With iptables only allow certain outbound ports

1

Okay, I'm running a router with shibby tomato (linux based) v1.28-115 and have a bridge network setup (br1) that consists of a guest wifi.

I want to only allow access to specific outbound ports... what do I need in my firewall script?

copy-paste issues, answering my own question

Tracker1

Posted 2013-11-26T07:42:01.900

Reputation: 563

I originally had my non-working script here.. it had some double --state entries, once I corrected the bad syntax, and adjusted the order, all was working, Answered my own question below. – Tracker1 – 2013-11-26T19:52:00.707

Answers

1

Here is my working script.. which may not be correct... I don't want to mess up rules outside this script in the rest of the config for nat/etc.. it's a consumer appliance and not wanting to put more than needed.

#default deny guest
iptables -I FORWARD -i br1 -j DROP

#Removes guest access to physical network
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP

#Removes guest access to the router's config GUI/ports
iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset

#guest allow dns to router
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT

#Guest - allow explicit ports
#Guest to ftp
iptables -I FORWARD -i br1 -p tcp --dport 21 -m state --state NEW -m limit --limit 4/min -j ACCEPT
#guest to ssh
iptables -I FORWARD -i br1 -p tcp --dport 22 -m state --state NEW -m limit --limit 4/min -j ACCEPT
#guest to telnet
iptables -I FORWARD -i br1 -p tcp --dport 23 -m state --state NEW -m limit --limit 4/min -j ACCEPT
#guest to smtp/smtp+ssl
#iptables -I FORWARD -i br1 -p tcp --dport 25 -m state --state NEW -m limit --limit 4/min -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 2525 -m state --state NEW -m limit --limit 4/min -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 465 -m state --state NEW -m limit --limit 4/min -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 587 -m state --state NEW -m limit --limit 4/min -j ACCEPT
#guest to pop3/ssl
iptables -I FORWARD -i br1 -p tcp --dport 110 -m state --state NEW -m limit --limit 16/min -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 995 -m state --state NEW -m limit --limit 16/min -j ACCEPT
#guest to imap/ssl
iptables -I FORWARD -i br1 -p tcp --dport 143 -m state --state NEW -m limit --limit 16/min -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 993 -m state --state NEW -m limit --limit 16/min -j ACCEPT
#guest http/https
iptables -I FORWARD -i br1 -p tcp --dport 80 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 8080 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 443 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 8443 -m state --state NEW -j ACCEPT

#Guest - allow established connections
iptables -I FORWARD -i br1 -m state --state RELATED,ESTABLISHED -j ACCEPT

Tracker1

Posted 2013-11-26T07:42:01.900

Reputation: 563