Home / server / Questions / 154375
Accepted
ESW
Asked: 2010-06-25 01:00:56 +0800 CST

iptables rule setup

  • 772

I'm reading examples for iptables, and I've got a pre-written file I'm using for the server that meets most of my needs. The format it uses to accept traffic on port 80 (for apache) is:

-A INPUT -p tcp --dport 80 -j ACCEPT

Another webpage I've read uses the following format to accept traffic for SMTP

-A INPUT -p tcp -s 0/0 --sport 1024:65535 -d server.ip.address.here --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT

Which seems a lot more complex? Is it necessary, or could I simply do:

-A INPUT -p tcp --dport 25 -j ACCEPT
iptables

1 Answers

  1. Best Answer

    This rule is more specific, thus theorically allowing less connections :

    -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d server.ip.address.here --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT

    With this rule the connection needs to be initiated by a client (port>=1024), on a specific IP (therefore a single interface), and the client can only initiate a new connection or use an already established one.

    But this simpler rule, since less specific, allow any kind of connection, from any port, to any interface on the port 25.

    -A INPUT -p tcp --dport 25 -j ACCEPT

    Keep in mind that if you do not reinforce your firewall by using specific DROP rules, or iptables' policies (-P) to DROP all packets that aren't explicitely allowed, any ACCEPT rule will be useless.

    • 2