Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
linux:firewall [2010/12/30 12:54]
greebo
linux:firewall [2019/04/15 10:18]
zagi
Line 32: Line 32:
 # use INTRANET="eth1+" or INTERNET="eth0+" # use INTRANET="eth1+" or INTERNET="eth0+"
 # if you have more ifaces (example: eth0:0)  towards Intranet/Internet # if you have more ifaces (example: eth0:0)  towards Intranet/Internet
-INTRANET="eth1"+
 +# WAN Interface
 INTERNET="eth0" INTERNET="eth0"
 # ADSL - INTERNET="ppp0" # ADSL - INTERNET="ppp0"
 +#
 +# LAN Interface
 +INTRANET="eth1"
      
 # what IPs are used in intranet # what IPs are used in intranet
Line 62: Line 66:
 212.18.32.0/24" 212.18.32.0/24"
  
 +# enable IP forwarding (routing!)
 echo "0" > /proc/sys/net/ipv4/ip_forward echo "0" > /proc/sys/net/ipv4/ip_forward
 +
 +# enable PMTU (mss/mtu discovery)
 +echo "1" > /proc/sys/net/ipv4/tcp_mtu_probing
  
 # first we flush the tables and policy # first we flush the tables and policy
Line 118: Line 126:
  
 # we allow all traffic from $INTRANET and localhost interfaces # we allow all traffic from $INTRANET and localhost interfaces
-$IPTB -A INPUT -i $INTRANET -j ACCEPT +$IPTB -A INPUT -i $INTRANET -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT 
-$IPTB -A INPUT -i lo -j ACCEPT+$IPTB -A INPUT -i lo  -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
  
-#$IPTB -A INPUT -m state --state INVALID -m limit --limit 1/minute -j LOG --log-prefix "INVALID packet> " +$IPTB -A INPUT -m state --state INVALID -m limit --limit 1/minute -j LOG --log-prefix "packet not in conntrack> " 
-#$IPTB -A INPUT -m state --state INVALID -j DROP+$IPTB -A INPUT -m state --state INVALID -j DROP
  
 # #
Line 129: Line 137:
    
 #FIN is set and ACK is not #FIN is set and ACK is not
-$IPTB -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP 
 $IPTB -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j LOG --log-prefix "FIN> " $IPTB -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j LOG --log-prefix "FIN> "
 +$IPTB -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
  
 #PSH is set and ACK is not #PSH is set and ACK is not
-$IPTB -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP 
 $IPTB -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j LOG --log-prefix "PSH> " $IPTB -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j LOG --log-prefix "PSH> "
 +$IPTB -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
  
 #URG is set and ACK is not #URG is set and ACK is not
-$IPTB  -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP 
 $IPTB  -A INPUT -p tcp --tcp-flags ACK,URG URG -j LOG --log-prefix "URG> " $IPTB  -A INPUT -p tcp --tcp-flags ACK,URG URG -j LOG --log-prefix "URG> "
 +$IPTB  -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
  
 # Block portscans: # Block portscans:
Line 156: Line 164:
  
 #FIN and RST are both set #FIN and RST are both set
-$IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP 
 $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j LOG --log-prefix "fin/rts flag>" $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j LOG --log-prefix "fin/rts flag>"
 +$IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
  
-$IPTB -A INPUT -f -j LOG --log-prefix "FRAGMENT> "+$IPTB -A INPUT -f -j LOG --log-prefix "Lost FRAGMENT> "
 $IPTB -A INPUT -f -j DROP $IPTB -A INPUT -f -j DROP
  
Line 181: Line 189:
 for i in $TCP_PORTS for i in $TCP_PORTS
  do  do
- $IPTB -A INPUT -p tcp -m state --syn --state NEW  --dport $i -j ACCEPT+ $IPTB -A INPUT -p tcp -m state --syn --state NEW  --dport $i -j ACCEPT
         done         done
  
Line 190: Line 198:
 $IPTB -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset $IPTB -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset
  
-# traceroute+# traceroute (udp - IOS, Uni*es)
 $IPTB -A INPUT -p udp -m limit --limit 3/second  --sport 32769:65535 --dport 33434:33523 -j ACCEPT $IPTB -A INPUT -p udp -m limit --limit 3/second  --sport 32769:65535 --dport 33434:33523 -j ACCEPT
  
