In the below examples we are using ETH0 as network interface, however your interface name might also be called VENET0:0
to determine the correct name.
1. Delete Existing Rules
Before you start building new set of rules, you might want to clean-up all the default rules, and existing rules. Use the iptables flush command as shown below to do this.
iptables -F (or) iptables --flush
2. Set Default Chain Policies
The default chain policy is ACCEPT. Change this to DROP for all INPUT, FORWARD, and OUTPUT chains as shown below.
iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP
When you make both INPUT, and OUTPUT chain’s default policy as DROP, for every firewall rule requirement you have, you should define two rules. i.e one for incoming and one for outgoing.
In all our examples below, we have two rules for each scenario, as we’ve set DROP as default policy for both INPUT and OUTPUT chain.
If you trust your internal users, you can omit the last line above. i.e Do not DROP all outgoing packets by default. In that case, for every firewall rule requirement you have, you just have to define only one rule. i.e define rule only for incoming, as the outgoing is ACCEPT for all packets.
3. Block a Specific ip-address
Before we proceed further will other examples, if you want to block a specific ip-address, you should do that first as shown below. Change the “x.x.x.x” in the following example to the specific ip-address that you like to block.
BLOCK_THIS_IP="x.x.x.x" iptables -A INPUT -s "$BLOCK_THIS_IP" -j DROP
This is helpful when you find some strange activities from a specific ip-address in your log files, and you want to temporarily block that ip-address while you do further research.
You can also use one of the following variations, which blocks only TCP traffic on eth0 connection for this ip-address.
iptables -A INPUT -i eth0 -s "$BLOCK_THIS_IP" -j DROP iptables -A INPUT -i eth0 -p tcp -s "$BLOCK_THIS_IP" -j DROP
4. Allow ALL Incoming SSH
The following rules allow ALL incoming ssh connections on eth0 interface.
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
5. Allow Incoming SSH only from a Sepcific Network
The following rules allow incoming ssh connections only from 192.168.100.X network.
iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
In the above example, instead of /24, you can also use the full subnet mask. i.e “192.168.100.0/255.255.255.0″.
6. Allow Incoming HTTP and HTTPS
The following rules allow all incoming web traffic. i.e HTTP traffic to port 80.
iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
The following rules allow all incoming secure web traffic. i.e HTTPS traffic to port 443.
iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
7. Combine Multiple Rules Together using MultiPorts
When you are allowing incoming connections from outside world to multiple ports, instead of writing individual rules for each and every port, you can combine them together using the multiport extension as shown below.
The following example allows all incoming SSH, HTTP and HTTPS traffic.
iptables -A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp -m multiport --sports 22,80,443 -m state --state ESTABLISHED -j ACCEPT
8. Allow Outgoing SSH
The following rules allow outgoing ssh connection. i.e When you ssh from inside to an outside server.
iptables -A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
Please note that this is slightly different than the incoming rule. i.e We allow both the NEW and ESTABLISHED state on the OUTPUT chain, and only ESTABLISHED state on the INPUT chain. For the incoming rule, it is vice versa.
9. Allow Outgoing SSH only to a Specific Network
The following rules allow outgoing ssh connection only to a specific network. i.e You an ssh only to 192.168.100.0/24 network from the inside.
iptables -A OUTPUT -o eth0 -p tcp -d 192.168.100.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
10. Allow Outgoing HTTPS
The following rules allow outgoing secure web traffic. This is helpful when you want to allow internet traffic for your users. On servers, these rules are also helpful when you want to use wget to download some files from outside.
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
Note: For outgoing HTTP web traffic, add two additional rules like the above, and change 443 to 80.
11. Load Balance Incoming Web Traffic
You can also load balance your incoming web traffic using iptables firewall rules.
This uses the iptables nth extension. The following example load balances the HTTPS traffic to three different ip-address. For every 3th packet, it is load balanced to the appropriate server (using the counter 0).
iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 0 -j DNAT --to-destination 192.168.1.101:443 iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 1 -j DNAT --to-destination 192.168.1.102:443 iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 2 -j DNAT --to-destination 192.168.1.103:443
12. Allow Ping from Outside to Inside
The following rules allow outside users to be able to ping your servers.
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
13. Allow Ping from Inside to Outside
The following rules allow you to ping from inside to any of the outside servers.
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
14. Allow Loopback Access
You should allow full loopback access on your servers. i.e access using 127.0.0.1
iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT
15. Allow Internal Network to External network.
On the firewall server where one ethernet card is connected to the external, and another ethernet card connected to the internal servers, use the following rules to allow internal network talk to external network.
In this example, eth1 is connected to external network (internet), and eth0 is connected to internal network (For example: 192.168.1.x).
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
16. Allow outbound DNS
The following rules allow outgoing DNS connections.
iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT
17. Allow NIS Connections
If you are running NIS to manage your user accounts, you should allow the NIS connections. Even when the SSH connection is allowed, if you don’t allow the NIS related ypbind connections, users will not be able to login.
