Moxa DA-682A-C7-DPP [42/108] Attention

DA-682A-DPP Linux Software Managing Communications

3-24

WARNING

For all firewalls using a strict DROP policy on incoming packets, be sure to include a rule that accepts packets

on the loopback interface:

moxa@Moxa:~# iptables –A INPUT –i lo –j ACCEPT

Examples:

REQUIRED RULE for all firewalls:

Accept all packets from the loopback interface:

# iptables –A INPUT –i lo –j ACCEPT

RECOMMENDED RULE from the sample firewall provided in Appendix C: Sample Scripts:

Allow all traffic from that belongs to established connections, or new, related traffic:

# iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

RECOMMENDED RULE from the sample firewall provided in Appendix C: Sample Scripts:

Drops all traffic with an invalid state, e.g. “Port Unreachable” when nothing was sent to the host, invalid

headers or checksums, and out-of-sequence packets:

# iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

Basic Filter Rules show examples of how you can open commonly opened ports:

Web server / HTTP:

# iptables -A INPUT -p tcp --dport 80 -j ACCEPT

Secure-sockets web server / HTTPS:

# iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Remote SSH Connections (REQUIRED RULE):

# iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Incoming UDP Streams:

# iptables -A INPUT -p udp --dport 53 -j ACCEPT

ATTENTION

ICMPv6 Neighbor Discovery packets will always be classified INVALID (if

you don’t know what this means, you

can probably ignore it). You may accept them with this rule:

# iptables -A INPUT -p 41 -j ACCEPT

Example 1: Accept TCP packets from 192.168.0.1.

# iptables –A INPUT –i eth0 –p tcp –s 192.168.0.1 –j ACCEPT

Example 2: Accept TCP packets from Class C network 192.168.1.0/24.

# iptables –A INPUT –i eth0 –p tcp –s 192.168.1.0/24 –j ACCEPT

Example 3: Drop TCP packets from 192.168.1.25 (this rule is only necessary on firewalls where you have set

the INPUT policy to ACCEPT; this is not recommended).

# iptables –A INPUT –i eth0 –p tcp –s 192.168.1.25 –j DROP

Example 4: ACCEPT all TCP packets addressed for port 21.

# iptables –A INPUT –i eth0 –p tcp --dport 21 –j ACCEPT

Example 5: Accept TCP packets from 192.168.0.24 to DA-682A-DPP-LX’s port 137, 138, 139

# iptables –A INPUT –i eth0 –p tcp –s 192.168.0.24 --dport 137:139 –j ACCEPT

Example 7: Log TCP packets that visit DA-682A-DPP-LX’s port 25.

# iptables –A INPUT –i eth0 –p tcp --dport 25 –j LOG