X-Git-Url: https://plomlompom.com/repos/%7B%7B%20web_path%20%7D%7D/decks/%7B%7Bdeck_id%7D%7D/cards/%7B%7Bcard_id%7D%7D/form?a=blobdiff_plain;f=all_new_2018%2Flinkable_etc_files%2Fserver%2Fetc%2Fiptables%2Frules.v4;h=fa4882dfa1340e80cbee94ce5758c5a03a1e95a8;hb=db8166ccd4711d311a845d009e859c9c415ea657;hp=f56878949562613bf3bdbadfb618d851c26a5481;hpb=d57ddacf1935302793b7e11f5ab1ea8fbda51a09;p=config

diff --git a/all_new_2018/linkable_etc_files/server/etc/iptables/rules.v4 b/all_new_2018/linkable_etc_files/server/etc/iptables/rules.v4
index f568789..fa4882d 100644
--- a/all_new_2018/linkable_etc_files/server/etc/iptables/rules.v4
+++ b/all_new_2018/linkable_etc_files/server/etc/iptables/rules.v4
@@ -2,10 +2,21 @@
 :INPUT DROP [0:0]
 :FORWARD DROP [0:0]
 :OUTPUT ACCEPT [0:0]
+# otherwise self-referential connections to local host will fail
 -A INPUT -i lo -j ACCEPT
+# this enables ping etc.
 -A INPUT -p icmp -j ACCEPT
+# SSH
 -A INPUT -p tcp --dport 22 -j ACCEPT
+# HTTPS in theory, in practice my second SSH port, see sshd_config
 -A INPUT -p tcp --dport 443 -j ACCEPT
--A INPUT -p tcp --dport 80 -j ACCEPT
+# SMTP (allowing for STARTTLS); necessary for mail server to mail server banter
+-A INPUT -p tcp --dport 25 -j ACCEPT
+# SMTPS, for mail server to mail user agent communication
+-A INPUT -p tcp --dport 465 -j ACCEPT
+# IMAPS
+-A INPUT -p tcp --dport 993 -j ACCEPT
+# tolerate any inbound connections requested by our server, no matter the port
 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-COMMIT
\ No newline at end of file
+COMMIT
+# this last line is here because iptables-restore ignores the final command if no newline follows it
\ No newline at end of file