Join Log in
Score:0
avatar Server

Simplify iptables rule set

cn flag
Kevin Hamilton

I would like to simplify the current IPTABLES rule set for my mail server. I am using IPSET to create an extensive list of IP addresses to block then referencing that list in iptables. However, in my case there are only 5 subnets that need to communicate with the email server, so I thought it might be easier to block all access and then explicitly allow just the subnets that are needed. Let's assume the 5 subnets are 1.1.1.0/24, 2.2.2.0/24, 3.3.3.0/24, 4.4.4.0/24 and 5.5.50/24. I'm not worried about nailing traffic down to specific ports because I control the devices on these subnets. Can anyone please suggest a basic iptables config to accomplish this?

Thank you, Kevin

27
0 + 0
ng flag
Halfgaar
I don't know IPSET, but that's the default way of using iptables. Just set a policy of DROP in the input and allow ESTABLISHED, and your subnets. And don't forget IPv6. You have then potentially open still.
0
Reply
Score:0
Zareh Kasparian avatar Server
us flag
Zareh Kasparian

It should look something like this. I have named your 5 subnets as Subnet-X.X.X.X

-A INPUT -m set --match-set Subnet-1.1.1.1 src -j Accept
-A INPUT -m set --match-set Subnet-2.2.2.2 src -j Accept
-A INPUT -m set --match-set Subnet-3.3.3.3 src -j Accept
-A INPUT -m set --match-set Subnet-4.4.4.4 src -j Accept
-A INPUT -m set --match-set Subnet-5.5.5.5 src -j Accept
-A INPUT -j DROP

Make sure your source IP is included in any of these subnets, otherwise your packet will be dropped. or you may add another rule and incase if your IP is static make your IP defined as ACCEPTED source.

Also make sure to have console access available, in case if something goes wrong, to flush your iptables rules.

0 + 0
Score:0
avatar Server
cn flag
Kevin Hamilton

Thank you very much for your answer. Actually I would prefer NOT to use ipset so I can keep the config as simple as possible. For example, would the following work?

-A INPUT -s 1.1.1.0/24 -j ACCEPT

-A INPUT -s 2.2.2.0/24 -j ACCEPT

-A INPUT -s 3.3.3.0/24 -j ACCEPT

-A INPUT -s 4.4.4.0/24 -j ACCEPT

-A INPUT -s 5.5.5.0/24 -j ACCEPT

-A INPUT -j DROP

I apologize for what is probably very basic question, but this is a live server and I want to be very careful.

Thanks, Kevin

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.