Re: Minimal secure iptables firewall

I was trusting in local traffic, but you are ok. More restrictions,
more security (in general).

On 7/19/05, Security Admin <security@rbmail.de> wrote:
> Hi
>
> in my opinion it is not a good idea to leave output on accept. If
> somebody successfully runs an exploit on your machine, which tries to
> load a rootkit or something else from somewhere onto the box, it will
> fail if you restrict the access to outside...
>
> Greetings, Flo
>
> Carlos Costa schrieb:
>
> > Hello all:
> >
> > Suppose the typical situation where we have a web server we can
> > secure. What about this minimal iptables configuration?
> >
> > -A INPUT -i lo -j ACCEPT
> > -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
> > -A INPUT -s <admin_ip> -p tcp -m tcp --dport 22 -j ACCEPT
> > -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
> > -A INPUT -j DROP
> > -A FORWARD -j DROP
> > -A OUTPUT -j ACCEPT
> >
> > That is,
> > INPUT:
> > accept local
> > accept port 80
> > accept port 22 from admin_ip(s)
> > accept related and established connections ('related' could be
> > removed, since I don't permit ftp connections, imho)
> > deny all other connections
> >
> > FORWARD:
> > deny
> >
> > OUTPUT:
> > accept (I trust my webserver)
> >
> > Is this configuration secure? Am I miss something?
> >
> > Thank you very much,
> >   Carlos.


-- 
[ http://www.improveyourweb.com/ ]
web.log.about.web.development