RE: can someone check this simple firewall?

RE: can someone check this simple firewall?

[Daniel Chemko]

#!/bin/sh

LAN_IP_RANGE="192.168.10.0/24"
LAN_IP="192.168.10.100"
#LAN_BCAST_ADRESS="192.168.10.100"
LOCALHOST_IP="127.0.0.1"
STATIC_IP="1.2.3.4"
INET_IFACE="eth0"
LAN_IFACE="eth1"
IPTABLES="/sbin/iptables"

#/sbin/depmod -a
#/sbin/modprobe ipt_LOG
#/sbin/modprobe ipt_MASQUERADE
->> You probably want at least:
->> modprobe ipt_conntrack_ftp
->> modprobe ipt_nat_ftp


$IPTABLES -F
$IPTABLES -F -t nat

->> Set this AFTER you have setup all your rules, otherwise you have a
hole for hackers to reach through while applying rules
echo "1" > /proc/sys/net/ipv4/ip_forward
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source
$STATIC_IP

# MAKE DEFAULT AS DROP

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
->> OUTPUT description below
$IPTABLES -P FORWARD DROP

# ACCEPT ANY CONNECTION FROM LAN
# ACCEPT CONNECTION TO ONLY 21, 22, 80 FROM OUTSIDE
# DENY REST
# ALLOW PING FROM EVERYWHERE

$IPTABLES -A INPUT -s $LAN_IP_RANGE -d $LAN_IP -j ACCEPT

$IPTABLES -A INPUT -s $LOCALHOST_IP -d $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -s $LOCALHOST_IP -d 0/0 -j ACCEPT
->> Should instead be a related rule:
->> $IPTABLES -A INPUT -i lo -j ACCEPT # All Outbounds are ok
->> $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #
Allow valid responses back in

->>Only TCP connections, not UDP and -s 0/0 is redundant
$IPTABLES -A INPUT -p tcp -s 0/0  --dport 21 -j ACCEPT
$IPTABLES -A INPUT -p udp -s 0/0  --dport 21 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 0/0  --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p udp -s 0/0  --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 0/0  --dport 80 -j ACCEPT
$IPTABLES -A INPUT -p udp -s 0/0  --dport 80 -j ACCEPT
->> This will not work for responses. Use this as well:
->> $IPTABLES -A INPUT -p icmp --icmp-type 0 -j ACCEPT if you want
internet pings from the firewall to work
$IPTABLES -A INPUT -p icmp -s $LAN_IP_RANGE -j ACCEPT

# ALLOW LAN CLIENTS TO GO ANYWHERE ON NET

$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -p icmp -s $LAN_IP_RANGE -j ACCEPT
->> $IPTABLES -A FORWARD -p icmp --icmp-type 0 -j ACCEPT
$IPTABLES -A FORWARD -s 192.168.10.0/24 -m state --state NEW -j ACCEPT
->> What is covered in this line that the first forward line does not??

# ALLOW ANY CONNECTION FROM LINUX SERVER TO INTERNET
->> This section is not needed. Set:
->> iptables -P OUTPUT ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LOCALHOST_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $STATIC_IP -j ACCEPT
$IPTABLES -A OUTPUT -p icmp s 0/0 -j ACCEPT

Re: can someone check this simple firewall?

[Payal Rathod]

Thanks a lot for the detailed explanation.
Comments inline.

On Wed, Aug 13, 2003 at 03:39:39PM -0700, Daniel Chemko wrote:
> ->> You probably want at least:
> ->> modprobe ipt_conntrack_ftp
> ->> modprobe ipt_nat_ftp

ok.

> $IPTABLES -F
> $IPTABLES -F -t nat
> 
> ->> Set this AFTER you have setup all your rules, otherwise you have a
> hole for hackers to reach through while applying rules

?????? But this will erase all the rules which we have set if you do it
at last.
 
> ->> Should instead be a related rule:
> ->> $IPTABLES -A INPUT -i lo -j ACCEPT # All Outbounds are ok
> ->> $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #

Got it. Great.

> ->>Only TCP connections, not UDP and -s 0/0 is redundant
> $IPTABLES -A INPUT -p tcp -s 0/0  --dport 21 -j ACCEPT
[...]

Ok. A bit OT here, but why not UDP? /etc/services lists udp also for the
same.

> $IPTABLES -A INPUT -p udp -s 0/0  --dport 80 -j ACCEPT
> ->> This will not work for responses. Use this as well:
> ->> $IPTABLES -A INPUT -p icmp --icmp-type 0 -j ACCEPT if you want
> internet pings from the firewall to work
> $IPTABLES -A INPUT -p icmp -s $LAN_IP_RANGE -j ACCEPT

What is wrong with my rules?

> ->> This section is not needed. Set:
> ->> iptables -P OUTPUT ACCEPT

Ok. Then why not the same for FORWARD chain too? Since we are forwarding
everything from LAN outside as well?

If we want people to just do ftp and nothing else, will this be ok,

iptables -P FORWARD DROP
iptables -A FORWARD -p tcp -s 192.168.10.0/24 -d 0/0 --dport 21 -j ACCEPT


Thanks a lot for the wonderful explanation.
With warm regards,
-Payal


-- 
"Visit GNU/Linux Success Stories"
http://payal.staticky.com
Guest-Book Section Updated.

Can someone please explain to a newbie?

