How to configure CentOS Iptables without getting locked out

Question

I am trying to apply these firewall rules:

/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -Z
/sbin/iptables -P INPUT DROP
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -p tcp ! --syn -j REJECT --reject-with tcp-reset
/sbin/iptables -A INPUT -m state --state INVALID -j DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp ! --syn -j REJECT --reject-with tcp-reset
/sbin/iptables -A OUTPUT -m state --state INVALID -j DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp ! --syn -j REJECT --reject-with tcp-reset
/sbin/iptables -A FORWARD -m state --state INVALID -j DROP
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT
/sbin/iptables -A FORWARD -i lo -o lo -j ACCEPT
/sbin/iptables -t mangle -F
/sbin/iptables -t mangle -X
/sbin/iptables -t mangle -Z
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
/sbin/iptables -t nat -F
/sbin/iptables -t nat -X
/sbin/iptables -t nat -Z
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 12443 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 11443 -j DROP
/sbin/iptables -A INPUT -p tcp --dport 11444 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 8447 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 8443 -j DROP
/sbin/iptables -A INPUT -p tcp --dport 8880 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 443 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 21 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 22 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 587 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 25 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 465 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 110 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 995 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 143 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 993 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 106 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 3306 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 5432 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 9008 -j DROP
/sbin/iptables -A INPUT -p tcp --dport 9080 -j DROP

/sbin/iptables -A INPUT -p udp --dport 137 -j DROP
/sbin/iptables -A INPUT -p udp --dport 138 -j DROP
/sbin/iptables -A INPUT -p tcp --dport 139 -j DROP
/sbin/iptables -A INPUT -p tcp --dport 445 -j DROP

/sbin/iptables -A INPUT -p udp --dport 1194 -j DROP




/sbin/iptables -A INPUT -p tcp --dport 26 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 53 -j ACCEPT
/sbin/iptables -A INPUT -p udp --dport 53 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 2095 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 2096 -j ACCEPT

/sbin/iptables -A INPUT -p udp --dport 465 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 26 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 37 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 43 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 113 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 465 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 873 -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp --dport 2089 -j ACCEPT

/sbin/iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

/sbin/iptables -A OUTPUT -p udp --dport 465 -j ACCEPT

/sbin/iptables -A OUTPUT -p udp --dport 873 -j ACCEPT




/sbin/iptables -A INPUT -p icmp --icmp-type 8/0 -j DROP

/sbin/iptables -A INPUT -j DROP

/sbin/iptables -A OUTPUT -j ACCEPT

/sbin/iptables -A FORWARD -j DROP

However, when I copy and paste them into the command line I get locked out of the server (of course since the rules are being applied line by line). How do I apply these rules all at once since /sbin/iptables -P INPUT DROP is executed first, but the line to allow shell access comes after (I have removed this to protect my IP.

I'm not going to comment on the rules itself and/or wether they would work since my experience with iptables is limited. However, I've recently had a similar issue where I had in fact locked myself out of the server. One of the suggestions I received at the time was: make a cronjob to run every 5 minutes to stop iptabels (/etc/init.d/iptables stop). If you happen to lock yourself out, you'll be back in 5 minutes later. Not saying this is ideal either since stopping iptables will open your server up for everything you were trying to protect it from. — Jan Henckens, Aug 13 '11 at 17:49

score 4 · Accepted Answer · answered Aug 13 '11 at 17:23

I wouldn't be trying to run them by pasting them into the terminal. I'd scp them over and run them from a single script (could just be a bash script with them all pasted in.

With just around the amount of data you have there, i've had situations where pasting that into an ssh terminal has actually led to some loss of data (as in a couple of lines are missed). in something like this, that really isn't such a good idea. Obviously the likelyhood of that happening depends on the link quality and bandwidth.

Also if you're playing around with iptables and are afraid you might lock yourself out, set up a script to clear iptables (or set them to something you're happy works) and then set either a cron job to execute it, or have another window open while you're applying the rules and just do "sleep 100 && ./cleariptables" or something to that affect. Ctrl+c it when new rules have been successful and you're sure you can still log in. Always attempt to make a new ssh connection has you may have blocked new ssh connections and the current one is only working as it's already established

user9517 · Answer 2 · 2011-08-13T16:58:41.107

3

Try moving the /sbin/iptables -P INPUT DROP to the end of the file. If that doesn't work then save the rules to a file and then use the iptables-restore command.

sudo iptables-restore </file/you/created

Once you've done that save your rules to /etc/sysconfig/iptables

sudo /sbin/service iptables save

so that they get loaded when your system starts next.

