#Firewall builder classify example how to#
#Firewall builder classify example full#

Allow Outgoing SSH only to a Specific Network i.e We allow both the NEW and ESTABLISHED state on the OUTPUT chain, and only ESTABLISHED state on the INPUT chain. Please note that this is slightly different than the incoming rule. Iptables -A INPUT -i eth0 -p tcp -sport 22 -m state -state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o eth0 -p tcp -dport 22 -m state -state NEW,ESTABLISHED -j ACCEPT i.e When you ssh from inside to an outside server. The following rules allow outgoing ssh connection. Iptables -A OUTPUT -o eth0 -p tcp -m multiport -sports 22,80,443 -m state -state ESTABLISHED -j ACCEPT 8. iptables -A INPUT -i eth0 -p tcp -m multiport -dports 22,80,443 -m state -state NEW,ESTABLISHED -j ACCEPT The following example allows all incoming SSH, HTTP and HTTPS traffic. When you are allowing incoming connections from outside world to multiple ports, instead of writing individual rules for each and every port, you can combine them together using the multiport extension as shown below.

Combine Multiple Rules Together using MultiPorts Iptables -A OUTPUT -o eth0 -p tcp -sport 443 -m state -state ESTABLISHED -j ACCEPT 7. iptables -A INPUT -i eth0 -p tcp -dport 443 -m state -state NEW,ESTABLISHED -j ACCEPT The following rules allow all incoming secure web traffic. Iptables -A OUTPUT -o eth0 -p tcp -sport 80 -m state -state ESTABLISHED -j ACCEPT iptables -A INPUT -i eth0 -p tcp -dport 80 -m state -state NEW,ESTABLISHED -j ACCEPT The following rules allow all incoming web traffic.

#Firewall builder classify example full#

In the above example, instead of /24, you can also use the full subnet mask. iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 -dport 22 -m state -state NEW,ESTABLISHED -j ACCEPT The following rules allow incoming ssh connections only from network.

Allow Incoming SSH only from a Specific Network

#Firewall builder classify example how to#

Note: If you like to understand exactly what each and every one of the arguments means, you should read How to Add IPTables Firewall Rules 5. Iptables -A OUTPUT -o eth0 -p tcp -sport 22 -m state -state ESTABLISHED -j ACCEPT iptables -A INPUT -i eth0 -p tcp -dport 22 -m state -state NEW,ESTABLISHED -j ACCEPT The following rules allow ALL incoming ssh connections on eth0 interface. Iptables -A INPUT -i eth0 -p tcp -s '$BLOCK_THIS_IP' -j DROP 4. iptables -A INPUT -i eth0 -s '$BLOCK_THIS_IP' -j DROP You can also use one of the following variations, which blocks only TCP traffic on eth0 connection for this ip-address. This is helpful when you find some strange activities from a specific ip-address in your log files, and you want to temporarily block that ip-address while you do further research. Iptables -A INPUT -s '$BLOCK_THIS_IP' -j DROP Change the вЂњx.x.x.xвЂќ in the following example to the specific ip-address that you like to block. Block a Specific ip-addressД«efore we proceed further will other examples, if you want to block a specific ip-address, you should do that first as shown below. Note: If you donвЂ™t know what a chain means, you should first familiarize yourself with the IPTables fundamentals. i.e define rule only for incoming, as the outgoing is ACCEPT for all packets. In that case, for every firewall rule requirement you have, you just have to define only one rule. i.e Do not DROP all outgoing packets by default. If you trust your internal users, you can omit the last line above. In all our examples below, we have two rules for each scenario, as weвЂ™ve set DROP as default policy for both INPUT and OUTPUT chain.