On Thu, Aug 28, 2003 at 04:55:42PM -0500, Scot Jenkins wrote:
> Personally, I've tried alot of the GUI frontends to iptables and
> usually ended up just coding the ruleset by hand. YMMV.
I find this to be quite true as well. Most firewalls are quite simple,
especially with iptables state-based filtering. Here's an exceedingly
simple example:
#!/bin/sh
# Set up default policy
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# Allow all local loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# First, "whitelist" -- accept established,related connections. Fastest
# processing of incoming packets. Because we accept immediately,
# tracking bandwidth usage by port doesn't work, but who cares?
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Next, incoming "blacklists". e.g. modem block from attbi
iptables -N blacklist
iptables -A blacklist -s bad.ip.address -j DROP
# Drop back TCP packets
iptables -A blacklist -p tcp ! -syn -m state --state NEW -j LOG \
--log-level INFO --log-prefix "IPT New not syn:"
iptables -A blacklist -p tcp ! -syn -m state --state NEW -j DROP
# Add blacklist to INPUT
iptables -A INPUT -i eth0 -j blacklist
# Hosting these services: ssh, http, https, auth, ftp
iptables -A INPUT -i eth0 -p tcp --dport ssh -j ACCEPT # Remote access
iptables -A INPUT -i eth0 -p tcp --dport auth -j ACCEPT # For identd calls
iptables -A INPUT -i eth0 -p tcp --dport http -j ACCEPT # Web
iptables -A INPUT -i eth0 -p tcp --dport https -j ACCEPT # Secure web
iptables -A INPUT -i eth0 -p tcp --dport imap -j ACCEPT # Email
# You don't want to regulate outgoing traffic, do you?
iptables -A OUTPUT -o eth0 -j ACCEPT
# If you want to log packets before you drop them via default policy,
# uncomment these:
#iptables -A INPUT -i eth0 -j LOG --log-level INFO --log-prefix "IPT drop eth0:"
#iptables -A OUTPUT -i eth0 -j LOG --log-level INFO --log-prefix "IPT drop eth0:"
# Done.
--
Chad Walstrom <chewie at wookimus.net> http://www.wookimus.net/
assert(expired(knowledge)); /* core dump */
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 240 bytes
Desc: not available
Url : http://shadowknight.real-time.com/pipermail/tclug-list/attachments/20030828/c004e12f/attachment.pgp