RE: firewall rules

["Michael K" <micke@klintan.se>]

#Here you go. I haven't tried the syntax.

INTERNAL_INTERFACE='eth0'
EXTERNAL_INTERFACE='eth1'
EXTERNAL_IP=`ifconfig $EXTERNAL_INTERFACE | awk '/inet/ { print $2 }' |
awk -F ":" '{ print $2 }'`

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -F 
iptables -t nat -F
Iptables -t mangle -F


#ESTABLISHED,RELATED
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#SSH
iptables -A INPUT -p tcp -s 192.168.10.0/24 --sport 512: --dport 22 -j
ACCEPT

#Telnet (Only use if you must, ssh is better)
iptables -A INPUT -p tcp -s 192.168.10.0/24 --sport 1024: --dport 23 -j
ACCEPT

#SMTP
iptables -A INPUT -p tcp -s 192.168.10.0/24 --sport 1024: --dport 25 -j
ACCEPT

#POP3
iptables -A INPUT -p tcp -s 192.168.10.0/24 --sport 1024: --dport 110 -j
ACCEPT

#FTP
iptables -A INPUT -p tcp -s 192.168.10.0/24 --sport 1024: --dport 21 -j
ACCEPT

#Web
iptables -A INPUT -p tcp -s 192.168.10.0/24 --sport 1024: -m multiport
--dports 80,443 -j ACCEPT

#Ping
iptables -A INPUT -p ICMP -s 192.168.10.0/24 --icmp-type echo-request -j
ACCEPT

#Surfing from the firewall
iptables -A OUTPUT -p tcp --dports 80,443 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT

#Internet sharing
iptables -t nat -A POSTROUTING -o $EXTERNAL_INTERFACE -j SNAT --to
$EXTERNAL_IP
iptables -A FORWARD -i $INTERNAL_INTERFACE -o $EXTERNAL_INTERFACE -p tcp
-s 192.168.10.1 --dport 80 -j ACCEPT 
iptables -A FORWARD -i $INTERNAL_INTERFACE -o $EXTERNAL_INTERFACE -p tcp
-s 192.168.10.3 --dport 80 -j ACCEPT
iptables -A FORWARD -i $INTERNAL_INTERFACE -o $EXTERNAL_INTERFACE -p tcp
-s 192.168.10.1 --dport 443 -j ACCEPT
iptables -A FORWARD -i $INTERNAL_INTERFACE -o $EXTERNAL_INTERFACE -p tcp
-s 192.168.10.3 --dport 443 -j ACCEPT
iptables -A FORWARD -i $INTERNAL_INTERFACE -o $EXTERNAL_INTERFACE -s
192.168.10.0/24 --dport ! 80 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT


#/Klintan


> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org 
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Payal Rathod
> Sent: Monday, April 14, 2003 4:00 PM
> To: netfilter@lists.netfilter.org
> Subject: firewall rules
> 
> 
> Hi,
> I have made a few firewall rules, almost stolen from 
> IP-Masquerading HOWTO. Can you please check them and tell 
> about any loopholes. I have a lan of 15 computers and a 
> central linux server. Users can telnet, ping, http, ssh, 
> pop3, smtp in this linux box if only they belong to the lan. 
> Also, users of the lan have internet access to everything 
> except www, how do I mention it? Only ip 192.168.10.1, 
> 192.168.10.3, 192.168.10.10 have www net access also. Rest no.
> 
> So as not to waste bandwidth I have put the rules on my site 
> at www.geocities.com/rpayal99/firewall-b1.txt Please have a 
> look at them and suggest changes. For security I have just 
> made a small change to external IP, but the rest of all the 
> rules are kept as they are.
> 
> With warm regards,
> -Payal
> 
> 
> 
> -- 
> "Visit GNU/Linux Success Stories"
> www.geocities.com/rpayal99
> Guest-Book Section Updated.
> 
> 
>