Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
linux:firewall [2010/12/29 10:16] greebo |
linux:firewall [2019/04/15 10:18] (current) zagi |
||
---|---|---|---|
Line 2: | Line 2: | ||
[[linux: | [[linux: | ||
[[http:// | [[http:// | ||
- | |||
<code bash |> | <code bash |> | ||
Line 27: | Line 26: | ||
# path to iptables and iproute2 files | # path to iptables and iproute2 files | ||
- | |||
IPTB="/ | IPTB="/ | ||
IP="/ | IP="/ | ||
# name of our Internet and intranet interfaces | # name of our Internet and intranet interfaces | ||
- | # | ||
# use INTRANET=" | # use INTRANET=" | ||
# if you have more ifaces (example: eth0: | # if you have more ifaces (example: eth0: | ||
- | INTRANET=" | + | # |
+ | # WAN Interface | ||
INTERNET=" | INTERNET=" | ||
# ADSL - INTERNET=" | # ADSL - INTERNET=" | ||
+ | # | ||
+ | # LAN Interface | ||
+ | INTRANET=" | ||
| | ||
# what IPs are used in intranet | # what IPs are used in intranet | ||
Line 65: | Line 66: | ||
212.18.32.0/ | 212.18.32.0/ | ||
+ | # enable IP forwarding (routing!) | ||
echo " | echo " | ||
+ | |||
+ | # enable PMTU (mss/mtu discovery) | ||
+ | echo " | ||
# first we flush the tables and policy | # first we flush the tables and policy | ||
Line 102: | Line 107: | ||
$IPTB -A ssh-access -s $sshhostese -j ACCEPT | $IPTB -A ssh-access -s $sshhostese -j ACCEPT | ||
done | done | ||
- | # Connection limit for SSH connections (1 connection per minute) - usefull against ssh scanners if you MUST open SSH for every IP! | + | # Connection limit for SSH connections (1 connection per minute |
- | # it is wise to use sshaccess input table (TRUSTED_HOSTS) | + | # |
- | $IPTB -A ssh-access -m limit --limit 1/minute --limit-burst 1 -j ACCEPT | + | $IPTB -A ssh-access -m hashlimit |
$IPTB -A ssh-access -j DROP | $IPTB -A ssh-access -j DROP | ||
# ssh | # ssh | ||
Line 121: | Line 126: | ||
# we allow all traffic from $INTRANET and localhost interfaces | # we allow all traffic from $INTRANET and localhost interfaces | ||
- | $IPTB -A INPUT -i $INTRANET -j ACCEPT | + | $IPTB -A INPUT -i $INTRANET |
- | $IPTB -A INPUT -i lo -j ACCEPT | + | $IPTB -A INPUT -i lo -m state --state NEW, |
- | #$IPTB -A INPUT -m state --state INVALID -m limit --limit 1/minute -j LOG --log-prefix "INVALID | + | $IPTB -A INPUT -m state --state INVALID -m limit --limit 1/minute -j LOG --log-prefix " |
- | #$IPTB -A INPUT -m state --state INVALID -j DROP | + | $IPTB -A INPUT -m state --state INVALID -j DROP |
# | # | ||
Line 132: | Line 137: | ||
#FIN is set and ACK is not | #FIN is set and ACK is not | ||
- | $IPTB -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP | ||
$IPTB -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j LOG --log-prefix " | $IPTB -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j LOG --log-prefix " | ||
+ | $IPTB -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP | ||
#PSH is set and ACK is not | #PSH is set and ACK is not | ||
- | $IPTB -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP | ||
$IPTB -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j LOG --log-prefix " | $IPTB -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j LOG --log-prefix " | ||
+ | $IPTB -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP | ||
#URG is set and ACK is not | #URG is set and ACK is not | ||
- | $IPTB -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP | ||
$IPTB -A INPUT -p tcp --tcp-flags ACK,URG URG -j LOG --log-prefix " | $IPTB -A INPUT -p tcp --tcp-flags ACK,URG URG -j LOG --log-prefix " | ||
+ | $IPTB -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP | ||
# Block portscans: | # Block portscans: | ||
Line 159: | Line 164: | ||
#FIN and RST are both set | #FIN and RST are both set | ||
- | $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP | ||
$IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j LOG --log-prefix " | $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j LOG --log-prefix " | ||
