How to allow only ssh and internet access with iptables?

Question

I want to allow only internet access (it is useful for update) and ssh on my server. I found this set of rules:

  sudo iptables -P INPUT DROP
  sudo iptables -P OUTPUT DROP
  sudo iptables -A INPUT -i lo -j ACCEPT
  sudo iptables -A INPUT -p tcp -m tcp --dport [port number] -j ACCEPT
  sudo iptables -A OUTPUT -o lo -j ACCEPT
  sudo iptables -A OUTPUT -p tcp --sport [port number] -m state --state ESTABLISHED -j ACCEPT
  sudo service iptables save
  sudo netfilter-persistent reload

This is working well but I can't update my system or access internet. Which rules should I add to allow outgoing internet connection?

Solution

Let's start

Delete current rules and chains:

sudo iptables --flush
sudo iptables --delete-chain

Allow loopback:

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

Drop ICMP:

sudo iptables -A INPUT -p icmp --icmp-type any -j DROP
sudo iptables -A OUTPUT -p icmp -j DROP

Allow established connections:

sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Allow SSH:

sudo iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

Default policies:

sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT ACCEPT

Save:

sudo iptables-save

This is it. I think :)

Comments

[EODCraft Staff]

Would using UFW be more efficient? I could find those commands easily.

[2707974]

SSH to server or from server?

[dmx]

@2707974 ssh from outside (any other computer) and allow server to access internet

[user956584]

THX THX THX THX