CODEWITHSUNDEEP
linuxfirewalliptables
exxodus7
exxodus7

Reputation: 562

Creating firewall rules using iptables

Is there any way to construct a firewall rule using "iptables" which filters packets on both input and output? I've only been able to find rules like the following which allow you to designate it as applying to packet source (INPUT) or destination (OUTPUT).

iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 80 -j DROP.

It would make sense though that I should be able to filter packets coming from and going to specific places so that I could end up with a fw table like the following:

pkts bytes target     prot opt in     out     source               destination
   0     0 ACCEPT     all  --  *      *       172.152.4.0/24       92.3.0.0/16

Any suggestions?

Thanks!

Upvotes: 0

Views: 3076

Answers (1)

0range
0range

Reputation: 2158

Yes and no.

No because: iptables works by defining how to treat packets based on their categorization into chains (INPUT, OUTPUT, FORWARD, ...) first and only then also on specific characteristics (source or destination address, protocol type, source or destination port, etc). You can never define an iptable rule that does not apply to a specific chain.

INPUT, OUTPUT, and FORWARD are the default chains of the iptables system. INPUT addresses everything with destination localhost (i.e. that is addressed to your network device); OUTPUT applies to everything with source localhost (i.e. that comes from your computer).

Yes because: You can define custom chains. You can do that like so

sudo iptables -N MYCHAIN

then you can send packets from both the INPUT and the OUTPUT (and if you like the FORWARD) chain to MYCHAIN, for instance all the TCP packages from INPUT:

sudo iptables -A INPUT -p tcp -j MYCHAIN

or all the packages from OUTPUT

sudo iptables -A OUTPUT -j MYCHAIN

and then you can define any rule you want for mychain, including

sudo iptables -A MYCHAIN -s 172.152.4.0/24 -d 92.3.0.0/16 -j ACCEPT

which should be more or less the rule you wanted

However, one might argue that it does indeed make sense to keep INPUT and OUTPUT chains seperate. Most users will want to apply much stricter rules on INPUT and FORWARD than on OUTPUT. Also, iptables can be used for routing in which case it makes a fundamental difference if you have an incoming or an outgoing package.

Upvotes: 3

Related Questions