Iptables

Logging packets

The default ruleset that is installed on Red Hat and it's variants end in a line like this.

 -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

Which is good, but there is no way to know what it is rejecting! To log the same, add this line just above it

 -A RH-Firewall-1-INPUT -j LOG --log-prefix "REJECT-packet "

Now the rejected packets will be logged to /var/log/messages.

Default deny

The default firewall iptables ruleset (found in /etc/sysconfig/iptables)contains this last line...

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

This is good security practice but has a tendency to break things. Another line that appears above it has some nice consequences because it allows iptables to track state and allow inbound replies to established sessions, including UDP traffic (normally a stateless protocol).

-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Some more examples

Permit SNMP queries from a monitoring server w.x.y.z

-A RH-Firewall-1-INPUT -p udp -m udp --source w.x.y.z/32 --dport 161 -j ACCEPT

Permit NTP traffic from our NTP server w.x.y.z

-A RH-Firewall-1-INPUT -p udp -m udp --source w.x.y.z/32 --dport 123 -j ACCEPT

Permit ping and other ICMP traffic

-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT

Permit tcp connections to our SSH daemon (port 22) from the 10/8 subnet

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --source 10.0.0.0/8 --dport 22 -j ACCEPT