Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision | Next revision Both sides next revision | ||
|
linux:firewall [2010/12/29 10:03] greebo |
linux:firewall [2010/12/29 10:16] greebo |
||
|---|---|---|---|
| Line 10: | Line 10: | ||
| echo "* Running $0" | echo "* Running $0" | ||
| echo " | echo " | ||
| + | echo "* http:// | ||
| echo | echo | ||
| Line 59: | Line 60: | ||
| WE_HAVE_INTRANET=" | WE_HAVE_INTRANET=" | ||
| + | # | ||
| TRUSTED_HOSTS=" | TRUSTED_HOSTS=" | ||
| 212.93.224.0/ | 212.93.224.0/ | ||
| Line 74: | Line 76: | ||
| $IPTB -t nat -F | $IPTB -t nat -F | ||
| + | # new chain for SSH and HTTP access | ||
| $IPTB -N ssh-access | $IPTB -N ssh-access | ||
| $IPTB -N http-access | $IPTB -N http-access | ||
| - | | + | # port redirection (transparent proxy) |
| # redirect all outgoing traffic that is NOT for the GW to local (GW) ports | # redirect all outgoing traffic that is NOT for the GW to local (GW) ports | ||
| + | # DNS (53/tcp and 53/udp) and SMTP (25/tcp) | ||
| #$IPTB -t nat -A PREROUTING -i ! $INTERNET -p tcp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | #$IPTB -t nat -A PREROUTING -i ! $INTERNET -p tcp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | ||
| #$IPTB -t nat -A PREROUTING -i ! $INTERNET -p udp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | #$IPTB -t nat -A PREROUTING -i ! $INTERNET -p udp -s $LAN -d ! $LAN --dport 53 -j REDIRECT | ||
| Line 89: | Line 93: | ||
| $IPTB -A INPUT -m state --state ESTABLISHED, | $IPTB -A INPUT -m state --state ESTABLISHED, | ||
| + | # move all SSH and HTTP traffic to apropriate chains | ||
| $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j ssh-access | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j ssh-access | ||
| $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 80 -j http-access | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 80 -j http-access | ||
| - | # ssh | + | # ssh chain |
| for sshhostese in $TRUSTED_HOSTS; | for sshhostese in $TRUSTED_HOSTS; | ||
| do | do | ||
| Line 156: | Line 161: | ||
| $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP | $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP | ||
| $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j LOG --log-prefix " | $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j LOG --log-prefix " | ||
| - | |||
| $IPTB -A INPUT -f -j LOG --log-prefix " | $IPTB -A INPUT -f -j LOG --log-prefix " | ||
| Line 177: | Line 181: | ||
| $IPTB -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP | $IPTB -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP | ||
| - | + | # what we allow from Internet | |
| - | # what we allow from Internet | + | |
| for i in $TCP_PORTS | for i in $TCP_PORTS | ||
| do | do | ||
| $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport $i -j ACCEPT | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport $i -j ACCEPT | ||
| - | | + | |
| + | # what we allow from Internet - UDP ports | ||
| $IPTB -A INPUT -p udp -m multiport --dport $UDP_PORTS -j ACCEPT | $IPTB -A INPUT -p udp -m multiport --dport $UDP_PORTS -j ACCEPT | ||
