Linux – How to block everything with IPTABLES

iptableslinuxlinux-kernel

I would like to block everything EXCEPT SSH/FTP/HTTP/POSTFIX and MySQL.

With "everything" I mean all the other ports, block pings etc etc.

Best Answer

I'm guessing you mean incoming connections (the INPUT chain), and not forwarded ones (as in a router). Also I take postfix means just SMTP (25).

iptables -P INPUT ACCEPT
iptables -F INPUT

for port in 21 22 25 80 3306
do
  iptables -A INPUT -p tcp --dport $port -j ACCEPT
done

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -P INPUT DROP

Test your FTP connection in particular, you may need to enable ip_conntrack_ftp for it to work correctly without modifying the client settings.

Related Topic