Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
linux:firewall [2008/11/28 12:04] a |
linux:firewall [2011/01/10 12:13] greebo |
||
---|---|---|---|
Line 1: | Line 1: | ||
- | [[linux: | + | [[linux: |
+ | [[linux: | ||
+ | [[http:// | ||
- | <code bash> | + | <code bash |> |
#!/bin/bash | #!/bin/bash | ||
Line 7: | Line 9: | ||
echo "* Running $0" | echo "* Running $0" | ||
echo " | echo " | ||
+ | echo "* http:// | ||
echo | echo | ||
Line 16: | Line 19: | ||
TNX_IDIOT=" | TNX_IDIOT=" | ||
- | echo " how iptables work in linux kernel | + | echo " how iptables work in linux kernel" |
echo | echo | ||
echo "> | echo "> | ||
Line 23: | Line 26: | ||
# path to iptables and iproute2 files | # path to iptables and iproute2 files | ||
- | |||
IPTB="/ | IPTB="/ | ||
IP="/ | IP="/ | ||
# name of our Internet and intranet interfaces | # name of our Internet and intranet interfaces | ||
- | INTRANET=" | + | # use INTRANET=" |
+ | # if you have more ifaces (example: eth0: | ||
+ | # | ||
+ | # WAN Interface | ||
INTERNET=" | INTERNET=" | ||
# ADSL - INTERNET=" | # ADSL - INTERNET=" | ||
+ | # | ||
+ | # LAN Interface | ||
+ | INTRANET=" | ||
| | ||
# what IPs are used in intranet | # what IPs are used in intranet | ||
Line 40: | Line 48: | ||
# what TCP ports/ | # what TCP ports/ | ||
# use " " as delimiter | # use " " as delimiter | ||
- | TCP_PORTS=" | + | TCP_PORTS=" |
# what UDP ports/ | # what UDP ports/ | ||
# use "," | # use "," | ||
- | UDP_PORTS=" | + | UDP_PORTS=" |
# which ports we forward into our intranet | # which ports we forward into our intranet | ||
Line 52: | Line 60: | ||
# set to 1 if we you have intranet | # set to 1 if we you have intranet | ||
WE_HAVE_INTRANET=" | WE_HAVE_INTRANET=" | ||
- | | + | |
+ | # | ||
+ | TRUSTED_HOSTS=" | ||
+ | 212.93.224.0/ | ||
+ | 212.18.32.0/ | ||
echo " | echo " | ||
# first we flush the tables and policy | # first we flush the tables and policy | ||
$IPTB -F | $IPTB -F | ||
+ | $IPTB -X | ||
$IPTB -F INPUT | $IPTB -F INPUT | ||
$IPTB -F FORWARD | $IPTB -F FORWARD | ||
$IPTB -F OUTPUT | $IPTB -F OUTPUT | ||
+ | |||
$IPTB -t nat -F | $IPTB -t nat -F | ||
- | | + | |
+ | # new chain for SSH and HTTP access | ||
+ | $IPTB -N ssh-access | ||
+ | $IPTB -N http-access | ||
# port redirection (transparent proxy) | # port redirection (transparent proxy) | ||
+ | # redirect all outgoing traffic that is NOT for the GW to local (GW) ports | ||
+ | # DNS (53/tcp and 53/udp) and SMTP (25/tcp) | ||
#$IPTB -t nat -A PREROUTING -i ! $INTERNET -p tcp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | #$IPTB -t nat -A PREROUTING -i ! $INTERNET -p tcp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | ||
#$IPTB -t nat -A PREROUTING -i ! $INTERNET -p udp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | #$IPTB -t nat -A PREROUTING -i ! $INTERNET -p udp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | ||
Line 70: | Line 91: | ||
$IPTB -P INPUT DROP | $IPTB -P INPUT DROP | ||
- | # statefull firewall | + | # statefull firewall |
$IPTB -A INPUT -m state --state ESTABLISHED, | $IPTB -A INPUT -m state --state ESTABLISHED, | ||
+ | |||
+ | # move all SSH and HTTP traffic to apropriate chains | ||
+ | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j ssh-access | ||
+ | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 80 -j http-access | ||
+ | |||
+ | # ssh chain | ||
+ | for sshhostese in $TRUSTED_HOSTS; | ||
+ | do | ||
+ | $IPTB -A ssh-access -s $sshhostese -j ACCEPT | ||
+ | done | ||
+ | # Connection limit for SSH connections (1 connection per minute PER source IP) | ||
+ | # - usefull against ssh scanners if you MUST open SSH for every IP! | ||
+ | $IPTB -A ssh-access -m hashlimit --hashlimit 1/minute --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name ssh -j ACCEPT | ||
+ | $IPTB -A ssh-access -j DROP | ||
+ | # ssh | ||
+ | |||
+ | # http | ||
+ | for httphostese in $TRUSTED_HOSTS; | ||
+ | do | ||
+ | $IPTB -A http-access -s $httphostese -j ACCEPT | ||
+ | done | ||
+ | # http | ||
# IPSEC | # IPSEC | ||
Line 79: | Line 122: | ||
# we allow all traffic from $INTRANET and localhost interfaces | # we allow all traffic from $INTRANET and localhost interfaces | ||
- | $IPTB -A INPUT -i $INTRANET -j ACCEPT | + | $IPTB -A INPUT -i $INTRANET |
- | $IPTB -A INPUT -i lo -j ACCEPT | + | $IPTB -A INPUT -i lo -m state --state NEW, |
- | #$IPTB -A INPUT -m state --state INVALID -m limit --limit 1/minute -j LOG --log-prefix "INVALID | + | $IPTB -A INPUT -m state --state INVALID -m limit --limit 1/minute -j LOG --log-prefix " |
- | #$IPTB -A INPUT -m state --state INVALID -j DROP | + | $IPTB -A INPUT -m state --state INVALID -j DROP |
# | # | ||
Line 90: | Line 133: | ||
#FIN is set and ACK is not | #FIN is set and ACK is not | ||
- | $IPTB -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP | ||
