FiLeBaRoN

i have used linux before (mandrake, ubuntu/kubuntu) with a gui and never really had to dig into the guts of the kernal. now i have a vds and i need help with confiquring and enabling iptables, i have tired installing APF to manage this for me, but the install went wrong (didnt find this out until after spending 2 hours editting the conf.apf file) and i wanted to know if there is a reasonably easy guide out there that can help me get iptables confiqured correctly. im looking to block both incoming/outgoing udp/tcp port ranges and setting which ports i want to be in htm mode. my vds is running fedora core 6 with cpanel/whm. thank you in advance to any reply's and help :)

hal8000

Theres no easy guides but the wiki has simple examples
http://en.wikipedia.org/wiki/Iptables

and later in the document links to external links, man iptables
is a good source for doc also

hajji

best practice for firewall making is to deny everything.
and open just what you need
there are 3 tables in iptables filter, nat, and mangle, the default is filter.

the syntax is like this;
iptables [tables]/[options]/[interface]/[protocol]/[ipaddress][ports][conditions]
note: this is not the respective parameters

sample:

# flusing in chains
iptables -F

# flush user-define chains
iptables -X

# table nat
iptables -t nat -F
iptables -t nat -X

# table mangle
iptables -t mangle -F
iptables -t mangle -X

# set all default rules to DROP
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# allow loopback connections
# for incoming connection
iptables -A INPUT -i lo -j ACCEPT
# for outgoing connections
iptables -A OUTPUT -o lo -j ACCEPT

# user specific rules and policy starts here

hajji

for the in and out sample rules

# incoming http connection (port 80)
iptables -A INPUT -i eth0 -s 0/0 --source-port 1024:65535 -d 192.168.0.1 --destination-port 80 -j ACCEPT
# outgoing http (reply)
iptables -A OUTPUT -o eth0 -s 192.168.0.1 --source-port 80 -d 0/0 --destination-port 1024:65535 -j ACCEPT

wmorri

Also, you can check out the Ubuntu community documentation on it here.

Cheers!