+ | $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP | ||
- | $IPTB -A INPUT -f -j LOG --log-prefix " | + | $IPTB -A INPUT -f -j LOG --log-prefix "Lost FRAGMENT> |
$IPTB -A INPUT -f -j DROP | $IPTB -A INPUT -f -j DROP | ||
Line 184: | Line 189: | ||
for i in $TCP_PORTS | for i in $TCP_PORTS | ||
do | do | ||
- | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport $i -j ACCEPT | + | $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport $i -j ACCEPT |
done | done | ||
Line 193: | Line 198: | ||
$IPTB -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset | $IPTB -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset | ||
- | # traceroute | + | # traceroute |
$IPTB -A INPUT -p udp -m limit --limit 3/ | $IPTB -A INPUT -p udp -m limit --limit 3/ | ||
# Log and drop ICMP fragments (shouldn not happen at all, but often used for DoS) | # Log and drop ICMP fragments (shouldn not happen at all, but often used for DoS) | ||
$IPTB -A INPUT -i $INTERNET --fragment -p icmp -j LOG --log-prefix " | $IPTB -A INPUT -i $INTERNET --fragment -p icmp -j LOG --log-prefix " | ||
- | $IPTB -A INPUT -i $INTERNET --fragment -p icmp -j DROP | + | $IPTB -A INPUT -i $INTERNET --fragment -p icmp -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp-frag |
# thou shall NOT block ALL ICMP, but only allow usefull ICMP types to pass trough | # thou shall NOT block ALL ICMP, but only allow usefull ICMP types to pass trough | ||
- | $IPTB -A INPUT -p icmp --icmp-type 0 -m limit --limit 30/second -j ACCEPT | + | # echo-reply |
- | $IPTB -A INPUT -p icmp --icmp-type 3 -m limit --limit 30/second -j ACCEPT | + | #$IPTB -A INPUT -p icmp --icmp-type 0 -m hashlimit |
- | $IPTB -A INPUT -p icmp --icmp-type 4 -m limit --limit 30/second -j ACCEPT | + | # unreachables |
- | $IPTB -A INPUT -p icmp --icmp-type 11 -m limit --limit 30/second -j ACCEPT | + | $IPTB -A INPUT -p icmp --icmp-type 3 -m hashlimit |
- | $IPTB -A INPUT -p icmp --icmp-type 12 -m limit --limit 30/second -j ACCEPT | + | # source-quench (depreciated) |
+ | #$IPTB -A INPUT -p icmp --icmp-type 4 -m hashlimit | ||
+ | # timeout (forward loop prevention) | ||
+ | $IPTB -A INPUT -p icmp --icmp-type 11 -m hashlimit | ||
+ | # parameter problem | ||
+ | $IPTB -A INPUT -p icmp --icmp-type 12 -m hashlimit | ||
# | # | ||
- | $IPTB -A INPUT -p icmp --icmp-type 30 -m limit --limit 30/second -j ACCEPT | + | $IPTB -A INPUT -p icmp --icmp-type 30 -m hashlimit |
# echo-request | # echo-request | ||
- | $IPTB -A INPUT -p icmp --icmp-type 8 -m limit --limit 3/second -j ACCEPT | + | $IPTB -A INPUT -p icmp --icmp-type 8 -m hashlimit |
# if the default policy is not DROP then we must use this | # if the default policy is not DROP then we must use this | ||
Line 231: | Line 240: | ||
$IPTB -A FORWARD -m state --state INVALID -j DROP | $IPTB -A FORWARD -m state --state INVALID -j DROP | ||
$IPTB -A FORWARD -m state --state ESTABLISHED, | $IPTB -A FORWARD -m state --state ESTABLISHED, | ||
- | $IPTB -A FORWARD -m state --state NEW -i ! $INTERNET -j ACCEPT | + | $IPTB -A FORWARD -m state --state NEW ! -i $INTERNET -j ACCEPT |
$IPTB -A FORWARD -m pkttype --pkt-type broadcast -j DROP | $IPTB -A FORWARD -m pkttype --pkt-type broadcast -j DROP | ||
Line 243: | Line 252: | ||
# ADSL (PPPoE connections) | # ADSL (PPPoE connections) | ||
- | #$IPTB -I FORWARD --protocol | + | #$IPTB -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu |
$IPTB -I FORWARD -o $INTERNET -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu | $IPTB -I FORWARD -o $INTERNET -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu | ||
Line 257: | Line 266: | ||
| | ||
# list the rules | # list the rules | ||
- | $IPTB -L -v -n | + | $IPTB -L -v -n --line |
+ | $IPTB -t nat -L -v -n --line | ||
| | ||
echo $WE_HAVE_INTRANET > / | echo $WE_HAVE_INTRANET > / | ||
</ | </ |