I want to filter traffic coming into my Linux box so ports appears like closed instead of "filtered".
Using iptables, except for ports I intended to open (-j ACCEPT), I have done the following on INPUT traffic (IPv4):
- For established or related connections (using
-m conntrack), ignore and accept - For TCP,
-j REJECT --reject-with tcp-reset, which should send a TCP RST packet back - For UDP, reject with
icmp-port-unreachable - For ICMP, accept echo request (so it can be pinged), and respond with
icmp-proto-unreachable - For everything else (protocols except 1, 6 and 17), respond with
icmp-proto-unreachable
For IPv6, everythinge except TCP is rejected with icmp6-port-unreachable. I haven't filtered any OUTPUT traffic.
Should I take any extra actions or is the setup comprehensive enough?
0 Answers