Problems about iptables
*filter
Allow all loopback (lo0) traffic and reject traffic
to localhost that does not originate from lo0.
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
Allow ping.
-A INPUT -p icmp -m state –state NEW --icmp-type 8 -j ACCEPT
Allow SSH connections.
-A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
Allow HTTP and HTTPS connections from anywhere
(the normal ports for web servers).
-A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
-A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT
Allow inbound traffic from established connections.
This includes ICMP error returns.
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Log what was incoming but denied (optional but useful).
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptablesINPUTdenied: " --log-level 7
Reject all other inbound.
-A INPUT -j REJECT
Log any traffic which was sent to you
for forwarding (optional but useful).
-A FORWARD -m limit --limit 5/min -j LOG --log-prefix "iptablesFORWARDdenied: " --log-level 7
Reject all traffic forwarding.
-A FORWARD -j REJECT
COMMIT
Then run the command:
sudo iptables-restore < /tmp/v4
But now I want to set up shadowsocks server side on the node, I must accept the port number for 8388 like this:
*filter
Allow all loopback (lo0) traffic and reject traffic
to localhost that does not originate from lo0.
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
Allow ping.
-A INPUT -p icmp -m state --state NEW --icmp-type 8 -j ACCEPT
Allow SSH connections.
-A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
Allow HTTP and HTTPS connections from anywhere
(the normal ports for web servers).
-A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
-A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT
-A INPUT -p tcp --dport 8388 -m state --state NEW -j ACCEPT // This item is added by me
Allow inbound traffic from established connections.
This includes ICMP error returns.
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Log what was incoming but denied (optional but useful).
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptablesINPUTdenied: " --log-level 7
Reject all other inbound.
-A INPUT -j REJECT
Log any traffic which was sent to you
for forwarding (optional but useful).
-A FORWARD -m limit --limit 5/min -j LOG --log-prefix "iptablesFORWARDdenied: " --log-level 7
Reject all traffic forwarding.
-A FORWARD -j REJECT
COMMIT
After running the iptables-restore command, the problem is out, my web service is rejected, it means that the port 80 is ban.
I don't know why I just added one single item to the iptable rule, then the other port was ban.
I hope someone can help me to fix, I want both the port 8388 and the web service are working, thanks!
1 Reply
@xuchenyu:
-A INPUT -p tcp –dport 8388 -m state --state NEW -j ACCEPT // This item is added by me
Adding this line ought to do what you want, except that "//" cannot be used to designate comments.
The command iptables -nvL (run as root) will show you what your current firewall rules are.