iptables allow HTTP from anywhere, MySQL internally and lock SSH to a specific ip

Question

Having trouble getting my head around iptables rules

I need to:

• Allow HTTP traffic to 80 and 443 from anywhere
• Allow MySQL traffic 3306 internally
• Allow SSH access from a specific list of IP addresss

Any ideas?

Answer 1

According to fwbuilder (recommended) and a quick inspection, the following do ricks 1 and 3. Doing (2) depends strongly on your definition of "internal" (on interface, two interfaces, etc.)

$IPTABLES -N RULE_0
$IPTABLES -A INPUT -p tcp -m tcp  -s 1.2.3.4   --dport 22  -m state --state NEW  -j RULE_0
$IPTABLES -A FORWARD -p tcp -m tcp  -s 1.2.3.4   --dport 22  -m state --state NEW  -j RULE_0
$IPTABLES -A RULE_0  -j LOG  --log-level info --log-prefix "RULE 0 -- ACCEPT "
$IPTABLES -A RULE_0  -j ACCEPT
# 
# Rule 1 (global)
# 
echo "Rule 1 (global)"
# 
$IPTABLES -N RULE_1
$IPTABLES -A OUTPUT -p tcp -m tcp  -m multiport  --dports 80,443  -m state --state NEW  -j RULE_1
$IPTABLES -A INPUT -p tcp -m tcp  -m multiport  --dports 80,443  -m state --state NEW  -j RULE_1
$IPTABLES -A FORWARD -p tcp -m tcp  -m multiport  --dports 80,443  -m state --state NEW  -j RULE_1
$IPTABLES -A RULE_1  -j LOG  --log-level info --log-prefix "RULE 1 -- ACCEPT "
$IPTABLES -A RULE_1  -j ACCEPT

E.g. for a 192.168.1.0/254 internal network:

   $IPTABLES -N In_RULE_0
   $IPTABLES -A INPUT  -i eth0:1  -p tcp -m tcp  -s 192.168.1.0/24   -d 192.168.1.0/24    --dport 3306  -m state --state NEW  -j In_RULE_0
   $IPTABLES -A FORWARD  -i eth0:1  -p tcp -m tcp  -s 192.168.1.0/24   -d 192.168.1.0/24   --dport 3306  -m state --state NEW  -j In_RULE_0
   $IPTABLES -A In_RULE_0  -j LOG  --log-level info --log-prefix "RULE 0 -- ACCEPT "
   $IPTABLES -A In_RULE_0  -j ACCEPT
   $IPTABLES -N Out_RULE_0
   $IPTABLES -A OUTPUT  -o eth0:1  -p tcp -m tcp  -s 192.168.1.0/24   -d 192.168.1.0/24   --dport 3306  -m state --state NEW  -j Out_RULE_0
   $IPTABLES -A FORWARD  -o eth0:1  -p tcp -m tcp  -s 192.168.1.0/24   -d 192.168.1.0/24   --dport 3306  -m state --state NEW  -j Out_RULE_0
   $IPTABLES -A Out_RULE_0  -j LOG  --log-level info --log-prefix "RULE 0 -- ACCEPT "
   $IPTABLES -A Out_RULE_0  -j ACCEPT