Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
|
linux:firewall [2010/12/30 13:26] greebo |
linux:firewall [2012/02/21 13:24] greebo |
||
|---|---|---|---|
| Line 32: | Line 32: | ||
| # use INTRANET=" | # use INTRANET=" | ||
| # if you have more ifaces (example: eth0: | # if you have more ifaces (example: eth0: | ||
| - | INTRANET=" | + | # |
| + | # WAN Interface | ||
| INTERNET=" | INTERNET=" | ||
| # ADSL - INTERNET=" | # ADSL - INTERNET=" | ||
| + | # | ||
| + | # LAN Interface | ||
| + | INTRANET=" | ||
| | | ||
| # what IPs are used in intranet | # what IPs are used in intranet | ||
| Line 118: | Line 122: | ||
| # we allow all traffic from $INTRANET and localhost interfaces | # we allow all traffic from $INTRANET and localhost interfaces | ||
| - | $IPTB -A INPUT -i $INTRANET -j ACCEPT | + | $IPTB -A INPUT -i $INTRANET |
| - | $IPTB -A INPUT -i lo -j ACCEPT | + | $IPTB -A INPUT -i lo -m state --state NEW, |
| - | #$IPTB -A INPUT -m state --state INVALID -m limit --limit 1/minute -j LOG --log-prefix "INVALID | + | $IPTB -A INPUT -m state --state INVALID -m limit --limit 1/minute -j LOG --log-prefix " |
| - | #$IPTB -A INPUT -m state --state INVALID -j DROP | + | $IPTB -A INPUT -m state --state INVALID -j DROP |
| # | # | ||
| Line 159: | Line 163: | ||
| $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP | $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP | ||
| - | $IPTB -A INPUT -f -j LOG --log-prefix " | + | $IPTB -A INPUT -f -j LOG --log-prefix "Lost FRAGMENT> |
| $IPTB -A INPUT -f -j DROP | $IPTB -A INPUT -f -j DROP | ||
| Line 181: | Line 185: | ||
| for i in $TCP_PORTS | for i in $TCP_PORTS | ||
| do | do | ||
| - | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport $i -j ACCEPT | + | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport $i -j ACCEPT |
| done | done | ||
| Line 190: | Line 194: | ||
| $IPTB -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset | $IPTB -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset | ||
| - | # traceroute | + | # traceroute |
| $IPTB -A INPUT -p udp -m limit --limit 3/ | $IPTB -A INPUT -p udp -m limit --limit 3/ | ||
| # Log and drop ICMP fragments (shouldn not happen at all, but often used for DoS) | # Log and drop ICMP fragments (shouldn not happen at all, but often used for DoS) | ||
| $IPTB -A INPUT -i $INTERNET --fragment -p icmp -j LOG --log-prefix " | $IPTB -A INPUT -i $INTERNET --fragment -p icmp -j LOG --log-prefix " | ||
| - | $IPTB -A INPUT -i $INTERNET --fragment -p icmp -j DROP | + | $IPTB -A INPUT -i $INTERNET --fragment -p icmp -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp-frag |
| # thou shall NOT block ALL ICMP, but only allow usefull ICMP types to pass trough | # thou shall NOT block ALL ICMP, but only allow usefull ICMP types to pass trough | ||
| Line 239: | Line 243: | ||
| # ADSL (PPPoE connections) | # ADSL (PPPoE connections) | ||
| - | #$IPTB -I FORWARD --protocol | + | #$IPTB -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu |
| $IPTB -I FORWARD -o $INTERNET -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu | $IPTB -I FORWARD -o $INTERNET -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu | ||
| Line 253: | Line 257: | ||
| | | ||
| # list the rules | # list the rules | ||
| - | $IPTB -L -v -n | + | $IPTB -L -v -n --line |
| + | $IPTB -t nat -L -v -n --line | ||
| | | ||
| echo $WE_HAVE_INTRANET > / | echo $WE_HAVE_INTRANET > / | ||
| </ | </ | ||
