Home |
Last modified: 16-06-2020 |
Improvements or additions include
Just like ipchains, NetFilter is based on sets of rules, called "chains". Each set belongs to a different state in which a packet can be: INPUT (incoming packet meant for the firewall itself), OUTPUT (outgoing packets leaving the firewall itself), FORWARD (packets en route to the network on the other side), PREROUTING (used for special applications, eg. Destination NAT), POSTROUTING (eg. Source NAT). A good explanation on how packets are routed through the different chains is here.
Rules can be handled with the following switches:
echo 1 > /proc/sys/net/ipv4/ip_forward
Generic IPTables script, accept all by default # path to your iptables executable IPT=/sbin/iptables
# put your local network address below mynet=10.0.0.0/16 # the interface you want to secure here # ppp+ = any PPP interface if you're connected to the internet through a ppp modem link. iface=eth1
# our reject lists # reject everything but ssh, + postgres squid apache linuxconf tcp="1:19 23:537 539:598 600:1022 3128 4100:4300 5432 7100 8080 10000" # reject everyting + nfs but named udp="1:52 54:1022 2049"
# delete previous rules $IPT -F INPUT $IPT -F OUTPUT $IPT -F FORWARD $IPT -F POSTROUTING -t nat $IPT -F PREROUTING -t nat $IPT -F OUTPUT -t nat
# disable ping reply and log incoming pings, so you'll get in /var/log/messages # IP addresses of little Hackers trying to check if your host is up. $IPT -A INPUT -i $iface -p icmp -s 0.0.0.0/0 --icmp-type echo-request -j LOG $IPT -A INPUT -i $iface -p icmp -s 0.0.0.0/0 --icmp-type echo-request -j DROP # improve throughput (0x08) and delays (0x10) $IPT -t mangle -A OUTPUT -p tcp -d 0.0.0.0/0 --dport telnet -j TOS --set-tos 0x10 $IPT -t mangle -A OUTPUT -p tcp -d 0.0.0.0/0 --dport ssh -j TOS --set-tos 0x10 $IPT -t mangle -A OUTPUT -p tcp -d 0.0.0.0/0 --dport ftp -j TOS --set-tos 0x10 $IPT -t mangle -A OUTPUT -p tcp -d 0.0.0.0/0 --dport ftp-data -j TOS --set-tos 0x08 # disable ip spoofing (and log) $IPT -A INPUT -i $iface -s $mynet -j LOG $IPT -A INPUT -i $iface -s $mynet -j DROP # more blocking for p in $tcp ; do $IPT -A INPUT -p tcp -i $iface -s 0/0 -d 0/0 --dport $p -j REJECT done for p in $udp ; do $IPT -A INPUT -p udp -i $iface -s 0/0 -d 0/0 --dport $p -j REJECT done
#Some environment variables PROGRAM="/sbin/iptables" INSIDE_NETWORK=192.168.0.0/24 OUTSIDE_NETWORK=10.0.0.0/24 INSIDE_INT=192.168.0.254 OUTSIDE_INT=10.0.0.254 PROXY=192.168.0.1:8080 PROXYSSL=192.168.0.1:443 SMTP=192.168.0.2 #Set default policies iptables -t nat -P PREROUTING DROP iptables -t nat -P POSTROUTING DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP iptables -P INPUT DROP #Add to INPUT set to block some well-known attacks #--tcp-flags <flags to inspect> <flags that should be set> iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP iptables -A FORWARD -p tcp --tcp-flags ALL ALL -j DROP iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP #Allow SSH connections to the firewall from the inside network iptables -A INPUT -i $INSIDE_INT -s $INSIDE_NETWORK -p tcp --dport 22 -j ACCEPT #Allow outgoing PINGs and incoming PONGs iptables -A FORWARD -s $INSIDE_NETWORK -p icmp --icmp-type