Simple firewall

Share your own howto's etc. Not for support questions!

Simple firewall

Postby av88p » 2016-12-21 19:07

Obviously, simpliest firewall. This firewall drops all TCP connections, except those, which are computer's communication with computer itself (lo interface). Two versions. First - client only. Second - for server with port 46850. Comments are welcome.


iptables -F
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -m tcp --tcp-flags ALL SYN -j DROP


iptables -F
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 46850 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --tcp-flags ALL SYN -j DROP
Posts: 4
Joined: 2016-11-24 17:02

Re: Simple firewall

Postby Bulkley » 2016-12-21 21:35

You are missing three important ones. Try this:

Code: Select all
iptables -F
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Without the two drops you are wide open.

As always, I suggest you check your router's firewall and, if possible, choose the most secure option.
Posts: 5130
Joined: 2006-02-11 18:35

Re: Simple firewall

Postby Head_on_a_Stick » 2016-12-21 22:57

I use this:
Code: Select all
TheLab: ~ # cat /etc/nftables.conf                                                       
#!/usr/sbin/nft -f

flush ruleset

table inet filter {
        chain input {
                type filter hook input priority 0;

                # accept any localhost traffic
                iif lo accept

                # accept traffic originated from us
                ct state established,related accept

                # activate the following line to accept common local services
                #tcp dport { 22, 80, 443 } ct state new accept

                # accept neighbour discovery otherwise IPv6 connectivity breaks.
                ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit,  nd-router-advert, nd-neighbor-advert } accept

                # count and drop any other traffic
                counter drop

I find the syntax easier to understand :)
“Controlling complexity is the essence of computer programming."Brian Kernighan

Please read before posting How to report a problem
User avatar
Posts: 6491
Joined: 2014-06-01 17:46
Location: /dev/chair

Return to Docs, Howtos, Tips & Tricks

Who is online

Users browsing this forum: No registered users and 7 guests