Installing iptables on Raspberry Pi

Why do we need iptables for RPi.

1. Restrict connections to services if you are connected to the internet directly.
2. Ability to control connections states and proper TCP connections.
3. Ability restrict to allowed connections to the RPi from remote locations.

As you probably found out that the Raspberry Pi does not have iptables installed by default. This is a good thing unless you plan to connect your RPi to the internet. This leaves your SSH (if you have it enabled) connection open to attack if you don't plan to setup a more secure private key connection to SSH. Which I would suggest doing anyway. I plan cover that in a future blog.

What I am planning to cover

1. Install of iptables for RPi.
2. Configure basic rules sets for connections to SSH and HTTP services.
3. Create a script to save your rulesets.
4. Setup loading rule sets on start-up or your RPi. 

Getting Started

Current overview of my configuration. Using an 8Gig SDCard. I downloaded these items.

• You will need Win32DiskImager to put the image on your SDCard. 
• I used Debian Wheezy for my Raspberry Pi Download Debian Wheezy. build 2013-02-09-wheezy-raspbian.zip.

 If you would like to setup a static IP or learning to connect to RPi via SSH view my blog here

Installing iptables

During this install of iptables I am going to install the package via SSH. By default iptables is set to allow all connections.

1. Type "sudo apt-get install iptables". press Enter this will download and install the current available version of iptables to you RPi.

Adding rules to iptables

At minimum we want to have a few rules in our iptables. These rules are not for you to use your RPi as a firewall. Plus it would be difficult with only one NIC. You must do these in order or connections could fail. Rules go top down in order. Skip any rule except ones in blue.

1. Type "sudo iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED". press Enter This will allow any connection that has been properly established and related to pass though. This is really only needed if you have opened a port like the rule 2. below.
2. Type "sudo iptables -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT". press Enter. This will allow you to host a website on your RPi on port 80.
3. Type "sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT". press Enter. This will allow you connect to your RPi via SSH.
4.  Type "sudo iptables -A INPUT -p tcp --dport 5901 -m state --state NEW -j ACCEPT" press Enter. This will allow you access if you have TightVNC installed.
5.  Type "sudo iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT". press Enter. This will allow you to ping your RPi.
6. Type "sudo iptables -P INPUT DROP". press Enter. This will block all inbound traffic not accepted by a rule.
7. Now type "sudo iptables -L". press Enter. You should see your rules loaded.

Saving the configuration to a file

In this section I am going to simply cover saving your shiny new iptables configuration to a file. Then create a script to call iptables-save which will allow us to save the file anytime.

1. Type "cd /etc | sudo iptables-save > iptables.conf". press Enter. This will save the currently running ruleset from memory into /etc/iptables.conf file.
2. Type "cd ~/". press Enter. Put us in your home directory.
3. Type "echo '#!/bin/bash' | sudo tee ~/savetables". press Enter. This is the header for the script file.
4. Type "echo '/sbin/iptables-save > /etc/iptables.conf' | sudo tee -a ~/savetables". press Enter. This is the command to save the table information to /etc/iptables.conf file.
5. Type "sudo chmod +x ~/savetables". press Enter. This will set the file to have execute permissions.
6. Type "cd ~ | sudo ./savetables". press Enter. This command will allow you to save the configuration file anytime.

Applying rules to the eth0 interface to stay persistent

We are going to start off by creating a script file in the network directory to execute our iptables when our eth0 interface is up and running.

1. Type "echo '#!/bin/bash' | sudo tee /etc/network/if-up.d/iptables". press Enter. This is the header for the script file.
2. Type "echo '/sbin/iptables-restore < /etc/iptables.conf' | sudo tee -a /etc/network/if-up.d/iptables". press Enter. This is the command that will load our iptables on our eth0 interface.
3. Type "sudo chmod +x /etc/network/if-up.d/iptables". press Enter. This will set the file to have execute permissions.
4. Type "sudo reboot". press Enter. After your RPi comes back up you should now be able to type "sudo iptables -L" and see your rules listed under INPUT.

Known Issues

None