Re: ip_conntrack_max vs ip_conntrack

[Jiann-Ming Su <sujiannming@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 783 bytes --]

On Thu, 30 Sep 2004 18:48:16 -0400, Jiann-Ming Su <sujiannming@gmail.com> wrote:
> 
> There's some good info on what I was looking for at the end of this section:
> 
> http://www.iptables.org/documentation/HOWTO//packet-filtering-HOWTO-7.html#ss7.3
> 

In case someone, like myself, should look through the archives,
another good place for info is
http://iptables-tutorial.frozentux.net/iptables-tutorial.html.  I'm
also including a snapshot of the rules we use to firewall off the
dorms at an academic institution.  Someone else out there may find
this helpful.  All IP's have been changed to protect the guilty.

-- 
Jiann-Ming Su
"I have to decide between two equally frightening options.  
                                            If I wanted to do that,
I'd vote." --Duckman

[-- Attachment #2: iptables --]
[-- Type: application/octet-stream, Size: 3922 bytes --]

# Generated by iptables-save v1.2.9 on Thu Oct 14 15:16:17 2004
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Thu Oct 14 15:16:17 2004
# Generated by iptables-save v1.2.9 on Thu Oct 14 15:16:17 2004
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed on Thu Oct 14 15:16:17 2004
# Generated by iptables-save v1.2.9 on Thu Oct 14 15:16:17 2004
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:FWD_SYN - [0:0]
:IN_ICMP - [0:0]
:IN_TCP - [0:0]
:IN_UDP - [0:0]
-A INPUT -i lo -j ACCEPT 
-A INPUT -p 89 -j ACCEPT 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p udp -j IN_UDP 
-A INPUT -p tcp -m state --state NEW -j IN_TCP 
-A INPUT -p icmp -j IN_ICMP 
-A INPUT -j ULOG --ulog-prefix "iptables input cleanup: " 
-A FORWARD -d ! 192.168.0.0/255.255.0.0 -p tcp -m tcp -m multiport --dports 135,445 -j DROP 
-A FORWARD -i eth1 -p tcp -m multiport --dports 135,445 -j DROP 
-A FORWARD -i eth2 -p tcp -m tcp --tcp-flags SYN SYN -j FWD_SYN 
-A FORWARD -i eth2 -j ACCEPT 
-A FORWARD -p 47 -j ACCEPT 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -s 192.168.0.0/255.255.0.0 -j ACCEPT 
-A FORWARD -s 10.0.0.0/255.255.0.0 -j ACCEPT 
-A FWD_SYN -p tcp -m tcp --tcp-flags FIN FIN -m limit --limit 10/min -j ULOG --ulog-prefix "iptables SYN/FIN attack" 
-A FWD_SYN -p tcp -m tcp --tcp-flags FIN FIN -j DROP 
-A FWD_SYN -p tcp -m tcp --dport 80 -m limit --limit 100/sec --limit-burst 200 -j ACCEPT 
-A FWD_SYN -p tcp -m tcp --dport 135 -m limit --limit 50/sec --limit-burst 50 -j ACCEPT 
-A FWD_SYN -p tcp -m tcp --dport 443 -m limit --limit 50/sec --limit-burst 50 -j ACCEPT 
-A FWD_SYN -p tcp -m tcp --dport 445 -m limit --limit 50/sec --limit-burst 50 -j ACCEPT 
-A FWD_SYN -p tcp -m tcp --dport 80 -m limit --limit 1/sec -j ULOG --ulog-prefix "iptables syn limit: " 
-A FWD_SYN -p tcp -m multiport --dports 135,443,445 -m limit --limit 10/min -j ULOG --ulog-prefix "iptables syn limit: " 
-A FWD_SYN -p tcp -m tcp -m multiport --dports 80,135,443,445 -j DROP 
-A FWD_SYN -p tcp -m tcp -m limit --limit 50/sec --limit-burst 50 -j ACCEPT 
-A FWD_SYN -p tcp -m tcp -m limit --limit 10/min -j ULOG --ulog-prefix "iptables syn limit: " 
-A FWD_SYN -j DROP 
-A IN_ICMP -s 10.0.9.30 -p icmp -j ACCEPT 
-A IN_ICMP -s 10.0.218.128/255.255.255.224 -p icmp -j ACCEPT 
-A IN_ICMP -s 10.0.246.0/255.255.254.0 -p icmp -j ACCEPT 
-A IN_ICMP -s 192.168.53.224/255.255.255.224 -p icmp -j ACCEPT 
-A IN_ICMP -j ULOG --ulog-prefix "iptables input icmp cleanup: " 
-A IN_ICMP -j DROP 
-A IN_TCP -s 192.168.99.36 -p tcp -m tcp --dport 22 -j ACCEPT 
-A IN_TCP -s 192.168.149.53 -p tcp -m tcp --dport 22 -j ACCEPT 
-A IN_TCP -s 192.168.99.35 -p tcp -m tcp --dport 22 -j ACCEPT 
-A IN_TCP -s 192.168.99.34 -p tcp -m tcp --dport 22 -j ACCEPT 
-A IN_TCP -s 192.168.68.111 -p tcp -m tcp --dport 22 -j ACCEPT 
-A IN_TCP -s 10.0.218.128/255.255.255.224 -p tcp -m tcp --dport 22 -j ACCEPT 
-A IN_TCP -s 10.0.246.0/255.255.254.0 -p tcp -m tcp --dport 22 -j ACCEPT 
-A IN_TCP -s 192.168.53.224/255.255.255.224 -p tcp -m tcp --dport 22 -j ACCEPT 
-A IN_TCP -s 10.0.246.0/255.255.254.0 -p tcp -m tcp --dport 10000 -j ACCEPT 
-A IN_TCP -s 10.0.254.144/255.255.255.240 -p tcp -m tcp --dport 10000 -j ACCEPT 
-A IN_TCP -j ULOG --ulog-prefix "iptables input tcp cleanup: " 
-A IN_TCP -j DROP 
-A IN_UDP -s 10.0.246.223 -p udp -m udp --dport 161 -j ACCEPT 
-A IN_UDP -s 10.0.9.30 -p udp -m udp --dport 161 -j ACCEPT 
-A IN_UDP -s 10.0.218.128/255.255.255.224 -p udp -m udp --dport 161 -j ACCEPT 
-A IN_UDP -s 10.0.246.63 -p udp -m udp --dport 161 -j ACCEPT 
-A IN_UDP -s 192.168.53.224/255.255.255.224 -p udp -m udp --dport 161 -j ACCEPT 
-A IN_UDP -j ULOG --ulog-prefix "iptables input udp cleanup: " 
-A IN_UDP -j DROP 
COMMIT
# Completed on Thu Oct 14 15:16:17 2004