The NIS ports are dynamic. i.e When the ypbind starts it allocates the ports.
First do a rpcinfo -p as shown below and get the port numbers. In this example, it was using port 853 and 850.
rpcinfo -p | grep ypbind
Now allow incoming connection to the port 111, and the ports that were used by ypbind.
iptables -A INPUT -p tcp --dport 111 -j ACCEPT iptables -A INPUT -p udp --dport 111 -j ACCEPT iptables -A INPUT -p tcp --dport 853 -j ACCEPT iptables -A INPUT -p udp --dport 853 -j ACCEPT iptables -A INPUT -p tcp --dport 850 -j ACCEPT iptables -A INPUT -p udp --dport 850 -j ACCEPT
The above will not work when you restart the ypbind, as it will have different port numbers that time.
There are two solutions to this: 1) Use static ip-address for your NIS, or 2) Use some clever shell scripting techniques to automatically grab the dynamic port number from the “rpcinfo -p” command output, and use those in the above iptables rules.
18. Allow Rsync From a Specific Network
The following rules allows rsync only from a specific network.
iptables -A INPUT -i eth0 -p tcp -s 192.168.101.0/24 --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 873 -m state --state ESTABLISHED -j ACCEPT
19. Allow MySQL connection only from a specific network
If you are running MySQL, typically you don’t want to allow direct connection from outside. In most cases, you might have web server running on the same server where the MySQL database runs.
However DBA and developers might need to login directly to the MySQL from their laptop and desktop using MySQL client. In those case, you might want to allow your internal network to talk to the MySQL directly as shown below.
iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT
20. Allow Sendmail or Postfix Traffic
The following rules allow mail traffic. It may be sendmail or postfix.
iptables -A INPUT -i eth0 -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT
21. Allow IMAP and IMAPS
The following rules allow IMAP/IMAP2 traffic.
iptables -A INPUT -i eth0 -p tcp --dport 143 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 143 -m state --state ESTABLISHED -j ACCEPT
The following rules allow IMAPS traffic.
iptables -A INPUT -i eth0 -p tcp --dport 993 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 993 -m state --state ESTABLISHED -j ACCEPT
22. Allow POP3 and POP3S
The following rules allow POP3 access.
iptables -A INPUT -i eth0 -p tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT
The following rules allow POP3S access.
iptables -A INPUT -i eth0 -p tcp --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT
23. Prevent DoS Attack
The following iptables rule will help you prevent the Denial of Service (DoS) attack on your webserver.
iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
In the above example:
- -m limit: This uses the limit iptables extension
- –limit 25/minute: This limits only maximum of 25 connection per minute. Change this value based on your specific requirement
- –limit-burst 100: This value indicates that the limit/minute will be enforced only after the total number of connection have reached the limit-burst level.
24. Port Forwarding
The following example routes all traffic that comes to the port 442 to 22. This means that the incoming ssh connection can come from both port 22 and 422.
iptables -t nat -A PREROUTING -p tcp -d 192.168.102.37 --dport 422 -j DNAT --to 192.168.102.37:22
If you do the above, you also need to explicitly allow incoming connection on the port 422.
iptables -A INPUT -i eth0 -p tcp --dport 422 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 422 -m state --state ESTABLISHED -j ACCEPT
25. Log Dropped Packets
You might also want to log all the dropped packets. These rules should be at the bottom.
First, create a new chain called LOGGING.
iptables -N LOGGING
Next, make sure all the remaining incoming connections jump to the LOGGING chain as shown below.
iptables -A INPUT -j LOGGING
Next, log these packets by specifying a custom “log-prefix”.
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
Finally, drop these packets.
iptables -A LOGGING -j DROP
By Ben Aghajanian
Kia has come a long way in the past few years. The company was known in the not-too-distant past for small, economical vehicles like the Spectra, Sephia, and Rio (which is still in production). However, last year, they introduced a full-size, luxury model. I recently drove the $66,000, 5.0L direct-injection, V8-powered, Kia K900 sedan, for a few days. Yes, a $66,000 Kia. The car targets full-size luxury sedans such as BMW’s 7 series and Lexus’ LS, while still admittedly undercutting them in price. So, does the fully loaded K900 measure up? Furthermore, does it FEEL like it measures up?
The first thing I noticed was how “old-school luxury” the K900 felt. Jumping in for the first time to run a quick errand, I hastily adjusted the seat (forward, this car is huge), tapped the electronic shift lever into gear, and floated away. The steering was very light, the seat was very soft, and I felt like I was driving a 1999 Lincoln Town Car Bill Blass Edition. No, seriously, this was one of the softest cars I’ve driven in a long time.
The best attribute of the K900 is probably the 5.0L V8. Shared with the Hyundai Genesis and Equus, the second generation of Hyundai’s in-house V8 is thoroughly enjoyable to exercise. Boasting 420hp, the V8 provides effortless acceleration and a throaty exhaust note at both low and high RPMs. It gets down and boogies. It also got around 16mpg in our driving.