$IPTB -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j LOG --log-prefix " | $IPTB -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j LOG --log-prefix " | ||
+ | $IPTB -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP | ||
#PSH is set and ACK is not | #PSH is set and ACK is not | ||
- | $IPTB -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP | ||
$IPTB -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j LOG --log-prefix " | $IPTB -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j LOG --log-prefix " | ||
+ | $IPTB -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP | ||
#URG is set and ACK is not | #URG is set and ACK is not | ||
- | $IPTB -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP | ||
$IPTB -A INPUT -p tcp --tcp-flags ACK,URG URG -j LOG --log-prefix " | $IPTB -A INPUT -p tcp --tcp-flags ACK,URG URG -j LOG --log-prefix " | ||
+ | $IPTB -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP | ||
# Block portscans: | # Block portscans: | ||
Line 117: | Line 160: | ||
#FIN and RST are both set | #FIN and RST are both set | ||
+ | $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j LOG --log-prefix " | ||
$IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP | $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP | ||
- | $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j LOG --log-prefix " | ||
- | |||
$IPTB -A INPUT -f -j LOG --log-prefix " | $IPTB -A INPUT -f -j LOG --log-prefix " | ||
Line 140: | Line 182: | ||
$IPTB -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP | $IPTB -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP | ||
- | # Connection limit for SSH connections ( 1 connection per minute) | + | # what we allow from Internet |
- | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT | + | |
- | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j DROP | + | |
- | + | ||
- | # what we allow from Internet | + | |
for i in $TCP_PORTS | for i in $TCP_PORTS | ||
do | do | ||
- | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport $i -j ACCEPT | + | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport $i -j ACCEPT |
- | done | + | done |
+ | # what we allow from Internet - UDP ports | ||
$IPTB -A INPUT -p udp -m multiport --dport $UDP_PORTS -j ACCEPT | $IPTB -A INPUT -p udp -m multiport --dport $UDP_PORTS -j ACCEPT | ||
Line 155: | Line 194: | ||
$IPTB -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset | $IPTB -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset | ||
- | # traceroute | + | # traceroute |
$IPTB -A INPUT -p udp -m limit --limit 3/ | $IPTB -A INPUT -p udp -m limit --limit 3/ | ||
Line 163: | Line 202: | ||
# thou shall NOT block ALL ICMP, but only allow usefull ICMP types to pass trough | # thou shall NOT block ALL ICMP, but only allow usefull ICMP types to pass trough | ||
- | $IPTB -A INPUT -p icmp --icmp-type 0 -m limit --limit 30/second -j ACCEPT | + | $IPTB -A INPUT -p icmp --icmp-type 0 -m hashlimit |
- | $IPTB -A INPUT -p icmp --icmp-type 3 -m limit --limit 30/second -j ACCEPT | + | $IPTB -A INPUT -p icmp --icmp-type 3 -m hashlimit |
- | $IPTB -A INPUT -p icmp --icmp-type 4 -m limit --limit 30/second -j ACCEPT | + | $IPTB -A INPUT -p icmp --icmp-type 4 -m hashlimit |
- | $IPTB -A INPUT -p icmp --icmp-type 11 -m limit --limit 30/second -j ACCEPT | + | $IPTB -A INPUT -p icmp --icmp-type 11 -m hashlimit |
- | $IPTB -A INPUT -p icmp --icmp-type 12 -m limit --limit 30/second -j ACCEPT | + | $IPTB -A INPUT -p icmp --icmp-type 12 -m hashlimit |
# | # | ||
- | $IPTB -A INPUT -p icmp --icmp-type 30 -m limit --limit 30/second -j ACCEPT | + | $IPTB -A INPUT -p icmp --icmp-type 30 -m hashlimit |
# echo-request | # echo-request | ||
- | $IPTB -A INPUT -p icmp --icmp-type 8 -m limit --limit 3/second -j ACCEPT | + | $IPTB -A INPUT -p icmp --icmp-type 8 -m hashlimit |
# if the default policy is not DROP then we must use this | # if the default policy is not DROP then we must use this | ||
Line 204: | Line 242: | ||
$IPTB -t nat -A POSTROUTING -o $INTERNET -s $LAN -j SNAT --to-source $GW_IP | $IPTB -t nat -A POSTROUTING -o $INTERNET -s $LAN -j SNAT --to-source $GW_IP | ||
- | # adsl | + | # ADSL (PPPoE connections) |
- | #$IPTB -I FORWARD --protocol | + | #$IPTB -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu |
$IPTB -I FORWARD -o $INTERNET -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu | $IPTB -I FORWARD -o $INTERNET -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu | ||
Line 211: | Line 249: | ||
# in " | # in " | ||
#for mac in `cat valid-macs`; | #for mac in `cat valid-macs`; | ||
+ | |||
+ | # OUTPUT | ||
+ | $IPTB -P OUTPUT DROP | ||
+ | |||
+ | # only allow NEW and related connections out | ||
+ | $IPTB -A OUTPUT -m state --state NEW, | ||
| | ||
# list the rules | # list the rules | ||
- | $IPTB -L -v -n | + | $IPTB -L -v -n --line |
+ | $IPTB -t nat -L -v -n --line | ||
| | ||
echo $WE_HAVE_INTRANET > / | echo $WE_HAVE_INTRANET > / | ||
</ | </ |