Home / server / Questions / 141358
Accepted
directedition
Asked: 2010-05-13 19:21:22 +0800 CST

iptables to play nice with tor and ntpd

  • 772

I'm setting up a server to operate as a tor relay and nothing else. I setup iptables to only allow talk on port 9001 and it worked fine, but there was an issue, the clock needs to be properly set and maintained for the relay to work properly, so I needed ntpd setup and running, but for some reason I can't get iptables to work as I want it. I'm trying to have it allow only tor and ntpd to talk over the network, but when I set it up to allow port 123 using udp, suddenly it ignores my -A OUTPUT ! -s 127.0.0.1 -j DROP and allows everything through. How should I go about this? Please excuse my ignorance, I've brand new to iptables.

I've gone through a number of permutations, but here are my rules as they stand now:

-A INPUT -p udp --sport 123 --dport 123 -j ACCEPT
-A OUTPUT -p udp --sport 123 --dport 123 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 9001 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 9001 -j ACCEPT
-A INPUT ! -s 127.0.0.1 -j DROP
-A OUTPUT ! -s 127.0.0.1 -j DROP
iptables ntp tor

1 Answers

  1. Best Answer

    two generic hints. as first rules always put:

    iptables -P DROP 
iptables -F # clean things up. i assume you connect locally, otherwise your ssh will stop to work.
itables -A INPUT -i lo -j ACCEPT
itables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

    and then your regulars

    iptables -A INPUT -p udp --dport 123 -j ACCEPT # assuming you are ntp server
iptables -A OUTPUT -p udp --dport 123 -j ACCEPT # try to narrow it down using -s to couple public ntp servers
iptables -A INPUT -m state --state NEW -p tcp --dport 9001 -j ACCEPT # assuming you take incomming tor connections here
iptables -A OUTPUT -m state --state NEW  -p tcp --dport 9001 -j ACCEPT # assuming you allow outgoing connections to other tor nodes
    • 3