By default Apache webserver listen on port 80 (http) and port 443 (https i.e. secure http). Apache webserver uses the TCP protocol to transfer information/data between server and browser. The default Iptables configuration does not allow inbound access to the HTTP (80) and HTTPS (443) ports used by the web server. This post explains how to allow inbound and outbound access to web services under Linux.
You can edit /etc/sysconfig/iptables file under RHEL / CentOS / Fedora Linux. Add the following lines, ensuring that they appear before the final LOG and DROP lines for the RH-Firewall-1-INPUT chain to open port 80 and 443:
-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT
Finally, restart the firewall:
# service iptables restart
If you've your own shell script, try:
/sbin/iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT
Allow incoming http/web traffic at port 80
SERVER_IP="202.54.10.20" iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d $SERVER_IP --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp -s $SERVER_IP --sport 80 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
Allow incoming https/secure web traffic at port 443
SERVER_IP="202.54.10.20" iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d $SERVER_IP --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp -s $SERVER_IP --sport 443 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
Allow outgoing http/web service traffic to port 80
SERVER_IP="202.54.10.20" iptables -A OUTPUT -p tcp -s $SERVER_IP --sport 1024:65535 -d 0/0 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp -s 0/0 --sport 80 -d $SERVER_IP --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
Allow outgoing https/secure web service traffic to port 443
SERVER_IP="202.54.10.20" iptables -A OUTPUT -p tcp -s $SERVER_IP --sport 1024:65535 -d 0/0 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp -s 0/0 --sport 443 -d $SERVER_IP --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
Featured Articles:
- 20 Linux System Monitoring Tools Every SysAdmin Should Know
- 20 Linux Server Hardening Security Tips
- Linux: 20 Iptables Examples For New SysAdmins
- My 10 UNIX Command Line Mistakes
- 25 PHP Security Best Practices For Sys Admins
- The Novice Guide To Buying A Linux Laptop
- Top 5 Email Client For Linux, Mac OS X, and Windows Users
- Top 20 OpenSSH Server Best Security Practices
- Top 10 Open Source Web-Based Project Management Software
Facebook it - Tweet it - Print it -
We're here to help you make the most of sysadmin work. So, subscribe!
{ 11 comments… read them below or add one }
grate site
How to configure Squid server with bandwidth limitation for particular network ips?
If you response with the configuration, then it will be great help me if not also, from this site i have got lots of information. Thanks. Its a greate knowledge protal.
In windows how to block https site like Gmail
Script to block incoming HTTP request from an IP say after 20 continue requests.
Thanks in advance
–kunal
Just to add one more thing IP blocking should be done for certain period of time say 5 hrs and after unblock that IP.
This would be much simple and better. There is no necessary to permit the oubound traffic to be opend and can be avoided.
# Allow incoming port 80 and 443 (http/s) traffic
/sbin/iptables -A INPUT -p tcp –dport 80 -m state –state NEW -j ACCEPT
/sbin/iptables -A INPUT -p tcp –dport 443 -m state –state NEW -j ACCEPT
…you all forgot to mention that conntrack has to be enabled as well. Otherwise only the first packet of the connection is let in, but the “real” data is still blocked… ;-)
To block Gtalk, i want to set the restriction to this address:
216.239.37.125, 72.14.253.125, 72.14.217.189 and 209.85.137.125 on ports 20, 21, 80, 443, 5222 and 5223
How can I block these addresses to block Gtalk and Https://mail.gmail.com request in transparent proxy.I am using the same script provided by nixcraft to configure Transparent proxy.
hello,
can you give opposite – i need example how to configure iptables for webserver, that need access to windows local network also.
thank you in advance!
hello sir,
how way bock https port number in the linux Ip table. Actually I wanted bock the browser by the https port way. like facebook.
thanks
Shahadat
I have open port 80 as you describe here but I cannot access my site from web.
I have also configure router to forward port 80 to the pc with the apache server.
Have you any idea what could be the problem?
Thanks in advance.