7 thoughts on “IPTables rules for FreeIPA”

1. Hello,
   A more restrictive approach using conntrack I’ve been using:

   :INPUT DROP [0:0]
   :FORWARD DROP [0:0]
   :OUTPUT ACCEPT [0:0]
   -A INPUT -m conntrack –ctstate INVALID -j DROP
   -A INPUT -m conntrack –ctstate RELATED,ESTABLISHED -j ACCEPT
   -A INPUT -p icmp -m icmp –icmp-type 0 -j ACCEPT
   -A INPUT -p icmp -m icmp –icmp-type 3 -j ACCEPT
   -A INPUT -p icmp -m icmp –icmp-type 11 -j ACCEPT
   -A INPUT -i lo -j ACCEPT
   -A INPUT -p tcp -m conntrack –ctstate NEW -m tcp -m multiport –dports 22,53,80,88,389,464,686,443 -j ACCEPT
   -A INPUT -p udp -m conntrack –ctstate NEW -m udp -m multiport –dports 53,88,123,464 -j ACCEPT
   -A INPUT -j LOG –log-prefix “IP DROP UNMATCHED: ”
   -A INPUT -j DROP
   COMMIT

   I can’t remember if freeIPA includes a firewalld snippet, I’ll check that later.
   Thanks!

2. Thanks, David. Care to annotate that a bit? I suspect that people will be finding this response of yours useful, and it would be handy to have the explanation all in one place.

3. OK, let me try 🙂
   First of all, please note that we’re dealing only with the filter
   table. No nat or mangle is/should be needed in a default freeIPA installation.
   Further restrictions can be implemented by DROPping also the OUTPUT
   using the security table, or by other means.

   DROP instead of ACCEPT (or REJECT): A direct quote from the DISA draft
   for RHEL6, “in iptables the default policy is applied only after all the
   applicable rules in the table are examined for a match. Setting the
   default policy to “DROP” implements proper design for a firewall, i.e.
   any packets which are not explicitly permitted should not be accepted.”
   Also, it makes it harder for port scanners to obtain useful info, as it
   drops the connection without giving a response.
   http://iase.disa.mil/stigs/os/unix/red_hat.html
   
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

   Why conntrack? It allows for a very simple sanity check, can be useful
   when combined with the contrack(8) tool, and it’s supposed to obsolete
   the state module. (Doesn’t Fedora 18 already issue a deprecation warning?)
   http://www.spinics.net/lists/netfilter/msg46832.html
   
-A INPUT -m conntrack –ctstate INVALID -j DROP
-A INPUT -m conntrack –ctstate RELATED,ESTABLISHED -j ACCEPT

   Accepted ICMP types. I probably shouldn’t have posted this “as is”, as it
   is a personal choice, valid for an specific scenario.
   The idea here is restricting the ICMP traffic to the minimum types
   and/or codes; note that ICMP types 1,2,7 are unassigned, 4-6,15-18,30-39
   are deprecated, some other are reserved or experimental.
   Also, note the security recommendations found in the DISA document cited above
   and others (NSA, …) with regards to ICMP redirects.
   https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xml
   
-A INPUT -p icmp -m icmp –icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp –icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp –icmp-type 11 -j ACCEPT

   Accept all local traffic. As a curiosity (at least it was surprising for me
   when I learn of it), local traffic goes through the lo interface regardless
   the local IP used.
   
-A INPUT -i lo -j ACCEPT

   Multiport module. It accepts up to 15 ports, enough for an IPA
   server, gives less lines to edit, and the info regarding what
   is what can still be easily obtained elsewhere:
   
# getent services 22 53 53/udp 80 88 88/udp 123/udp 389 464 646/udp 686 443
ssh 22/tcp
domain 53/tcp
domain 53/udp
http 80/tcp www www-http
kerberos 88/tcp kerberos5 krb5
kerberos 88/udp kerberos5 krb5
ntp 123/udp
ldap 389/tcp
kpasswd 464/tcp kpwd
ldp 646/udp
hcp-wismar 686/tcp
https 443/tcp

   -A INPUT -p tcp -m conntrack –ctstate NEW -m tcp -m multiport –dports 22,53,80,88,389,464,686,443 -j ACCEPT
-A INPUT -p udp -m conntrack –ctstate NEW -m udp -m multiport –dports 53,88,123,464 -j ACCEPT

   Optionally, you might want to know if you’re consistently dropping some traffic.
   
-A INPUT -j LOG –log-prefix “IP DROP UNMATCHED: ”

   After that, drop it all.
   
-A INPUT -j DROP
COMMIT

   Hope it’s useful.
   P.S. I’ve used some formatting tags in the hope they’ll be recognized, if that’s not the case, please feel free to edit the post. Thank you very much for the feedback.

4. Hi David, Adam

   This has been immensely useful. Thanks a lot! I’m wondering also what the default rules should be for an IPA client to have open if necessary?

   Thanks!

5. I don’t think there are any: the ipa_client doesn’t set up and servers, so all default firewalling should work as is. Unless you are running a firewall rule that limits outgoing connections (maybe some sort of virus checker?) you shouldn’t need to modify your firewall.

6. Hi Adam,

   I think you’re missing the ports for the ip-replica* commands

   Using your rule set none of the replica commands seem to work (with iptables off it will)

   eg.
   ipa-csreplica-manage re-initialize –from ipa01
   Directory Manager password:

   Can’t contact LDAP server

   Cheers,
   Andrew.

7. Port 8080 (tcp) seems to be needed by a replica that doesn’t have its own CA

This site uses Akismet to reduce spam. Learn how your comment data is processed.