Iptables 1.4.7 practical application

As needed, the following ports can be accessed from the Internet: 80, 14490, 14500, 14460, 14470, and 24461
External ports accessible to the server: 80 and 25
Considering the remote management interface, add port 22 and allow port 53 for Internet access. Allow loop back interface, icmp ping.
 
The specific configuration information is as follows: www.2cto.com
[Root @ localhost sysconfig] # iptables-V
Iptables v1.4.7
[Root @ localhost sysconfig] # iptables-S
-P INPUT DROP
-P FORWARD ACCEPT
-P OUTPUT DROP
-A input-I lo-j ACCEPT
-A input-m state -- state RELATED, ESTABLISHED-j ACCEPT
-A input-p tcp-m state -- state NEW-m tcp -- dport 22-j ACCEPT
-A input-p tcp-m state -- state NEW-m multiport -- dports 80, 14490, 14500,14460, 14470,24461-j ACCEP
-A input-p udp-m state -- state NEW-m multiport -- dports 14490,14500, 14460,14470, 24461-j ACCEPT
-A input-p icmp-m icmp -- icmp-type 8-j ACCEPT
-A input-p icmp-m icmp -- icmp-type 0-j ACCEPT
-A output-p icmp-j ACCEPT
-A output-o lo-j ACCEPT
-A output-m state -- state RELATED, ESTABLISHED-j ACCEPT
-A output-p tcp-m state -- state NEW-m tcp -- sport 22-j ACCEPT
-A output-p tcp-m state -- state NEW-m multiport -- dports 80, 25-j ACCEPT
-A output-p tcp-m state -- state NEW-m tcp -- dport 53-j ACCEPT
-A output-p udp-m state -- state NEW-m udp -- dport 53-j ACCEPT
-A output-p icmp-m icmp -- icmp-type 8-j ACCEPT
-A output-p icmp-m icmp -- icmp-type 0-j ACCEPT
 
Situations encountered in the process:
1. The domain name cannot be pinged. The problem was also found before, but there was no time for verification.
When output drop is found, you cannot telnet the dns port 53. Add entry:
-A output-p tcp-m state -- state NEW-m tcp -- dport 53-j ACCEPT
-A output-p udp-m state -- state NEW-m udp -- dport 53-j ACCEPT
Tcp and udp ports are included.
 
An error occurred while writing.
-A output-p udp-m state -- state NEW-m tcp -- dport 53-j ACCEPT
The entry is written incorrectly. The Protocol does not match the preceding and following parameters. However, when iptables is restarted, the last line of "COMMIT" error is reported. Sadly, you have to take it seriously!
 
2.-a input-m state -- state RELATED, ESTABLISHED-j ACCEPT
The entries here allow subsequent links that have established connections. You need to add them.
 
3.-a input-p tcp-m state -- state NEW-m tcp -- dport 22-j ACCEPT
Allow new connection
 
4. INPUT and OUTPUT can be separated in writing. Easy to view and troubleshoot.
 
5. restart: service iptables restart
Save: iptable-save>/etc/sysconfig/iptables
 
6. Some interfaces are allowed to be switched back.
-A input-I lo-j ACCEPT
-A output-o lo-j ACCEPT
 
7. Allow icmp
-A input-p icmp-m icmp -- icmp-type 8-j ACCEPT
-A input-p icmp-m icmp -- icmp-type 0-j ACCEPT
-A output-p icmp-m icmp -- icmp-type 8-j ACCEPT
-A output-p icmp-m icmp -- icmp-type 0-j ACCEPT
 
 
 
 
From the c371193852 blog