server ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]

[root@server ~]# service iptables restart

iptables: Flushing firewall rules: [ OK ]
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Unloading modules: [ OK ]
iptables: Applying firewall rules: [ OK ]

Related Posts: