Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
linux:firewall [2009/06/24 11:17] greebo |
linux:firewall [2010/12/29 10:16] greebo |
||
---|---|---|---|
Line 1: | Line 1: | ||
[[linux: | [[linux: | ||
+ | [[linux: | ||
[[http:// | [[http:// | ||
+ | |||
<code bash |> | <code bash |> | ||
Line 8: | Line 10: | ||
echo "* Running $0" | echo "* Running $0" | ||
echo " | echo " | ||
+ | echo "* http:// | ||
echo | echo | ||
Line 48: | Line 51: | ||
# what UDP ports/ | # what UDP ports/ | ||
# use "," | # use "," | ||
- | UDP_PORTS=" | + | UDP_PORTS=" |
# which ports we forward into our intranet | # which ports we forward into our intranet | ||
Line 57: | Line 60: | ||
WE_HAVE_INTRANET=" | WE_HAVE_INTRANET=" | ||
+ | # | ||
TRUSTED_HOSTS=" | TRUSTED_HOSTS=" | ||
212.93.224.0/ | 212.93.224.0/ | ||
Line 72: | Line 76: | ||
$IPTB -t nat -F | $IPTB -t nat -F | ||
+ | # new chain for SSH and HTTP access | ||
$IPTB -N ssh-access | $IPTB -N ssh-access | ||
$IPTB -N http-access | $IPTB -N http-access | ||
- | | ||
# port redirection (transparent proxy) | # port redirection (transparent proxy) | ||
# redirect all outgoing traffic that is NOT for the GW to local (GW) ports | # redirect all outgoing traffic that is NOT for the GW to local (GW) ports | ||
+ | # DNS (53/tcp and 53/udp) and SMTP (25/tcp) | ||
#$IPTB -t nat -A PREROUTING -i ! $INTERNET -p tcp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | #$IPTB -t nat -A PREROUTING -i ! $INTERNET -p tcp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | ||
#$IPTB -t nat -A PREROUTING -i ! $INTERNET -p udp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | #$IPTB -t nat -A PREROUTING -i ! $INTERNET -p udp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | ||
Line 88: | Line 93: | ||
$IPTB -A INPUT -m state --state ESTABLISHED, | $IPTB -A INPUT -m state --state ESTABLISHED, | ||
- | # Connection limit for SSH connections (3 connection per minute) - usefull agains ssh scanners if you MUST open SSH for every IP! | + | # move all SSH and HTTP traffic |
- | # it is wise to use sshaccess input table (TRUSTED_HOSTS) | + | |
- | #$IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 3/minute --limit-burst 1 -j ACCESS | + | |
- | #$IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j DROP | + | |
$IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j ssh-access | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j ssh-access | ||
$IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 80 -j http-access | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 80 -j http-access | ||
- | # ssh | + | # ssh chain |
for sshhostese in $TRUSTED_HOSTS; | for sshhostese in $TRUSTED_HOSTS; | ||
do | do | ||
$IPTB -A ssh-access -s $sshhostese -j ACCEPT | $IPTB -A ssh-access -s $sshhostese -j ACCEPT | ||
done | done | ||
+ | # Connection limit for SSH connections (1 connection per minute) - usefull against ssh scanners if you MUST open SSH for every IP! | ||
+ | # it is wise to use sshaccess input table (TRUSTED_HOSTS) | ||
+ | $IPTB -A ssh-access -m limit --limit 1/minute --limit-burst 1 -j ACCEPT | ||
+ | $IPTB -A ssh-access -j DROP | ||
# ssh | # ssh | ||
Line 109: | Line 114: | ||
done | done | ||
# http | # http | ||
- | |||
# IPSEC | # IPSEC | ||
Line 157: | Line 161: | ||
$IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP | $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP | ||
$IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j LOG --log-prefix " | $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j LOG --log-prefix " | ||
- | |||
$IPTB -A INPUT -f -j LOG --log-prefix " | $IPTB -A INPUT -f -j LOG --log-prefix " | ||
Line 178: | Line 181: | ||
$IPTB -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP | $IPTB -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP | ||
- | + | # what we allow from Internet | |
- | # what we allow from Internet | + | |
for i in $TCP_PORTS | for i in $TCP_PORTS | ||
do | do | ||
$IPTB -A INPUT -p tcp -m state --syn --state NEW --dport $i -j ACCEPT | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport $i -j ACCEPT | ||
- | | + | |
+ | # what we allow from Internet - UDP ports | ||
$IPTB -A INPUT -p udp -m multiport --dport $UDP_PORTS -j ACCEPT | $IPTB -A INPUT -p udp -m multiport --dport $UDP_PORTS -j ACCEPT | ||
Line 239: | Line 242: | ||
$IPTB -t nat -A POSTROUTING -o $INTERNET -s $LAN -j SNAT --to-source $GW_IP | $IPTB -t nat -A POSTROUTING -o $INTERNET -s $LAN -j SNAT --to-source $GW_IP | ||
- | # adsl | + | # ADSL (PPPoE connections) |
#$IPTB -I FORWARD --protocol tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu | #$IPTB -I FORWARD --protocol tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu | ||
$IPTB -I FORWARD -o $INTERNET -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu | $IPTB -I FORWARD -o $INTERNET -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu | ||
Line 246: | Line 249: | ||
# in " | # in " | ||
#for mac in `cat valid-macs`; | #for mac in `cat valid-macs`; | ||
+ | |||
+ | # OUTPUT | ||
+ | $IPTB -P OUTPUT DROP | ||
+ | |||
+ | # only allow NEW and related connections out | ||
+ | $IPTB -A OUTPUT -m state --state NEW, | ||
| | ||
# list the rules | # list the rules |