Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
rc.firewall examples.
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Documentation, Tips & Tricks
View previous topic :: View next topic  
Author Message
shwag
n00b
n00b


Joined: 24 Sep 2003
Posts: 24
Location: Los Angeles, CA

PostPosted: Wed Jan 07, 2004 1:40 am    Post subject: rc.firewall examples. Reply with quote

rc.firewall is a file I use to build my iptables config. Here is how my firewall is setup, and hopefully others can share how they do it. Please change your IPs to protect the identity of your network. :)

Code:

#!/bin/sh
                                                                                                             
IPTABLES="/sbin/iptables"
                                                                                                             
$IPTABLES -F            # flush rules
$IPTABLES -t nat -F     # flush nat table
$IPTABLES -X            # delete user defined chains
$IPTABLES -t nat -A POSTROUTING -o eth0 -j MASQUERADE  # enables masq
                                                                                                             
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED #accept estab, required for outbound ftp
$IPTABLES -A OUTPUT -p ALL -j ACCEPT    #allow all out
                                                                                                             
$IPTABLES -A INPUT -p ICMP -i eth0 -j ACCEPT    #allow ping
#$IPTABLES -A INPUT -p tcp -i eth0 --dport 22 --sport 1024:65535 -m state --state NEW -j ACCEPT  #ssh
$IPTABLES -A INPUT -p tcp -i eth0 --dport 5000 --sport 1024:65535 -m state --state NEW -j ACCEPT #allow the tunnel connection
#$IPTABLES -A INPUT -p tcp -i eth0 --dport 80 --sport 1024:65535 -m state --state NEW -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 --dport 22 -j DNAT --to 10.10.0.10  #ssh
$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 --dport 25 -j DNAT --to 10.10.0.10  #smtp
$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 --dport 53 -j DNAT --to 10.10.0.10  #dns
$IPTABLES -t nat -A PREROUTING -p udp -i eth0 --dport 53 -j DNAT --to 10.10.0.10  #dns
$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 --dport 80 -j DNAT --to 10.10.0.10  #web
$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 --dport 143 -j DNAT --to 10.10.0.10  #imap
$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 --dport 443 -j DNAT --to 10.10.0.10  #https
$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 --dport 993 -j DNAT --to 10.10.0.10  #imap-ssl
$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 --dport 995 -j DNAT --to 10.10.0.10  #pop3-ssl
#$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 --dport 2210 -j DNAT --to 10.10.0.10:22
#$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 --dport 2206 -j DNAT --to 10.10.0.6:22
                                                                                                             
$IPTABLES -A INPUT -p all -i eth0 -j LOG --log-prefix "DROPPED PACKET:  -->  " --log-level 6
$IPTABLES -A INPUT -p all -i eth0 -j DROP
                                                                                                             
echo Saving
/etc/init.d/iptables save
Back to top
View user's profile Send private message
RedPingüim
Tux's lil' helper
Tux's lil' helper


Joined: 20 May 2003
Posts: 82
Location: São Paulo - SP

PostPosted: Thu Jan 08, 2004 7:53 am    Post subject: Reply with quote

Hi..

I have just a standalone machine plugged in a ADSL Router and I'm so confuse about firewall rules.

Are there simple rules which can be applied in this case? Needless to say that I have no necessity to use NAT or something like that, but only simple rules for a simple machine...

Below you can see the current rules that are in using for me:

Quote:

bash-2.05b$ cat rules-save
# Generated by iptables-save v1.2.8 on Fri Dec 12 22:14:40 2003
*filter
:INPUT DROP [249:23230]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [236:37767]
[0:0] -A INPUT -i ! eth0 -j ACCEPT
[262:108880] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -i ! eth0 -p tcp -j REJECT --reject-with tcp-reset
[0:0] -A INPUT -i ! eth0 -p udp -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Fri Dec 12 22:14:40 2003


In addition, I edited /etc/init.d/iptables and placed the following lines:


Quote:

#explicitly disable ECN
if [ -e /proc/sys/net/ipv4/tcp_ecn ]
then
echo 0 > /proc/sys/net/ipv4/tcp_ecn
fi

#disable spoofing on all interfaces
for x in ${INTERFACES}
do
echo 1 > /proc/sys/net/ipv4/conf/${x}/rp_filter
done

_________________
Carlos Vendramini
opera 9 build 1635 (gentoo 2006.0; gentoo-sources-2.6.15-r7, gnome 2.12.2) - Linux user #293485 - Opera Fórum em Português
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Documentation, Tips & Tricks All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum