Keeping remote attackers out of a LAN is an important aspect of network security, if not the most important. The integrity of a LAN should be protected from malicious remote users through the use of stringent firewall rules. However, with a default policy set to block all incoming, outgoing, and forwarded packets, it is impossible for the firewall/gateway and internal LAN users to communicate with each other or externally. To allow users to perform network-related functions and use networking applications, administrators must open certain ports for communication.
For example, to allow access to port 80 on the firewall, append the following rule:
iptables -A INPUT -p tcp -m tcp --sport 80 -j ACCEPT iptables -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT |
This allows regular Web browsing from websites that communicate via port 80. To allow access to secure websites (such as https://www.example.com/), you must open port 443, as well.
iptables -A INPUT -p tcp -m tcp --sport 443 -j ACCEPT iptables -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT |
There may be times when you require remote access to the LAN from outside the LAN. Secure services, such as SSH and CIPE, can be used for encrypted remote connection to LAN services. For administrators with PPP-based resources (such as modem banks or bulk ISP accounts), dialup access can be used to circumvent firewall barriers securely, as modem connections are typically behind a firewall/gateway because they are direct connections. However, for remote users with broadband connections, special cases can be made. You can configure IPTables to accept connections from remote SSH and CIPE clients. For example, to allow remote SSH access, the following rules may be used:
iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A OUTPUT -p udp --sport 22 -j ACCEPT |
CIPE connection requests from the outside can be accepted with the following command (replacing x with your device number):
iptables -A INPUT -p udp -i cipcbx -j ACCEPT iptables -A OUTPUT -p udp -o cipcbx -j ACCEPT |
Since CIPE uses its own virtual device which transmits datagram (UDP) packets, the rule allows the cipcb interface for incoming connections, instead of source or destination ports (though they can be used in place of device options). For information about using CIPE, refer to Chapter 6 Virtual Private Networks.
There are other services for which you may need to define rules. Refer to the Red Hat Enterprise Linux Reference Guide for comprehensive information on IPTables and its various options.
These rules allow access to regular and secure services on the firewall; however, they do not allow nodes behind the firewall access to these services. To allow LAN access to these services, you can use NAT with IPTables filtering rules.