Direkt zum Hauptbereich

iptables - setting up a decent firewall

Here is nothing else to write about but the source code you put into /etc/init.d/firewall as a 755 script, and a ". /etc/init.d/firewall" line in to /etc/rc.local".

I adjusted some stuff reading through Eric Ambergs "Linux-Server" book.


 #!/bin/sh  
 echo "Initialisiere Firewall iptables ..."  
   
 # Firewallregeln löschen  
 iptables -F  
 iptables -X  
 iptables -P INPUT DROP  
 iptables -P OUTPUT DROP  
 iptables -P FORWARD DROP  
 iptables -Z  
   
 # Module laden für FTP ports  
 modprobe ip_conntrack_ftp  
   
 #------------------------------------------------------------------------------  
 # 
 # http://wiki.debianforum.de/Einfaches_Firewall-Script  
 #  
 # Logging options.  
 LOG="LOG --log-level 4 --log-tcp-sequence --log-tcp-options"  
 LOG="$LOG --log-ip-options"  
    
 # Defaults for rate limiting  
 RLIMIT="-m limit --limit 3/s --limit-burst 30"  
   
 # Custom user-defined chains.  
    
 # LOG packets, then ACCEPT.  
 iptables -N ACCEPTLOG  
 iptables -A ACCEPTLOG -j $LOG $RLIMIT --log-prefix "FW-ACCEPT: "  
 iptables -A ACCEPTLOG -j ACCEPT  
    
 # LOG packets, then DROP.  
 iptables -N DROPLOG  
 iptables -A DROPLOG -j $LOG $RLIMIT --log-prefix "FW-DROP: "  
 iptables -A DROPLOG -j DROP  
   
 # better not to REJECT anything for it tells somebody something  
 # LOG packets, then REJECT.  
 # TCP packets are rejected with a TCP reset.  
 iptables -N REJECTLOG  
 iptables -A REJECTLOG -j $LOG $RLIMIT --log-prefix "FW-REJECT: "  
 iptables -A REJECTLOG -p tcp -j REJECT --reject-with tcp-reset  
 iptables -A REJECTLOG -j REJECT  
   
 # Only allows RELATED ICMP types  
 # (destination-unreachable, time-exceeded, and parameter-problem).  
 # TODO: Rate-limit this traffic?  
 # TODO: Allow fragmentation-needed?  
 # TODO: Test.  
 iptables -N RELATED_ICMP  
 iptables -A RELATED_ICMP -p icmp --icmp-type destination-unreachable -j ACCEPT  
 iptables -A RELATED_ICMP -p icmp --icmp-type time-exceeded -j ACCEPT  
 iptables -A RELATED_ICMP -p icmp --icmp-type parameter-problem -j ACCEPT  
 iptables -A RELATED_ICMP -j DROPLOG  
    
 # Make It Even Harder To Multi-PING  
 iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 2 -j ACCEPT  
 iptables -A OUTPUT -p icmp -j ACCEPT  
    
 # Only allow the minimally required/recommended parts of ICMP. Block the rest.  
 #------------------------------------------------------------------------------  
    
 # Allow all ESTABLISHED ICMP traffic.  
 iptables -A INPUT -p icmp -m state --state ESTABLISHED -j ACCEPT $RLIMIT  
 iptables -A OUTPUT -p icmp -m state --state ESTABLISHED -j ACCEPT $RLIMIT  
    
 # Allow some parts of the RELATED ICMP traffic, block the rest.  
 iptables -A INPUT -p icmp -m state --state RELATED -j RELATED_ICMP $RLIMIT  
 iptables -A OUTPUT -p icmp -m state --state RELATED -j RELATED_ICMP $RLIMIT  
    
 # Allow incoming ICMP echo requests (ping), but only rate-limited.  
 iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT $RLIMIT  
    
 # Allow outgoing ICMP echo requests (ping), but only rate-limited.  
 iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT $RLIMIT  
    
 # Drop any other ICMP traffic.  
 iptables -A INPUT -p icmp -j DROPLOG  
 iptables -A OUTPUT -p icmp -j DROPLOG  
 iptables -A FORWARD -p icmp -j DROPLOG  
 #------------------------------------------------------------------------------  
   
 # loopback  
 iptables -A INPUT -i lo -j ACCEPT  
 iptables -A OUTPUT -o lo -j ACCEPT  
   
 # stateful inspection  
 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT  
 iptables -A INPUT -m state --state INVALID -j DROPLOG  
 iptables -A OUTPUT -m state --state INVALID -j DROP  
 iptables -A FORWARD -m state --state INVALID -j DROP  
 iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT  
   
 # SSH  
 iptables -A INPUT -p tcp --dport 22 -j ACCEPTLOG  
   
 # DNS  
 iptables -A OUTPUT -m state --state NEW -p udp --dport 53 -j ACCEPT  
 iptables -A OUTPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT  
 iptables -A INPUT -m state --state NEW -p udp --dport 53 -j ACCEPT  
 iptables -A INPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT  
   
