Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
|
linux:firewall [2009/05/25 00:35] 127.0.0.1 external edit |
linux:firewall [2010/12/29 10:03] greebo |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| [[linux: | [[linux: | ||
| + | [[linux: | ||
| [[http:// | [[http:// | ||
| - | <code bash> | + | |
| + | <code bash |> | ||
| #!/bin/bash | #!/bin/bash | ||
| Line 29: | Line 31: | ||
| # name of our Internet and intranet interfaces | # name of our Internet and intranet interfaces | ||
| + | # | ||
| + | # use INTRANET=" | ||
| + | # if you have more ifaces (example: eth0: | ||
| INTRANET=" | INTRANET=" | ||
| INTERNET=" | INTERNET=" | ||
| Line 41: | Line 46: | ||
| # what TCP ports/ | # what TCP ports/ | ||
| # use " " as delimiter | # use " " as delimiter | ||
| - | TCP_PORTS=" | + | TCP_PORTS=" |
| # what UDP ports/ | # what UDP ports/ | ||
| # use "," | # use "," | ||
| - | UDP_PORTS=" | + | UDP_PORTS=" |
| # which ports we forward into our intranet | # which ports we forward into our intranet | ||
| Line 56: | Line 61: | ||
| TRUSTED_HOSTS=" | TRUSTED_HOSTS=" | ||
| 212.93.224.0/ | 212.93.224.0/ | ||
| - | 212.18.32.0\24" | + | 212.18.32.0/24" |
| echo " | echo " | ||
| Line 72: | Line 77: | ||
| $IPTB -N http-access | $IPTB -N http-access | ||
| - | | + | # port redirection (transparent proxy) |
| - | # port redirection (transparent proxy) | + | # redirect all outgoing traffic that is NOT for the GW to local (GW) ports |
| #$IPTB -t nat -A PREROUTING -i ! $INTERNET -p tcp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | #$IPTB -t nat -A PREROUTING -i ! $INTERNET -p tcp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | ||
| #$IPTB -t nat -A PREROUTING -i ! $INTERNET -p udp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | #$IPTB -t nat -A PREROUTING -i ! $INTERNET -p udp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | ||
| Line 92: | Line 97: | ||
| $IPTB -A ssh-access -s $sshhostese -j ACCEPT | $IPTB -A ssh-access -s $sshhostese -j ACCEPT | ||
| done | done | ||
| + | # Connection limit for SSH connections (1 connection per minute) - usefull against ssh scanners if you MUST open SSH for every IP! | ||
| + | # it is wise to use sshaccess input table (TRUSTED_HOSTS) | ||
| + | $IPTB -A ssh-access -m limit --limit 1/minute --limit-burst 1 -j ACCEPT | ||
| + | $IPTB -A ssh-access -j DROP | ||
| # ssh | # ssh | ||
| Line 100: | Line 109: | ||
| done | done | ||
| # http | # http | ||
| - | |||
| # IPSEC | # IPSEC | ||
| Line 169: | Line 177: | ||
| $IPTB -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP | $IPTB -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP | ||
| - | # Connection limit for SSH connections ( 1 connection per minute) - usefull agains ssh scanners if you MUST open SSH for every IP! | ||
| - | # it is wise to use sshaccess input table (TRUSTED_HOSTS) | ||
| - | #$IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT | ||
| - | #$IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j DROP | ||
| # what we allow from Internet | # what we allow from Internet | ||
| Line 234: | Line 238: | ||
| $IPTB -t nat -A POSTROUTING -o $INTERNET -s $LAN -j SNAT --to-source $GW_IP | $IPTB -t nat -A POSTROUTING -o $INTERNET -s $LAN -j SNAT --to-source $GW_IP | ||
| - | # adsl | + | # ADSL (PPPoE connections) |
| #$IPTB -I FORWARD --protocol tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu | #$IPTB -I FORWARD --protocol tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu | ||
| $IPTB -I FORWARD -o $INTERNET -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu | $IPTB -I FORWARD -o $INTERNET -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu | ||
| Line 241: | Line 245: | ||
| # in " | # in " | ||
| #for mac in `cat valid-macs`; | #for mac in `cat valid-macs`; | ||
| + | |||
| + | # OUTPUT | ||
| + | $IPTB -P OUTPUT DROP | ||
| + | |||
| + | # only allow NEW and related connections out | ||
| + | $IPTB -A OUTPUT -m state --state NEW, | ||
| | | ||
| # list the rules | # list the rules | ||
