Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
linux:firewall6 [2009/12/03 12:42] greebo |
linux:firewall6 [2011/08/05 10:31] greebo |
||
---|---|---|---|
Line 1: | Line 1: | ||
<code bash |> | <code bash |> | ||
#!/bin/bash | #!/bin/bash | ||
- | IPT6="/ | + | echo "*************" |
- | PUBIF="eth0" | + | echo "* Running $0" |
- | echo "Starting IPv6 firewall..." | + | echo "*************" |
- | $IPT6 -F | + | |
- | $IPT6 -X | + | echo " how iptables work in linux kernel" |
- | $IPT6 -t mangle | + | echo |
- | $IPT6 -t mangle | + | echo ">-[prerouting]-> + > |
+ | echo " | ||
+ | echo " | ||
+ | |||
+ | # path to ip6tables | ||
+ | IP6T="/ | ||
- | #unlimited | + | # name of our Internet and intranet interfaces |
- | $IPT6 -A INPUT -i lo -j ACCEPT | + | # |
- | $IPT6 -A OUTPUT -o lo -j ACCEPT | + | # use INTRANET=" |
+ | # if you have more ifaces (example: eth0: | ||
+ | INTRANET=" | ||
+ | INTERNET=" | ||
+ | # ADSL - INTERNET=" | ||
- | # DROP all incomming traffic | + | # what TCP ports/ |
- | $IPT6 -P INPUT DROP | + | # use " " as delimiter |
- | $IPT6 -P OUTPUT DROP | + | TCP_PORTS=" |
- | $IPT6 -P FORWARD DROP | + | |
+ | # what UDP ports/ | ||
+ | # use "," | ||
+ | UDP_PORTS=" | ||
+ | |||
+ | # which ports we forward into our intranet | ||
+ | # use "," | ||
+ | # | ||
+ | |||
+ | TRUSTED_HOSTS=" | ||
+ | 2001: | ||
+ | |||
+ | #IPv6 forward | ||
+ | echo " | ||
+ | |||
+ | # first we flush the tables and policy | ||
+ | $IP6TB -F | ||
+ | $IP6TB -X | ||
+ | $IP6TB -F INPUT | ||
+ | $IP6TB -F FORWARD | ||
+ | $IP6TB -F OUTPUT | ||
+ | |||
+ | # default policy | ||
+ | $IP6TB | ||
+ | $IP6TB -P OUTPUT DROP | ||
+ | $IP6TB -P FORWARD DROP | ||
+ | |||
+ | # separate/ | ||
+ | $IP6TB -N ssh-access | ||
+ | $IP6TB -N http-access | ||
+ | |||
+ | # port redirection (transparent proxy) | ||
+ | # redirect all outgoing traffic that is NOT for the GW to local (GW) ports | ||
+ | #$IP6TB -t nat -A PREROUTING -i ! $INTERNET -p tcp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | ||
+ | #$IP6TB -t nat -A PREROUTING -i ! $INTERNET -p udp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | ||
+ | #$IP6TB -t nat -A PREROUTING -i ! $INTERNET -p tcp -s $LAN -d ! $LAN --dport 25 -j REDIRECT --to-ports 25 | ||
+ | |||
+ | # we allow all traffic from $INTRANET and localhost interfaces | ||
+ | ##$IP6TB -A INPUT -i $INTRANET -j ACCEPT | ||
+ | $IP6TB -A INPUT -i lo -j ACCEPT | ||
+ | $IP6TB -A OUTPUT -o lo -j ACCEPT | ||
# Allow full outgoing connection but no incomming stuff | # Allow full outgoing connection but no incomming stuff | ||
- | $IPT6 -A INPUT -m state --state ESTABLISHED, | + | $IP6TB -A INPUT -m state --state ESTABLISHED, |
- | $IPT6 -A OUTPUT -m state --state NEW, | + | # |
+ | $IP6TB -A OUTPUT -m state --state NEW, | ||
- | # allow incoming ICMP ping pong stuff | + | # Allow localhost traffic. This rule is for all protocols. |
- | $IPT6 -A INPUT -p ipv6-icmp -j ACCEPT | + | $IP6TB -A INPUT -s ::1 -d ::1 -j ACCEPT |
- | $IPT6 -A OUTPUT | + | |
- | ##$IPT6 -A INPUT --protocol | + | $IP6TB -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j ssh-access |
+ | $IP6TB -A INPUT -p tcp -m state --syn --state NEW --dport 80 -j http-access | ||
+ | |||
+ | # ssh | ||
+ | # Connection limit for SSH connections (1 connection per minute from one source IP) | ||
+ | # usefull agains ssh scanners if you MUST open SSH for every IP! | ||
