IPTABLES: need to grant certain IP address full access

[stevenriz]

Hi, this is an IPTABLES question. We have a simple config shown below. I'd like to add a couple ipaddresses that will have full access to all ports in the system. I added this
-A INPUT -s 66.238.208.110/32 -d pub.lic.ip.add/32 -i eth0 -p tcp -m tcp --dport 1:65301 -j ACCEPT

to the config like so to no avail. Here is the entire config... What do you think?

# Firewall configuration written by redhat-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A INPUT -s ip.add.to.add/32 -d ser.ver.ip.add/32 -i eth0 -p tcp -m tcp --dport 1024:65535 -j ACCEPT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

 

[lgarner]

Move your lie above the "-A INPUT -j RH-Firewall-1-INPUT" line. Better yet, put your line into the RH-Firewall-1-INPUT chain above the "-j REJECT" line.

 

[ericbrunson]

I don't think that rule is sufficient. I'm by no means an iptables expert, but this is what I use:

-A INPUT -s MYIPADDRESS -m state --state NEW -j ACCEPT 
-A FORWARD -s MYIPADDRESS -m state --state NEW -j ACCEPT 
-A OUTPUT -s MYIPADDRESS -m state --state NEW -j ACCEPT

Also note that not specifying the port range leaves it open to any.

 

[stevenriz]

I noticed that and renamed my line and all worked... I see now that INPUT was renamed to RH-Firewall........blablabla.... I think I have it now....

 

[stevenriz]

thanks lgarner, thanks eric... I will try both ways, eric's way is three lines to one but the lines have less parameters in them. I will tend to bet they are negotiable in performance....

 

[ericbrunson]

Well, they go in three different chains, INPUT, OUTPUT and FORWARD. INPUT is mandatory, OUTPUT is probably covered by a more general rule and FORWARD is only necessary if you're routing for a network.

I think your initial problem was the ordering, which you've fixed.

 

[lgarner]

Yes, I would just leave the port off if you want all traffic incoming from that address. The main thing is to make sure that the desired traffic is ACCEPTed before it's REJECTed.