mjhjmtu

My Iptables to connect to VPS using static ip X.X.X.X
and to allow VPS to update and install packages

*filter

#Allow all loopback (lo0) traffic and reject traffic
#to localhost that does not originate from lo0.
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
-A OUTPUT -o lo -j ACCEPT

#Allow traffic from address X.X.X.X
-A INPUT -i eth0 -s X.X.X.X -j ACCEPT
-A OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

#Allow DNS
-A OUTPUT -o eth0 -p udp --dport 53 -j ACCEPT
-A INPUT -i eth0 -p udp --sport 53 -m conntrack --ctstate ESTABLISHED -j ACCEPT

#Allow HTTP
-A OUTPUT -o eth0 -p tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT

#Allow HTTPS
-A OUTPUT -o eth0 -p tcp --dport 443 -j ACCEPT
-A INPUT -i eth0 -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

#Reject everything else
-A INPUT -j DROP
-A FORWARD -j DROP
-A OUTPUT -j DROP

COMMIT

Question: why is the rule

-A OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

unnecessary?

The other 3 output rules,

-A OUTPUT -o eth0 -p udp --dport 53 -j ACCEPT

-A OUTPUT -o eth0 -p tcp --dport 80 -j ACCEPT

-A OUTPUT -o eth0 -p tcp --dport 443 -j ACCEPT

are for --ctstate ESTABLISHED and only for ports 53,80,443

Is there a difference adding RELATED to the ctstate?

If the updates are only from mirrors.linode.com, can I further improve the rules using -s mirrors.linode.com? What if the hostname ip change many months later?

You do not need this rules:

-A INPUT -i eth0 -p udp --sport 53 -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

They must be replaced with single one:

-A INPUT -i eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Explanation: this rule are needed to receive traffic from connections which your host are initiated. This rule will do not applying for connection which initiated by remote hosts.

Iptables rules are applying to packets in certain order which you define.

If packets are comming to host they placed in INPUT chain and iptables apply INPUT rules.
Let's convert your rules by chains:

*filter

-A INPUT -i eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
-A INPUT -i eth0 -s X.X.X.X -j ACCEPT

-A OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 53 -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 443 -j ACCEPT

-A INPUT -j DROP
-A FORWARD -j DROP
-A OUTPUT -j DROP

COMMIT

I was delete all comments to reduce the answer.

Answer for your questions.

This rule:

-A OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

permit all traffic from local system to remote host when connection are initiated by remote host. In other words: this rule allows your host to answer for remote connections. This rule are needed for normal work.

RELATED are needed for new connections which initiated inside other permitted session. (e.g. passive ftp connections with dynamic ports range).

The bad idea to type DNS name in iptables rules - name resolving occure one times when iptables rules are load. And other reasons...