Ytdyklly

I'm following this guide here: http://isalazyadmin.net/2009/07/02/configuring-a-basic-firewall-for-debian-linux/

And I have the iptables listed shown, but my server still appears to be accepting all incoming connections (ie: bittorrent peers are still connecting, even though I didn't allow those ports).

/etc/iptables.rules

*filter



# This will allow all loopback (lo0) traffic and drop all traffic to 127/8

# that does not use lo0

-A INPUT -i lo -j ACCEPT

-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT



#  This accepts all already established connections

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT



# This allows all outbound traffic

-A OUTPUT -j ACCEPT



# This will allow HTTP and HTTPS connections from anywhere, this are the normal

# ports used for a web server

-A INPUT -p tcp --dport 80 -j ACCEPT

-A INPUT -p tcp --dport 443 -j ACCEPT



# Allow SSH connections

-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT



# Allow bittorrent/rtorrent ports, from ~/.rtorrent.rc

## -A INPUT -p tcp --dport 8071:8079 -j ACCEPT





# Allow ICMP ping

-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT



# Reject all other inbound traffic

-A INPUT -j REJECT

-A FORWARD -j REJECT



COMMIT

When I run iptables -L after a reboot, I still get this as my first rule:

iptables -L

Chain INPUT (policy ACCEPT)

target     prot opt source               destination         

ACCEPT     all  --  anywhere             anywhere  

Not sure where this is coming from.

Here is the full list:

Chain INPUT (policy ACCEPT)

target     prot opt source               destination         

ACCEPT     all  --  anywhere             anywhere            

REJECT     all  --  anywhere             loopback/8          reject-with icmp-port-unreachable 

ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www 

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 

ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 

REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 



Chain FORWARD (policy ACCEPT)

target     prot opt source               destination         

REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 



Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination         

ACCEPT     all  --  anywhere             anywhere

Here is the output of iptables-save:

# Generated by iptables-save v1.4.8 on Fri Jan 11 09:54:19 2013

*raw

:PREROUTING ACCEPT [6701:942626]

:OUTPUT ACCEPT [8927:989420]

COMMIT

# Completed on Fri Jan 11 09:54:19 2013

# Generated by iptables-save v1.4.8 on Fri Jan 11 09:54:19 2013

*nat

:PREROUTING ACCEPT [3281:284415]

:INPUT ACCEPT [9:720]

:OUTPUT ACCEPT [1758:148908]

:POSTROUTING ACCEPT [1758:148908]

COMMIT

# Completed on Fri Jan 11 09:54:19 2013

# Generated by iptables-save v1.4.8 on Fri Jan 11 09:54:19 2013

*mangle

:PREROUTING ACCEPT [6701:942626]

:INPUT ACCEPT [6701:942626]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [8928:989684]

:POSTROUTING ACCEPT [8928:989684]

COMMIT

# Completed on Fri Jan 11 09:54:19 2013

# Generated by iptables-save v1.4.8 on Fri Jan 11 09:54:19 2013

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -i lo -j ACCEPT 

-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable 

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 

-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 

-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT 

-A INPUT -j REJECT --reject-with icmp-port-unreachable 

-A FORWARD -j REJECT --reject-with icmp-port-unreachable 

-A OUTPUT -j ACCEPT 

COMMIT

# Completed on Fri Jan 11 09:54:19 2013

Here is the iptables -vL output:

$ sudo iptables -vL

[sudo] password for ettinger: 

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)

 pkts bytes target     prot opt in     out     source               destination         

 8303 1206K ACCEPT     all  --  lo     any     anywhere             anywhere            

    0     0 REJECT     all  --  !lo    any     anywhere             loopback/8          reject-with icmp-port-unreachable 

  12M 7191M ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED 

   18   980 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:www 

    7   344 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:https 

  379 22728 ACCEPT     tcp  --  any    any     anywhere             anywhere            state NEW tcp dpt:ssh 

18316 1110K ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpts:8071:8079 

 120K   15M ACCEPT     udp  --  any    any     anywhere             anywhere            udp dpt:6881 

24809 1489K ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:9001 

  688 35244 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:9030 

  874 73072 ACCEPT     icmp --  any    any     anywhere             anywhere            icmp echo-request 

12705  871K REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-port-unreachable 



Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

 pkts bytes target     prot opt in     out     source               destination         

    0     0 REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-port-unreachable 



Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)

 pkts bytes target     prot opt in     out     source               destination         

  14M   12G ACCEPT     all  --  any    any     anywhere             anywhere      

The line you are worried about:

Chain INPUT (policy ACCEPT)

target     prot opt source               destination         

ACCEPT     all  --  anywhere             anywhere       

is actually because of this in your rules:

-A INPUT -i lo -j ACCEPT

Notice the interface is explicit in the rule, but not in the -L output. Move that rule to the middle of the list, use iptables-restore and notice the "ACCEPT all -- anywhere" has moved down too. Now try changing the rule a bit:

-A INPUT -i lo -s 127.0.0.1 -j ACCEPT

and the -L output will become:

target     prot opt source                 destination  

ACCEPT     all  --  localhost.localdomain  anywhere

"localhost.localdomain" will be your 127.0.0.1 hostname from /etc/hosts. This at least makes it clearer where that rule came from.

You can also see more detailed information including the interfaces with iptables -vL.

BTW, you may want to start your rules:

*filter

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

:OUTPUT DROP [0:0]

Drop everything by default as a fall through for safety. This is considered bad manners, however (see the link in Gilles comment below), so you may want to create a final catch all for each table which uses -j REJECT --reject-with icmp-net-prohibited.

Just as a matter of completeness, in order to avoid this problem in future use the -v verbose command line option when displaying the table. As thus:

iptables -Lv

The output should now include the interface it affects in the "in" and "out" columns:

Chain INPUT (policy DROP 0 packets, 0 bytes)

 pkts bytes target     prot opt in     out     source               destination

  151 13073 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED

    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0

    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0

    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22

  126 33414 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Problem is in this part of INPUT chain:

Chain INPUT (policy ACCEPT)

target     prot opt source               destination         

ACCEPT     all  --  anywhere             anywhere

especially in the last line. Everything after this line is unnecesary, because this line accept everythink.

You have to delete this line from the rules by this command:

iptables -D INPUT 1

You have to inspect your firewall rules, where is rule, which adding this line.