Hi,
I'm new to iptables and below is the simple script I wrote for my
firewall/gateway. The machine has a static address and on eth1 there
is a local lan 10.0.0.0/24.
I want to drop all new incomming connections on eth0 except ssh.
If someone could check it I would be gratefull. Also any tips to make
it better are welcome.
#!/bin/sh
# Start/stop the firewall
STATIC_IP=w.x.y.z
LOCALLAN=eth1
INTERNET=eth0
IPTABLES=/sbin/iptables
test -f $IPTABLES || exit 0
case "$1" in
start) echo "Starting firewall:"
echo -n " flushing rules: "
$IPTABLES -t nat -F
$IPTABLES -F
echo "ok"
echo -n " setting default policy: "
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT ACCEPT
echo "ok"
echo -n " setting INPUT chain: "
# Accept all established and related connections
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Accept all new connections coming from the local lan
$IPTABLES -A INPUT -m state --state NEW -i ! $INTERNET -j ACCEPT
# Accept SSH from everywhere
$IPTABLES -A INPUT -p tcp -dport 22 -j ACCEPT
# Accept mail
# Not needed yet
echo "ok"
echo -n " setting OUTPUT chain: "
echo "ok"
echo -n " setting FORWARD chain:"
# Drop all tcp and udp connections to port 135,139, 445 and 593
# Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability
#
# A buffer overrun vulnerability has been reported in Microsoft Windows
# that can be exploited remotely via a DCOM RPC interface that listens
# on TCP/UDP port 135. The issue is due to insufficient bounds checking
# of client DCOM object activation requests. Exploitation of this issue
# could result in execution of malicious instructions with Local System
# privileges on an affected system.
#
# This issue may be exposed on other ports that the RPC Endpoint Mapper
# listens on, such as TCP ports 139, 135, 445 and 593. This has not been
# confirmed. Under some configurations the Endpoint Mapper may receive
# traffic via port 80.
# [ http://www.symantec.com/avcenter/security/Content/8205.html ]
$IPTABLES -A FORWARD -p tcp --dport 135 -j DROP
$IPTABLES -A FORWARD -p udp --dport 135 -j DROP
$IPTABLES -A FORWARD -p tcp --dport 139 -j DROP
$IPTABLES -A FORWARD -p udp --dport 139 -j DROP
$IPTABLES -A FORWARD -p tcp --dport 445 -j DROP
$IPTABLES -A FORWARD -p udp --dport 445 -j DROP
$IPTABLES -A FORWARD -p tcp --dport 593 -j DROP
$IPTABLES -A FORWARD -p udp --dport 593 -j DROP
# Drop all connections coming from the local lan to port 6667:6668
# Some worms send information to an IRC server
$IPTABLES -A FORWARD -s 10.0.0.0/24 -p tcp --dport 6667:6668 -j DROP
# Accept all established and related connections
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Forward all new connections comming from the local lan
$IPTABLES -A FORWARD -m state --state NEW -i ! $INTERNET -j ACCEPT
echo "ok"
echo -n " turning on ip_forward:"
echo 1 > /proc/sys/net/ipv4/ip_forward
# Turning on SNAT
$IPTABLES -t nat -A POSTROUTING -o $INTERNET -j SNAT --to $STATIC_IP
echo "ok"
echo "Firewall started."
;;
stop) echo -n "Stopping firewall"
# SNAT is disabled and the machines continues as a normal machine.
# This is put so that I can easy close the local lan.
$IPTABLES -t nat -F
$IPTABLES -F
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT ACCEPT
echo "."
;;
restart) echo -n "Restarting firewall"
echo "."
;;
reload|force-reload) echo -n "Reloading configuration files for firewall"
echo "."
;;
*) echo "Usage: /etc/init.d/firewall start|stop|restart|reload|force-reload"
exit 1
;;
esac
exit 0
--
Rudy Gevaert [EMAIL PROTECTED]
Web page http://www.webworm.org
GNU/Linux user and Savannah hacker http://savannah.gnu.org
One of the symptoms of an approaching nervous breakdown is the
belief that one's work is terribly important.
-- Bertrand Russell
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