[Stephen J. McCracken]

I am using giptables to help setup iptables on two RH7.3 boxes.  These
two are sibling proxies in our organization.  The two have basically
identical rulesets, but one gets many of the following logged to the
syslog while the other very few:

Aug 11 13:57:10 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.184.28 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=33149 DF PROTO=TCP SPT=8080 DPT=1100 WINDOW=5840 RES=0x00 ACK
FIN URGP=0
Aug 11 13:57:12 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.184.31 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=37565 DF PROTO=TCP SPT=8080 DPT=1660 WINDOW=5840 RES=0x00 ACK
FIN URGP=0
Aug 11 14:02:43 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.184.22 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=646 DF PROTO=TCP SPT=8080 DPT=2163 WINDOW=5840 RES=0x00 ACK
FIN URGP=0
Aug 11 14:04:21 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.134.27 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=47763 DF PROTO=TCP SPT=8080 DPT=1308 WINDOW=5840 RES=0x00 ACK
FIN URGP=0

But I have the following rules generated by giptables:

iptables -A interface0_in -p tcp -s 10.129.134.0/23 --sport 1024:65535
-d 10.129.130.5 --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A interface0_out -p tcp -s 10.129.130.5 --sport 8080 -d
10.129.134.0/23 --dport 1024:65535 -m state --state ESTABLISHED -j
ACCEPT
iptables -A interface0_in -p tcp -s 10.129.184.0/23 --sport 1024:65535
-d 10.129.130.5 --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A interface0_out -p tcp -s 10.129.130.5 --sport 8080 -d
10.129.184.0/23 --dport 1024:65535 -m state --state ESTABLISHED -j
ACCEPT
iptables -A interface0_in -p tcp -s 172.16.0.0/25 --sport 1024:65535 -d
10.129.130.5 --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A interface0_out -p tcp -s 10.129.130.5 --sport 8080 -d
172.16.0.0/25 --dport 1024:65535
-m state --state ESTABLISHED -j ACCEPT

Can someone please explain to a newbie?

[Stephen J. McCracken]

I am using giptables to help setup iptables on two RH7.3 boxes.  These
two are sibling proxies in our organization.  The two have basically
identical rulesets, but one gets many of the following logged to the
syslog while the other very few:

Aug 11 13:57:10 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.184.28 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=33149 DF PROTO=TCP SPT=8080 DPT=1100 WINDOW=5840 RES=0x00 ACK
FIN URGP=0
Aug 11 13:57:12 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.184.31 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=37565 DF PROTO=TCP SPT=8080 DPT=1660 WINDOW=5840 RES=0x00 ACK
FIN URGP=0
Aug 11 14:02:43 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.184.22 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=646 DF PROTO=TCP SPT=8080 DPT=2163 WINDOW=5840 RES=0x00 ACK
FIN URGP=0
Aug 11 14:04:21 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.134.27 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=47763 DF PROTO=TCP SPT=8080 DPT=1308 WINDOW=5840 RES=0x00 ACK
FIN URGP=0

But I have the following rules generated by giptables:

iptables -A interface0_in -p tcp -s 10.129.134.0/23 --sport 1024:65535
-d 10.129.130.5 --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A interface0_out -p tcp -s 10.129.130.5 --sport 8080 -d
10.129.134.0/23 --dport 1024:65535 -m state --state ESTABLISHED -j
ACCEPT
iptables -A interface0_in -p tcp -s 10.129.184.0/23 --sport 1024:65535
-d 10.129.130.5 --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A interface0_out -p tcp -s 10.129.130.5 --sport 8080 -d
10.129.184.0/23 --dport 1024:65535 -m state --state ESTABLISHED -j
ACCEPT
iptables -A interface0_in -p tcp -s 172.16.0.0/25 --sport 1024:65535 -d
10.129.130.5 --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A interface0_out -p tcp -s 10.129.130.5 --sport 8080 -d
172.16.0.0/25 --dport 1024:65535
-m state --state ESTABLISHED -j ACCEPT

Re: Can someone please explain to a newbie?

[Stephen J. McCracken]

On Thu, 2003-08-14 at 14:59, Wallwork, Nathan wrote:
> On 14 Aug 2003, Stephen J. McCracken wrote:
> > Subject: Can someone please explain to a newbie?
> > 
> > one gets many of the following logged to the syslog while the other 
> > very few:
> 
> Have you reloaded the rules on webfilter2 since the last rules change?

yes.

> 
> > Aug 11 13:57:10 webfilter2 kernel: giptables-end-of-firewall: IN=
> > OUT=eth0 SRC=10.129.130.5 DST=10.129.184.28 LEN=40 TOS=0x00 PREC=0x00
> > TTL=64 ID=33149 DF PROTO=TCP SPT=8080 DPT=1100 WINDOW=5840 RES=0x00 ACK
> > FIN URGP=0
> > 
> > But I have the following rules generated by giptables:
> > 
> > iptables -A interface0_out -p tcp -s 10.129.130.5 --sport 8080 -d
> > 10.129.184.0/23 --dport 1024:65535 -m state --state ESTABLISHED -j
> > ACCEPT
> 
> It looks like this should match, assuming the ESTABLISH part matches.

That's what I thought.  What defines "ESTABLISHED"?
> 
> Consider setting up a copy of that rul without the --state ESTABLISHED, 
> place that right below, and see if it catches any packets.

The problem is that, being a newbie, I use giptables to set up the
iptables rules and I'm not sure where to do this.  Also, I would like to
understand the "why" and not just get around it especially as one box,
using the same ruleset hardly gets any of these while the other quite a
few.