On Wednesday 07 Oct 2015 14:23:39 James wrote: > Mick <michaelkintzios <at> gmail.com> writes: > > > http://gentoo-en.vfose.ru > > > /wiki/IptablesIptables_and_stateful_firewalls#State_basics > > > > Start iptables, run the script, stop iptables with '/etc/init.d/iptables > > > > > stop' which will save your rules to /var/lib/iptables/rules-save, > > > after starting iptables, I ran /etc/firewall.sh (the previously published > script) and the stop with the syntax above:: > > cat /var/lib/iptables/rules-save > # Generated by iptables-save v1.4.21 on Wed Oct 7 09:13:59 2015 > *mangle > > :PREROUTING ACCEPT [16022765:14170972269] > :INPUT ACCEPT [16022479:14170935323] > :FORWARD ACCEPT [0:0] > :OUTPUT ACCEPT [19311825:1508198446] > :POSTROUTING ACCEPT [19311825:1508198446] > > COMMIT > # Completed on Wed Oct 7 09:13:59 2015 > # Generated by iptables-save v1.4.21 on Wed Oct 7 09:13:59 2015 > *filter > > :INPUT DROP [471:17192] > :FORWARD ACCEPT [0:0] > :OUTPUT ACCEPT [722751:44404539] > > [740388:740719942] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT > COMMIT > # Completed on Wed Oct 7 09:13:59 2015 > > > was the ouput.
Are you sure that restarting iptables did not produce errors on the CLI? The script you are using is somewhat old and the iptables syntax has changed since then. Have a look here: https://wiki.gentoo.org/wiki/Iptables Your single rule line above should therefore look like this: -A INPUT -i eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT but before this rule you should specify a default policy for your INPUT and other chains - ideally one to DROP all packets coming in and allow all going out; e.g. -P INPUT DROP -P FORWARD DROP -P OUTPUT ACCEPT Also, to accept any INPUT packets on interfaces other than eth0, you would precede these lines with: -A INPUT ! -i eth0 -j ACCEPT More details on syntax can be found in 'man iptables-extensions'. You will need to modify your script accordingly for this new syntax. To see if you are getting syntax errors run each rule on the CLI first, e.g. /sbin/iptables -A INPUT -i eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT and check that it takes with: /sbin/iptables -L -v -n NOTE: The order in which you add iptables rules on the CLI is the order in which they will end up listed in /var/lib/iptables/rules-save. BTW, I recall a thread posted for a firewall script within the last couple of years, but can't recall exactly who was the contributor. Have a quick search in Gmane to see if you can find it. > sysctl is not set up. I did find this page on that:: > https://wiki.gentoo.org/wiki/Procfs > > Any suggestions on setting up sysctl for iptables and other future > usage? According to the URL you posted above you should use /etc/sysctl.d/local.conf, rather than the legacy /etc/sysctl.conf which I suggested. Apologies for a bum steer. Use your previous URL for stateful firewalls to see what sysctl settings you need to add here. > > nmap -A -T4 -P0 -vvv -p1-65535 XXX.XX.XXX.XX > > Worked flawlessly. Very precise syntax (thanks). Here are the highlights:: > > Not shown: 65534 closed ports Not good. Unless you have set up a default policy to REJECT packets, this shows ports that are not firewalled, but happen to be closed (no service is running there). If you had a DROP policy/rule for INPUT packets it should say "65534 filtered ports". > PORT STATE SERVICE VERSION > 22/tcp open ssh OpenSSH 5.9p1-hpn13v11lpk (protocol 2.0) Not good. Unless you have also defined a rule for allowing connections to port 22, this shows an open port, to which a service (ssh) is currently listening for incoming connections. If you want to only allow ssh connections from some local address 192.168.1.27, you can try adding a rule for it like this: -A INPUT -s 192.168.1.27/32 -i eth0 -p tcp -m conntrack --ctstate NEW -m mac --mac-source 67:35:AC:34:89:48 -m conntrack --ctorigdstport 22 -j ACCEPT > Not bad for a quick workstation firewall(s). After I get sysctl setup, > I'll test a few other verssions and post again. Then wikify these > for community consumption. Your script needs more work. Look first at the iptables URL I posted above, which has the modern syntax. Also, either define a default INPUT chain policy to DROP or REJECT packets, or end your script with rules to drop all other packets, not already accepted by previous rules: -A INPUT -i eth0 -j DROP PS. Instead of running some script, you can always specify your rules in your /var/lib/iptables/rules-save and also back it up. Then use this file to change settings as you see fit and reload/start the firewall for the settings to take. -- Regards, Mick
signature.asc
Description: This is a digitally signed message part.
