Skip to main content
4 of 5
added iptable with option to apt-get update by opening ports 53 and 80
Joey
  • 117
  • 1
  • 2
  • 8

Iptables: Securing a Linux system by limiting all traffic to one static IP and loopback, using Iptables

I have a static IP (on my home pc), is it enough to secure a remote server for my own usage (from my home, static ip, to remote server) using the following rule?

# Allow all loopback (lo0) traffic and reject traffic
# to localhost that does not originate from lo0.
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT

#Allow traffic from address $STATIC_IP
-A INPUT -s $STATIC_IP -j ACCEPT
-A OUTPUT -d $STATIC_IP -j ACCEPT

#Reject everything else
-A INPUT -j REJECT
-A FORWARD -j REJECT
-A OUTPUT -j REJECT

COMMIT

Edit: This is my final Iptables per Egor Vasilyvev answer

# Allow all loopback (lo0) traffic and reject traffic
# to localhost that does not originate from lo0.
-A INPUT -i lo -j ACCEPT
-A OUTPUT -i lo -j ACCEPT

#Allow traffic from address $STATIC_IP
-A INPUT -s $STATIC_IP -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

#Reject everything else
-A INPUT -j REJECT
-A FORWARD -j REJECT
-A OUTPUT -j REJECT

COMMIT

Edit: Added rules to allow DNS and Apt-Get updates (ports 53 and 80)

*filter

#Allow all loopback (lo0) traffic and reject traffic
#to localhost that does not originate from lo0.
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

#Allow traffic from address X.X.X.X (replace with static ip)
-A INPUT -i eth0 -s X.X.X.X -j ACCEPT
-A OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

#Allow DNS
-A OUTPUT -o eth0 -p udp --dport 53 -j ACCEPT
-A INPUT -p udp --sport 53 -m conntrack --ctstate ESTABLISHED,RELATED -j 
ACCEPT

#Allow traffic from distro mirros
-A OUTPUT -o eth0 -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED,RELATED -j 
ACCEPT

#Reject everything else
-A INPUT -j DROP
-A FORWARD -j DROP
-A OUTPUT -j DROP

COMMIT
Joey
  • 117
  • 1
  • 2
  • 8