Task Write a iptables script that blocks everything except ping (icmp) and ssh (port 22), http (80) and https (443). Solution

export ipt=/sbin/iptables
$ipt -F #Flush all the rules one by one

#Allow SSH
$ipt -A INPUT -p tcp --dport 22 -j ACCEPT
#Allow HTTP
$ipt -A INPUT -p tcp --dport 80 -j ACCEPT
#Allow HTTPS
$ipt -A INPUT -p tcp --dport 443 -j ACCEPT

# Set default policies for INPUT, FORWARD and OUTPUT chains

# Set access for localhost
$ipt -A INPUT -i lo -j ACCEPT

# Accept packets belonging to established and related connections
$ipt -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#Allow pings
#Ping requires the ability to accept packets and send packet back out.
#Ping is a layer 3,ICMP operation.
#In order to allow it our protocol now becomes icmp instead of tcp.
#Ping packets are able to be received.
$ipt -I INPUT -p icmp -j ACCEPT

#Ping packets are able to be sent
$ipt -I OUTPUT -p icmp -j ACCEPT

#Drop everything else incoming
$ipt -A INPUT -j DROP

# List rules
$ipt -L -v

-m says load a module state which allows access to the connection tracking state of the packets

--state precedes a comma separated list of the connection states to match. In this case it’s NEW.

NEW the packet has started a new connection or a connection that has not seen packets going in both directions

-m tcp load the tcp module (just like we loaded the state module) this module allows us extra functionality with tcp

-p tcp specifies protocol, in my case TCP

--dport 22 feature provided by the -m tcp module, in this case I want the rule to be applicable to port 22 (ssh).

-j ACCEPT means the results of this chain is to accept the packets. (-j specifies the target of the rule if the packet matches the rule. If I said -j DROP we would block all traffic to port 22).