# iptables...GUI or CLI?

## FizzyWidget

I have in the past attempted to configure iptables to suit my needs but for some reason I always seem to end up blocking access to the system from with inside of the LAN as well as outside, guessing I'm just not used to doing it through the command line.

Its not an overly complicated iptables I would need, block everything incoming and out going unless I allow it, allow me full access from inside LAN, allow friends to connect to web and ftp servers by restricting it to their ip addresses, and allow me to sync and pull in updates.

I have lost the script I had so will have to start again, should i bite the bullet and get some more grey hairs and try and learn iptables or just use a gui to make the tables with?

----------

## NeddySeagoon

Dark Foo,

Shorewall is a nice half way house. You write the rules in something approaching iptables commands but it takes a lot of the drudgery out of iptables itself.

----------

## FizzyWidget

will give it a try, whats the worse that can happen  :Wink: 

edit: seems after some hunting i found my old script   :Smile: 

```
# Generated by iptables-save v1.4.12.1 on Mon Sep  5 22:28:53 2011

*nat

:PREROUTING ACCEPT [3:455]

:INPUT ACCEPT [0:0]

:OUTPUT ACCEPT [7:557]

:POSTROUTING ACCEPT [7:557]

COMMIT

# Completed on Mon Sep  5 22:28:53 2011

# Generated by iptables-save v1.4.12.1 on Mon Sep  5 22:28:53 2011

*mangle

:PREROUTING ACCEPT [457:32314]

:INPUT ACCEPT [457:32314]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [497:174401]

:POSTROUTING ACCEPT [499:174876]

COMMIT

# Completed on Mon Sep  5 22:28:53 2011

# Generated by iptables-save v1.4.12.1 on Mon Sep  5 22:28:53 2011

*filter

:INPUT DROP [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

[141:10130] -A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

[0:0] -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT

[0:0] -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT

[0:0] -A INPUT -i lo -j ACCEPT

[21:1859] -A INPUT -i eth0 -j DROP

[0:0] -A INPUT -s 192.168.1.0/24 -i eth0 -j ACCEPT

[0:0] -A INPUT -s xxx.xxx.xxx.xxx/32 -i eth0 -p tcp -m tcp --dport xxx -j ACCEPT

[0:0] -A INPUT -s  xxx.xxx.xxx.xxx/32 -i eth0 -p tcp -m tcp --dport xxx -j ACCEPT

[0:0] -A INPUT -s xxx.xxx.xxx.xxx/32 -i eth0 -p tcp -m tcp --dport xxx -j ACCEPT

[0:0] -A INPUT -s xxx.xxx.xxx.xxx/32 -i eth0 -p tcp -m tcp --dport xxx -j ACCEPT

[2:106] -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT

[160:64192] -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT

COMMIT

# Completed on Mon Sep  5 22:28:53 2011
```

----------

## PaulBredbury

Your "-A INPUT -i eth0 -j DROP" should be after the accepts. The order of these rules is crucial.

----------

## FizzyWidget

so it should be

[0:0] -A INPUT -s 192.168.1.0/24 -i eth0 -j ACCEPT 

[0:0] -A INPUT -s xxx.xxx.xxx.xxx/32 -i eth0 -p tcp -m tcp --dport xxx -j ACCEPT 

[0:0] -A INPUT -s  xxx.xxx.xxx.xxx/32 -i eth0 -p tcp -m tcp --dport xxx -j ACCEPT 

[0:0] -A INPUT -s xxx.xxx.xxx.xxx/32 -i eth0 -p tcp -m tcp --dport xxx -j ACCEPT 

[0:0] -A INPUT -s xxx.xxx.xxx.xxx/32 -i eth0 -p tcp -m tcp --dport xxx -j ACCEPT 

[2:106] -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT 

[160:64192] -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT 

[21:1859] -A INPUT -i eth0 -j DROP

----------

