How to do things with iptables. Safety first: How to reset everything.
sudo iptables -F sudo iptables -X sudo iptables -t nat -F sudo iptables -t nat -X sudo iptables -t mangle -F sudo iptables -t mangle -X
Also, safety first: Don’t just copy something and run it on your server. You better understand what you are doing.
How to block a service?
Instead of using “DROP” you should use “REJECT –reject-with tcp-reset”. If you want to be able to access that service from the inside, you have to add an allow rule first.
Instead of using “DROP” you should use “REJECT –reject-with tcp-reset”. If you want to be able to access that service from the inside, you have to add an allow rule first.
sudo iptables -A INPUT -p tcp -s localhost --dport 3306 -j ACCEPT #mysql allow local sudo iptables -A INPUT -p tcp --dport 3306 -j REJECT --reject-with tcp-reset #mysql
The “REJECT –reject-with tcp-reset” looks to the outside like there is no service running. A “DROP” will show that there is a firewall / iptables working.
Blocking an IP range
sudo iptables -A bannedDownloader -s 14.120.0.0/16 -j DROP
Disallow NTP queries
sudo iptables -A INPUT -p udp -s localhost --dport 123 -j ACCEPT #ntp allow local sudo iptables -I INPUT -p udp --dport 123 -j REJECT #ntp
Block timestamp
sudo iptables -I INPUT 1 -p ICMP --icmp-type timestamp-request -j DROP sudo iptables -I INPUT 1 -p ICMP --icmp-type timestamp-reply -j DROP sudo iptables -A INPUT -p icmp --icmp-type 13 -j DROP