The Kia is completely loaded with features. Our tester featured the VIP package, including a heads-up display, active cruise control, extra adjustments for the driver’s seat, around-view camera, adjustable rear seats, a panoramic sunroof, and much more. Most features one would find on a high-end German luxury sedan can be found here, and everything I tested worked flawlessly.
The active cruise control was especially impressive. Kia’s system will not only slow you to a crawl from highway speed in traffic, but stop the car completely, remain stopped, and resume accelerating when the car in front of you begins to move again. You can adjust the K900’s following distance to several different interval lengths, and in a lengthy traffic jam, genuinely have to never touch a pedal.
K900 versus Hyundai Genesis
Like the Hyundai Genesis we tested a few weeks ago, the K900’s 8-speed automatic offers 3 drive modes: Eco, Normal, and Sport. Like the Genesis, you can tell the difference between the modes, but not by much. Unlike the Genesis, the Kia does not offer paddle shifters. It seems that while the Genesis is benchmarked against driver’s cars like the BMW 5-series, the Kia is designed to just set-it-and-forget-it. If you must, though, there is a manual gate on the shift lever. This is largely unnecessary, as the transmission is well-behaved, smooth, and rarely caught in the wrong gear.
Besides the V8, other high points include the multimedia interface. Kia’s UVO-branded system works very well. I found it interesting that despite the corporate ties to Hyundai, the K900’s system was noticeably different than the Genesis’. First, the Kia didn’t have a touchscreen, instead relying on a joystick-esque knob surrounded by several buttons for specific functions, like phone and maps, on the center console. I quickly became familiar with the system, which was logically designed and quick to respond. The navigation knob even allowed for simulated frequency-by-frequency tuning, a la classic AM/FM radio. Neat touch.
The K900 is very impressive until we revisit its sticker price. The Hyundai Genesis undercuts the Kia by over $15,000 base-to-base or nearly $28,000 as tested, yet feels like a more modern and sophisticated car, even without the abundance of options. It handles better and the structure feels more taut. This all makes sense, to a degree, because the Genesis rides on a newer platform, whereas the K900 is built on the older Hyundai Equus platform.
Hyundai is viewed by many as a higher-end brand than Kia. So far, the market has agreed, as the Genesis is outselling the K900 more than 28:1 year-to-date. Hyundai’s push upmarket has happened more gradually than Kia’s, with vehicles like the 2nd and 3rd generation Santa Fe, the Veracruz, the 2005+ Sonata, and the Azera. This has facilitated the acceptance of cars like the Genesis. Furthermore, a Lexus LS460 starts within $7,000 of the K900, which means that it will likely have a lower cost-to-own over time, as resale on the Lexus will be higher. Taking market factors into consideration, we have a Kia that has outpriced Lexus’ flagship.
So there you have it. The K900, objectively, is well executed in many ways. It has the style and luxury features of a bona fide luxury sedan. It also is priced accordingly, so it has a bit of an identity crisis. To me, the Hyundai Genesis represents the better buy, with the V8 or without it (as tested).
LAMP, as acronym for Linux, Apache, MySQL and PHP represents an Open Source web development platform that uses Linux operating system, Apache web server, MySQL database, and PHP as the scripting language. Together, these components have what it takes to build a robust web application platform. CentOS (Community Enterprise Operating System) is a Linux-based community supported enterprise OS. Its latest version, CentOS 7, was launched in July, 2014. In this tutorial, we will look into the steps required to install LAMP in Centos 7.
Before we begin with the installation, let us check our hostname, using the command
which should return our FQDN of the server.
The system can be checked for updates and updated using the commands
#sudo yum update
To install Apache, we run the command
#yum install httpd
Next is to enable the Apache service at startup.
#systemctl enable httpd.service
#systemctl restart httpd.service
The Apache server can be tested now!
To prevent the firewall of your network to block the service, the Apache port number (80) can be excluded from the firewall.
#firewall –cmd –permanent –add-service httpd
#systemctl restart firewall.service
MySQL has been replaced by MariaDB in CentOS. To install MariaDB, we would perform the following steps:
To install MariaDB, we run the following command
#sudo yum install mariadb-server
To enable MariaDB at startup, run the following command
#sudo systemctl enable mariadb.service
#sudo systemctl start mariadb.service
To password protect MariaDB installation, we can use the following
It would prompt for the current password. We would leave that blank and the system would prompt for the new password. We would set a new password, confirm it.
To install PHP, we run the following command
#yum install php php-mysql
This command would install the MySQL support, in addition to PHP.
Next we create a log directory for PHP and assign ownership
#sudo mkdir /var/log/phplogdir
#sudo chown /var/log/phplogdir
We will restart the Apache service now
#systemctl restart httpd.service
To test, we can create a demo PHP page and check in the browser.
To check the installed versions of the services, we can use the following commands
Now that we have configured LAMP on CentOS 7, we have a platform to configure almost all powerful websites available. Happy computing!