 # Log and drop ICMP fragments (shouldn not happen at all, but often used for DoS) # Log and drop ICMP fragments (shouldn not happen at all, but often used for DoS)
 $IPTB -A INPUT -i $INTERNET --fragment -p icmp -j LOG --log-prefix "Fragmented incoming ICMP> " $IPTB -A INPUT -i $INTERNET --fragment -p icmp -j LOG --log-prefix "Fragmented incoming ICMP> "
-$IPTB -A INPUT -i $INTERNET --fragment -p icmp -j DROP+$IPTB -A INPUT -i $INTERNET --fragment -p icmp -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp-frag -j ACCEPT
  
 # thou shall NOT block ALL ICMP, but only allow usefull ICMP types to pass trough # thou shall NOT block ALL ICMP, but only allow usefull ICMP types to pass trough
-$IPTB -A INPUT -p icmp --icmp-type 0  -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp0 -j  +# echo-reply 
-#$IPTB -A INPUT -p icmp --icmp-type 0  -m limit --limit 30/second -j ACCEPT +#$IPTB -A INPUT -p icmp --icmp-type 0 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp0 -j ACCEPT 
-$IPTB -A INPUT -p icmp --icmp-type 3  -m limit --limit 30/second -j ACCEPT +unreachables 
-$IPTB -A INPUT -p icmp --icmp-type 4  -m limit --limit 30/second -j ACCEPT +$IPTB -A INPUT -p icmp --icmp-type -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp3 -j ACCEPT 
-$IPTB -A INPUT -p icmp --icmp-type 11 -m limit --limit 30/second -j ACCEPT +# source-quench (depreciated) 
-$IPTB -A INPUT -p icmp --icmp-type 12 -m limit --limit 30/second -j ACCEPT+#$IPTB -A INPUT -p icmp --icmp-type 4 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp4 -j ACCEPT 
 +# timeout (forward loop prevention) 
 +$IPTB -A INPUT -p icmp --icmp-type 11 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp11 -j ACCEPT 
 +# parameter problem 
 +$IPTB -A INPUT -p icmp --icmp-type 12 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp12 -j ACCEPT
 #icmp-traceroute #icmp-traceroute
-$IPTB -A INPUT -p icmp --icmp-type 30 -m limit --limit 30/second -j ACCEPT +$IPTB -A INPUT -p icmp --icmp-type 30 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp30 -j ACCEPT
 # echo-request # echo-request
-$IPTB -A INPUT -p icmp --icmp-type 8  -m limit --limit 3/second -j ACCEPT+$IPTB -A INPUT -p icmp --icmp-type 8 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp8 -j ACCEPT
  
 # if the default policy is not DROP then we must use this # if the default policy is not DROP then we must use this
Line 229: Line 240:
 $IPTB -A FORWARD -m state --state INVALID -j DROP $IPTB -A FORWARD -m state --state INVALID -j DROP
 $IPTB -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTB -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-$IPTB -A FORWARD -m state --state NEW -i $INTERNET -j ACCEPT+$IPTB -A FORWARD -m state --state NEW -i $INTERNET -j ACCEPT
  
 $IPTB -A FORWARD -m pkttype --pkt-type broadcast -j DROP $IPTB -A FORWARD -m pkttype --pkt-type broadcast -j DROP
Line 241: Line 252:
  
 # ADSL (PPPoE connections) # ADSL (PPPoE connections)
-#$IPTB -I FORWARD --protocol tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu+#$IPTB -I FORWARD -tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
 $IPTB -I FORWARD -o $INTERNET -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu $IPTB -I FORWARD -o $INTERNET -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu
  
Line 255: Line 266:
      
 # list the rules # list the rules
-$IPTB -L -v -n+$IPTB -L -v -n --line 
 +$IPTB -t nat -L -v -n --line
      
 echo $WE_HAVE_INTRANET > /proc/sys/net/ipv4/ip_forward echo $WE_HAVE_INTRANET > /proc/sys/net/ipv4/ip_forward
  
 </code> </code>
linux/firewall.txt · Last modified: 2019/04/15 10:18 by zagi
CC Attribution-Share Alike 4.0 International
Driven by DokuWiki Recent changes RSS feed Valid CSS Valid XHTML 1.0 ipv6 ready