echo-requested -j ACCEPT iptables -A FORWARD -d $INSIDE_NETWORK -p icmp --icmp-type echo-reply -j ACCEPT iptables -A OUTPUT -i $OUTSIDE_INT -p icmp --icmp-type echo-requested -j ACCEPT iptables -A INPUT -i $OUTSIDE_INT -p icmp --icmp-type echo-reply -j ACCEPT #Block spoofed packets iptables -A FORWARD -i $INSIDE_INT -s ! $INSIDE_NETWORK -j DROP #Block non-routable addresses from the Interne iptables -A FORWARD -i $OUTSIDE_INT -s 10.0.0.0/8 -j DROP iptables -A FORWARD -i $OUTSIDE_INT -s 172.16.0.0/12 -j DROP iptables -A FORWARD -i $OUTSIDE_INT -s 192.168.0.0/16 -j DROP #Block SMB/CIFS iptables -A FORWARD -p tcp --sport 137:139 -J DROP iptables -A FORWARD -p udp --sport 137:139 -J DROP #Block NFS and other dangerous apps iptables -A FORWARD -p tcp --sport 635 -j DROP iptables -A FORWARD -p udp --sport 635 -j DROP iptables -A FORWARD -p tcp --sport 2049 -j DROP iptables -A FORWARD -p udp --sport 2049 -j DROP iptables -A FORWARD -p tcp --sport 111 -j DROP iptables -A FORWARD -p udp --sport 111 -j DROP iptables -A FORWARD -i $OUTSIDE_INT -p udp syslog -j DROP iptables -A FORWARD -i $OUTSIDE_INT -p tcp --dport 512 -j DROP iptables -A FORWARD -i $OUTSIDE_INT -p tcp --dport 514 -j DROP iptables -A FORWARD -i $OUTSIDE_INT -p tcp --dport 515 -j DROP #Route all outgoing WWW traffic to our proxy; -t nat required with PREROUTING/POSTROUTING iptables -t nat -A PREROUTING -i $INSIDE_INT -p tcp--dport 80 -j NAT --to $PROXY iptables -t nat -A PREROUTING -i $INSIDE_INT -p tcp --dport 443 -j NAT --to $PROXYSSL #Route all outgoing SMTP traffice to single host iptables -t nat -A PREROUTING -i $INSIDE_INT -p tcp --dport 25 -j NAT --to $SMTP #Stateful settings iptables -A FORWARD -m state --state NEW -i $INSIDE_INT -s$INSIDE_NETWORK -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -i $OUTSIDE_INT -s ! $INSIDE_NETWORK -j ACCEPT
#!/bin/bash
IPT="/usr/local/bin/iptables"
#Load the module.
#If compiled as module.... modprobe ip_tables
#Flush old rules, delete the firewall chain if it exists
$IPT -F
$IPT -F -t nat
$IPT -X firewall
#Setup Masquerading. Change the IP to your internal network and uncomment
#this in order to enable it.
#$IPT -A POSTROUTING -t nat -s 192.168.1.0/24 -j MASQUERADE
#$IPT -P FORWARD ACCEPT
#echo 1 > /proc/sys/net/ipv4/ip_forward
#Set up the firewall chain
$IPT -N firewall
$IPT -A firewall -j LOG --log-level info --log-prefix "Firewall:"
$IPT -A firewall -j DROP #Accept ourselves
$IPT -A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -j ACCEPT
#If you're using IP Masquerading, change this IP to whatever your internl
#IP addres is and uncomment it
#$IPT -A INPUT -s 192.168.1.1/32 -d 0/0 -j ACCEPT
#Accept DNS, 'cause it's warm and friendly
$IPT -A INPUT -p udp --source-port 53 -j ACCEPT
$IPT -A INPUT -p tcp --source-port 113 -j ACCEPT
$IPT -A INPUT -p tcp --destination-port 113 -j ACCEPT
#Allow ftp to send data back and forth.
$IPT -A INPUT -p tcp ! --syn --source-port 20 --destination-port 1024:65535 -j ACCEPT
#Accept SSH. Duh.
#$IPT -A INPUT -p tcp --destination-port 22 -j ACCEPT
#Send everything else ot the firewall.
$IPT -A INPUT -p icmp -j firewall
$IPT -A INPUT -p tcp --syn -j firewall
$IPT -A INPUT -p udp -j firewall