 # http  
 iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT  
 iptables -A OUTPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT  
   
 # https  
 iptables -A INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT  
 iptables -A OUTPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT  
   
 #  
 # mail  
 #  
 # Erlaube eingehende SMTP Anfragen.  
 iptables -A INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT  
 # Erlaube ausgehende SMTP Anfragen.  
 iptables -A OUTPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT  
 # Erlaube ausgehende SMTPS Anfragen.  
 iptables -A OUTPUT -m state --state NEW -p tcp --dport 465 -j ACCEPT  
   
 # Erlaube eingehende POP3 Anfragen.  
 iptables -A INPUT -m state --state NEW -p tcp --dport 110 -j ACCEPT  
 # Erlaube eingehende POP3S Anfragen.  
 iptables -A INPUT -m state --state NEW -p tcp --dport 995 -j ACCEPT  
    
 # Erlaube eingehende und ausgehendeIMAP4 Anfragen.
iptables -A INPUT -m state --state NEW -p tcp --dport 143 -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED -p tcp --dport 143 -j ACCEPT

# Erlaube eingehende und ausgehende IMAPS Anfragen.
iptables -A INPUT -m state --state NEW -p tcp --dport 993 -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED -p tcp --dport 993 -j ACCEPT
 
   
 # FTP  
 iptables -A OUTPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT  
 iptables -A INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT  
   
 # Erlaube ausgehende NTP Anfragen.  
 iptables -A OUTPUT -m state --state NEW -p udp --dport 123 -j ACCEPT  
   
 # Erlaube ausgehende WHOIS Anfragen.  
 iptables -A OUTPUT -m state --state NEW -p tcp --dport 43 -j ACCEPT  
   
   
 # Explicitly log and reject everything else.  
 #------------------------------------------------------------------------------  
 # Use REJECT instead of REJECTLOG if you don't need/want logging. better DROPLOG!  
 iptables -A INPUT -j DROPLOG  
 iptables -A OUTPUT -j DROPLOG  
 iptables -A FORWARD -j DROPLOG  
    
 # Exit gracefully.  
 #------------------------------------------------------------------------------  
   
 echo "Firewall konfiguriert und aktiv."  
    
 exit 0

Kommentare

Kommentar veröffentlichen

Beliebte Posts aus diesem Blog

rails + carrierwavve + plupload = multiple file upload

Right now I am very happy! I finished my work on creating a file upload method in rails for more than one file, altogether handled by rails sessions and as objects. First I had to learn a bit more about how rails works and I achieved that by reading a lot: books, screencasts and blogs. In this blog post I like to share what I accomplished, but without the hussle of putting code blocks in here, so watch out for bold formatted text as that is the code. My goal was to have one site with just the pure option of uploading files. All file handling would be done behind the scenes by myself logging onto my server. That said you are not going to see any fancy CRUD here. Lets start then! And dont forget to versioning your app BEFORE you try something new! [e.g. git] > rails g scaffold Photo title:string Now add carrierwave to you Gemfile and run > bundle install >rails g uploader Photo Alltogether you have model, controller, views and an uploader folder with the Ph...
Kommentar veröffentlichen
Mehr anzeigen

debian 6 vserver - a new installation due to centOS update problem - my steps

My centOS vserver broke down after a "yum update" and even the centOS community forum could not give an answer within 24h. In my books that is poor for the almighty and stable centOS. Bare in mind that I am just a normal user of linux, no professional and definitely no expert when it comes to server, but I can read, try and share my findings: debian 6 installation steps via ssh secure your server: adduser foobar for security purposes  change /etc/sshd/sshd_conf to PermitRootLogin no now you can login as foobar and change to root via su - visudo for sudo command permissions and put this at the bottom: foobar   ALL=(ALL) ALL change hostname change hostname in /etc/hostname and in /etc/hosts reboot login via rsa key rather than password locally do ssh-keygen ssh-copy-id -i foobar@hostname... ssh now works without passwords but with keys (for easy deployment) install ruby and rails via rvm login as root always good to have: sudo apt-get install...
Kommentar veröffentlichen
Mehr anzeigen

Stream your media to your DLNA device e.g. tv with miniDLNA on a linux machine

Recently we bought a Sony Bravia LED TV with the possibility to receive streams. It can read DLNA, which is not much, so dont fall for the certificate. DLNA means it can read MPEG-I/II and some other normal stuff. Luckily the Sony Bravia can read mkv and x256 and some other codecs. And this is something the sells people and adverbs dont tell you, so be warned not to trust the DLNA-Certificate too much, the device has to decode the media in the end. Anyway i set up miniDLNA on my laptop and now I am able to stream my media to the television. Although the process did not go that well. The problem was miniDLNA was breaking down all the time. And checking it by reading the logs etc revealed permission issues. I had to start miniDLNA as the user my files belonged to. BUT I did not use the user setting in the minidlna.conf instead I just started the daemon as the user. I could have done this with a startup script, but there were some issues with the network being set up at the sam...
Kommentar veröffentlichen
Mehr anzeigen