+ | # TRUSTED_HOSTS are whitelisted | ||
+ | for sshhostese in $TRUSTED_HOSTS; | ||
+ | do | ||
+ | $IP6TB -A ssh-access -s $sshhostese -j ACCEPT | ||
+ | done | ||
+ | $IP6TB -A ssh-access -m hashlimit --hashlimit 1/minute --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name ssh -j ACCEPT | ||
+ | $IP6TB -A ssh-access -j DROP | ||
+ | |||
+ | # ssh | ||
+ | |||
+ | # http | ||
+ | for httphostese in $TRUSTED_HOSTS; | ||
+ | do | ||
+ | $IP6TB -A http-access -s $httphostese -j ACCEPT | ||
+ | done | ||
+ | # http | ||
+ | |||
+ | # what we allow from Internet | ||
+ | for i in $TCP_PORTS | ||
+ | do | ||
+ | $IP6TB -A INPUT -p tcp -m state --syn --state NEW --dport $i -j ACCEPT | ||
+ | done | ||
+ | |||
+ | $IP6TB -A INPUT -p udp -m multiport --dport $UDP_PORTS | ||
+ | |||
+ | # identd requests | ||
+ | $IP6TB -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset | ||
+ | |||
+ | # traceroute? | ||
+ | $IP6TB -A INPUT -p udp -m limit --limit 3/ | ||
+ | |||
+ | # Recommended, | ||
+ | $IP6TB | ||
+ | $IP6TB -A OUTPUT -m rt --rt-type 0 -j DROP | ||
+ | $IP6TB -A FORWARD -m rt --rt-type 0 -j DROP | ||
+ | |||
+ | # Allow but rate-limit echo request/ | ||
+ | $IP6TB -A INPUT -i $PUBIF -p icmpv6 --icmpv6-type | ||
+ | $IP6TB | ||
+ | |||
+ | # Allow router advertisements on local network segments | ||
+ | for icmptype in 133 134 135 136 137 | ||
+ | do | ||
+ | $IP6TB -A INPUT -p icmpv6 --icmpv6-type $icmptype -m hl --hl-eq 255 -j ACCEPT | ||
+ | $IP6TB -A OUTPUT -p icmpv6 --icmpv6-type $icmptype -m hl --hl-eq 255 -j ACCEPT | ||
+ | | ||
+ | |||
+ | # Allow RFC 4890 but with rate-limiting | ||
+ | #for icmptype in 1 2 3 4 130 131 132 141 142 143 148 149 151 152 | ||
+ | |||
+ | for icmptype in 1 2 3/0 3/1 4/0 4/1 4/2 130 131 132 133 141 142 143 148 149 151 152 153 | ||
+ | do | ||
+ | $IP6TB -A INPUT -p icmpv6 --icmpv6-type $icmptype -m limit --limit 900/min -j ACCEPT | ||
+ | $IP6TB -A OUTPUT -p icmpv6 --icmpv6-type $icmptype -m limit --limit 900/min -j ACCEPT | ||
+ | | ||
+ | |||
+ | # Log all other icmpv6 types | ||
+ | $IP6TB -A INPUT -p icmpv6 -j LOG --log-prefix " | ||
+ | |||
+ | |||
+ | #reject | ||
+ | $IP6TB -A INPUT -i $PUBIF -p tcp -m state --syn --state NEW -m multiport --dports 113, | ||
+ | $IP6TB -A INPUT -i $PUBIF -p udp -m multiport --dports | ||
- | ############# | ||
- | $IPT6 -A INPUT -i $PUBIF -p tcp -m state --syn --state NEW --destination-port 22 -j ACCEPT | ||
- | #### no need to edit below ### | ||
# log everything else | # log everything else | ||
- | $IPT6 -A INPUT -j LOG | + | $IP6TB -A INPUT -j LOG |
- | $IPT6 -A INPUT -j DROP | + | $IP6TB -A INPUT -j DROP |
+ | |||
+ | |||
+ | # OUTPUT | ||
+ | |||
+ | $IP6TB -A OUTPUT -o $PUBIF -p icmpv6 --icmpv6-type 128 -m limit --limit 900/min -j ACCEPT | ||
+ | $IP6TB -A OUTPUT -o $PUBIF -p icmpv6 --icmpv6-type 129 -m limit --limit 900/min -j ACCEPT | ||
+ | |||
+ | for icmptype in 133 134 135 136 137 | ||
+ | do | ||
+ | $IP6TB -A OUTPUT -p icmpv6 --icmpv6-type $icmptype -m hl --hl-eq 255 -j ACCEPT | ||
+ | done | ||
+ | # Allow RFC 4890 but with rate-limiting | ||
+ | for icmptype in 1 2 3 4 130 131 132 141 142 143 148 149 151 152 | ||
+ | do | ||
+ | $IP6TB -A OUTPUT -p icmpv6 --icmpv6-type $icmptype -m limit --limit 900/min -j ACCEPT | ||
+ | done | ||
+ | # list the rules | ||
+ | $IP6TB -L -v -n | ||
</ | </ |