If the iptables-restore doesn't work then saving the rules manually to /etc/sysconfig/iptables and restarting the service will work

sudo /sbin/service iptables restart

The input file to iptables-restore might be

*filter
-F
-X
-Z
-P INPUT DROP
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp ! --syn -j REJECT --reject-with tcp-reset
-A INPUT -m state --state INVALID -j DROP
# Add the rest of your INPUT/OUTPUT/FORWARD rules before the commit
COMMIT
*mangle 
-X
-F
-Z
-P PREROUTING ACCEPT
#Add the rest of the mangle rules
COMMIT
*nat
-X
#add the rest of your nat rules
COMMIT

edited Aug 13 '11 at 16:58

answered Aug 13 '11 at 16:17

user9517

116,228

I copied the above rules into a file, but i get this message: iptables-restore: line 1 failed – cappuccino Aug 13 '11 at 19:05
I gave you the format of the file at the end of the answer. If you just copied the whole lot into a file, add #!/bin/bash at the top of the file, save it, make it executable and then run it. – user9517 Aug 13 '11 at 19:13
@Iain iptables-restore by default performs -F and -X. Policies are set using a special construct. Try perusing the output of iptables-save – pepoluan Aug 13 '11 at 19:35
@pepoluan: The format above also works and is easier to describe than the format used by iptables-save. – user9517 Aug 13 '11 at 19:51

score 2 · Answer 3 · answered Aug 13 '11 at 20:36

Another way not to get locked out is to load your new rules, sleep for x seconds and test during the sleep, then load the old rules that worked in case your new rules don't work.

# load_new_rules; sleep 120; load_old_rules

Good way to not lock yourself out when working on a remote firewall that you don't have remote console access to.

score 1 · Answer 4 · answered Aug 13 '11 at 19:33

1

On another linux box, configure via console all the iptables rules and policies. Save it to a file using iptables-save. Copy the file to your remote machine, and apply using:

iptables-apply -t 300 name-of-file

the 300 is the timeout. iptables-apply will apply all rules in the file, wait for your confirmation, and if no confirmation in 300 seconds, restores the previous rules and policies.

answered Aug 13 '11 at 19:33

pepoluan

5,138

2

iptables-apply isn't native to a CentOS system. – user9517 Aug 13 '11 at 20:02
1

Fortunately iptables-apply is a standalone Python script, so you can copy it from /usr/sbin/iptables-apply on a Debian system. Alternatively, get it from the iptables source: http://git.netfilter.org/iptables/tree/iptables/iptables-apply – Alastair Irvine May 12 '15 at 04:24
Jut to be picky - it's actually a bash script, and doesn't seem to work on CentOS, due to the lack of a /bin/tempfile binary. I tried replacing this in the iptables-apply script with "mktemp", but their operation appeared to be different enough that it wouldn't work... – ticktockhouse Oct 05 '15 at 14:00

score 1 · Answer 5 · answered Jan 12 '14 at 17:26

Here is what I do:

1.) Never save iptables rules "service iptables save" so if you ever block yourself, a reboot will not load the same bad rules again before you have a chance to reconnect and correct the problem. This, of course, will require a manual load your rules after each reboot. An alternative approach would be to go ahead and save the rules, but not setting up the iptables service to start upon system start and then manually starting the service after each reboot.

2.) Add some rules near the top of the ruleset to always accept connections from a few host ranges that are semi-safe (your home/office) so any following rules added will never block you:

iptables -A INPUT -s 83.225.0.0/16 -j ACCEPT
iptables -A INPUT -s 75.102.0.0/16 -j ACCEPT
iptables -A INPUT -s 37.122.0.0/16 -j ACCEPT

score 0 · Answer 6 · edited Apr 01 '22 at 02:40

You need try to restore your iptables with this command

NAME        
       iptables-restore — Restore IP Tables
   ip6tables-restore — Restore IPv6 Tables

SYNOPSIS         top
       iptables-restore [-chntvV] [-w secs] [-W usecs] [-M modprobe] [-T
       name] [file]
   ip6tables-restore [-chntvV] [-w secs] [-W usecs] [-M modprobe]
   [-T name] [file]

DESCRIPTION         top
       iptables-restore and ip6tables-restore are used to restore IP and
       IPv6 Tables from data specified on STDIN or in file. Use I/O
       redirection provided by your shell to read from a file or specify
       file as an argument.
   -c, --counters
          restore the values of all packet and byte counters

   -h, --help
          Print a short option summary.

   -n, --noflush
          don't flush the previous contents of the table. If not
          specified, both commands flush (delete) all previous
          contents of the respective table.

   -t, --test
          Only parse and construct the ruleset, but do not commit
          it.

   -v, --verbose
          Print additional debug info during ruleset processing.

   -V, --version
          Print the program version number.

   -w, --wait [seconds]
          Wait for the xtables lock.  To prevent multiple instances
          of the program from running concurrently, an attempt will
          be made to obtain an exclusive lock at launch.  By
          default, the program will exit if the lock cannot be
          obtained.  This option will make the program wait
          (indefinitely or for optional seconds) until the exclusive
          lock can be obtained.

   -W, --wait-interval microseconds
          Interval to wait per each iteration.  When running latency
          sensitive applications, waiting for the xtables lock for
          extended durations may not be acceptable. This option will
          make each iteration take the amount of time specified. The
          default interval is 1 second. This option only works with
          -w.

   -M, --modprobe modprobe_program
          Specify the path to the modprobe program. By default,
          iptables-restore will inspect /proc/sys/kernel/modprobe to
          determine the executable's path.

   -T, --table name
          Restore only the named table even if the input stream
          contains other ones.

How to configure CentOS Iptables without getting locked out

6 Answers6