RE: diald slow to be useful...

["Robert Jenkins" <raj@jrw.co.uk>]

Hi Mike,

This is basically what I'm using for the firewall (I've changed my Ip
addresses & trimmed out some port forwards & other junk).
It's based on a template I found on the internet, but I can't remember
where...

Using iptables makes it a fraction of the size of my old ipchains
firewall!

Regards,
Robert Jenkins.
mailto:raj@jrw.co.uk


#!/bin/bash
#

#Point this to your copy of ip_tables
IPT="/sbin/iptables"

#Load the modules. (Moved to rc.local)
#modprobe ip_tables
#echo 1 > /proc/sys/net/ipv4/ip_forward


#Flush old rules, delete the firewall chain if it exists
$IPT -F
$IPT -F -t nat
$IPT -X firewall

#Setup Masquerading. Change the IP to your internal network and
uncomment
#this in order to enable it.
$IPT -A POSTROUTING -t nat -s 192.168.0.0/24 -j MASQUERADE
$IPT -P FORWARD ACCEPT

#Set up the firewall chain
$IPT -N firewall
$IPT -A firewall -j LOG --log-level info --log-prefix "Firewall:"
$IPT -A firewall -j DROP


#Accept ourselves
$IPT -A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -j ACCEPT
#If you're using IP Masquerading, change this IP to whatever your
internl
#IP addres is and uncomment it
$IPT -A INPUT -s 192.168.0.0/24 -d 0/0 -j ACCEPT

#Accept DNS
$IPT -A INPUT -p udp --source-port 53 -j ACCEPT
#And NTP
$IPT -A INPUT -p udp --source-port 123 --destination-port 123 -j ACCEPT
$IPT -A INPUT -p tcp --source-port 123 --destination-port 123 -j ACCEPT

#Allow ftp to send data back and forth.
$IPT -A INPUT -p tcp ! --syn --source-port 20 --destination-port
1024:65535 -j ACCEPT

#Accept SSH.
#$IPT -A INPUT -p tcp --destination-port 22  -j ACCEPT

#Send everything else to the firewall.
$IPT -A INPUT -p icmp -j firewall
$IPT -A INPUT -p tcp --syn -j firewall
$IPT -A INPUT -p udp -j firewall

#
# End.
#