Centos – Firewall rules for outgoing RSH connections

centosfirewallremote-access

I have a CentOS 6 server that needs rsh access to one of our old legacy servers which does not support ssh.

RSH connects to port 514 on the remote servers, which then creates another connection back to the client on a port between 512-1023. My current firewall skill level is "port open/port closed" and opening up all of them wouldn't leave much of a firewall. What's the most restrictive way to allow outgoing RSH connections?

Best Answer

I'd restrict the incoming from the range of servers using iptables -A INPUT --src {IP address or range}/{netmask} -m state --state NEW -m tcp -p tcp --dport 514:1023 -j ACCEPT.

You can then restrict the incoming port ranges to the right servers

Unless you need to restrict outgoing data from a specific server I would not worry about setting up outbound rules.

I use webmin to set up my basic rules then I copy them manually (its faster and it saves me from looking up all the information I don't use regularly). Webmin supports all sorts of rules--inbound, outbound and mangle. You can set webmin up on a test box then edit then write the rules and copy them to the proper server.

Related Solutions

Ubuntu – UFW Firewall Rules ordering

If you're interested in reordering your UFW rules, this is one way to do it.

$ sudo ufw status numbered

     To                         Action      From
     --                         ------      ----
[ 1] 22                         ALLOW IN    Anywhere
[ 2] 80                         ALLOW IN    Anywhere
[ 3] 443                        ALLOW IN    Anywhere
[ 4] 22 (v6)                    ALLOW IN    Anywhere (v6)
[ 5] 80 (v6)                    ALLOW IN    Anywhere (v6)
[ 6] 443 (v6)                   ALLOW IN    Anywhere (v6)
[ 7] Anywhere                   DENY IN     [ip-to-block]

Say you accidentally added a rule to the end, but you wanted up top.

First you will have remove it from the bottom (7) and add it back.

$ sudo ufw delete 7

Note, be careful of removing multiple rules one after another, their position can change!

Add back your rule to the very top (1):

$ sudo ufw insert 1 deny from [ip-to-block] to any

Linux – NTP client on CentOS 5 fails behind Cisco ASA firewall

You don't have the ASA configured to allow outgoing NTP traffic, so it doesn't. "Related/established" traffic refers to in-progress traffic, such as incoming replies from NTP servers, not newly initiated traffic, so it doesn't apply here.

To resolve the issue, add rules for the appropriate groups to allow outgoing NTP traffic. For example:

access-list NEPLAN extended permit udp any any eq 123

Best Answer

Related Solutions

Ubuntu – UFW Firewall Rules ordering

Linux – NTP client on CentOS 5 fails behind Cisco ASA firewall

Related Topic