* help to build a small firewall for a child
@ 2003-03-23 19:34 Andrea Tasso
2003-03-24 8:16 ` Joel Newkirk
2003-03-24 8:34 ` Joel Newkirk
0 siblings, 2 replies; 4+ messages in thread
From: Andrea Tasso @ 2003-03-23 19:34 UTC (permalink / raw)
To: netfilter
hi all,
this is a part of my configuration, now from 192.168.2.2 you can do
surf the internet (I have default ipmask on 192.168.2.1, iptable based).
the router I do not want to use it to do this stuffs, but the 192.168.2.1
server is what I want to use, with iptables, hopefully.
child PC | | | | adsl |
wlan0 | | wlan0 server eth0 | | router |
| | | | |
192.168.2.2 ----- 192.168.2.1 - 10.0.0.1 ---- 10.0.0.138 -151.38.133.194 - internet
I want my child on 192.168.2.2 to be able to connect to a limited list of
web sites (or IPs), say
209.10.154.66
192.25.206.10
63.70.47.55
On eth1 of server there is another net 192.168.1.0 (the server is
192.168.1.1 and the other is 192.168.1.0) I want to keep to be able to do
everything
any example for me ?
thanks a lot, and bye
andrea
this is ifconfig out
eth0 Link encap:Ethernet HWaddr 52:54:05:E2:AD:5A
inet addr:10.0.0.1 Bcast:10.255.255.255 Mask:255.0.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
eth1 Link encap:Ethernet HWaddr 00:50:FC:3F:C8:6F
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
wlan0 Link encap:Ethernet HWaddr 00:09:5B:12:10:AA
inet addr:192.168.2.1 Bcast:192.168.2.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
and this iptables-save
# Generated by iptables-save v1.2.6a on Sun Mar 23 20:29:09 2003
*mangle
:PREROUTING ACCEPT [349421:238898421]
:INPUT ACCEPT [349361:238894776]
:FORWARD ACCEPT [6:360]
:OUTPUT ACCEPT [272574:19680094]
:POSTROUTING ACCEPT [272580:19680454]
-A PREROUTING -i eth1 -j IMQ --todev 0
-A PREROUTING -i eth1 -j MARK --set-mark 0xa
COMMIT
# Completed on Sun Mar 23 20:29:09 2003
# Generated by iptables-save v1.2.6a on Sun Mar 23 20:29:09 2003
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -s 127.0.0.0/255.0.0.0 -i ! lo -j LOG
-A INPUT -s 127.0.0.0/255.0.0.0 -i ! lo -j DROP
-A INPUT -d 255.255.255.255 -i eth1 -j ACCEPT
-A INPUT -d 255.255.255.255 -i wlan0 -j ACCEPT
-A INPUT -s 192.168.1.0/255.255.255.0 -i eth1 -j ACCEPT
-A INPUT -s 192.168.2.0/255.255.255.0 -i wlan0 -j ACCEPT
-A INPUT -d 224.0.0.0/240.0.0.0 -i eth1 -p ! tcp -j ACCEPT
-A INPUT -d 224.0.0.0/240.0.0.0 -i wlan0 -p ! tcp -j ACCEPT
-A INPUT -s 192.168.1.0/255.255.255.0 -i eth0 -j LOG
-A INPUT -s 192.168.1.0/255.255.255.0 -i eth0 -j DROP
-A INPUT -s 192.168.2.0/255.255.255.0 -i eth0 -j LOG
-A INPUT -s 192.168.2.0/255.255.255.0 -i eth0 -j DROP
-A INPUT -d 255.255.255.255 -i eth0 -j ACCEPT
-A INPUT -d 10.0.0.1 -i eth0 -j ACCEPT
-A INPUT -d 10.255.255.255 -i eth0 -j ACCEPT
-A INPUT -j LOG
-A INPUT -j DROP
-A FORWARD -s 192.168.2.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -j
ACCEPT
-A FORWARD -s 192.168.1.0/255.255.255.0 -d 192.168.2.0/255.255.255.0 -j
ACCEPT
-A FORWARD -s 192.168.1.0/255.255.255.0 -i eth1 -o eth0 -j ACCEPT
-A FORWARD -d 192.168.1.0/255.255.255.0 -i eth0 -o eth1 -j ACCEPT
-A FORWARD -s 192.168.2.0/255.255.255.0 -i wlan0 -o eth0 -j ACCEPT
-A FORWARD -d 192.168.2.0/255.255.255.0 -i eth0 -o wlan0 -j ACCEPT
-A FORWARD -d 192.168.1.0/255.255.255.0 -o eth0 -j LOG
-A FORWARD -d 192.168.1.0/255.255.255.0 -o eth0 -j DROP
-A FORWARD -d 192.168.2.0/255.255.255.0 -o eth0 -j LOG
-A FORWARD -d 192.168.2.0/255.255.255.0 -o eth0 -j DROP
-A FORWARD -j LOG
-A FORWARD -j DROP
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -d 255.255.255.255 -o eth1 -j ACCEPT
-A OUTPUT -d 255.255.255.255 -o wlan0 -j ACCEPT
-A OUTPUT -d 192.168.1.0/255.255.255.0 -o eth1 -j ACCEPT
-A OUTPUT -d 192.168.2.0/255.255.255.0 -o wlan0 -j ACCEPT
-A OUTPUT -d 224.0.0.0/240.0.0.0 -o eth1 -p ! tcp -j ACCEPT
-A OUTPUT -d 224.0.0.0/240.0.0.0 -o wlan0 -p ! tcp -j ACCEPT
-A OUTPUT -d 192.168.1.0/255.255.255.0 -o eth0 -j LOG
-A OUTPUT -d 192.168.1.0/255.255.255.0 -o eth0 -j DROP
-A OUTPUT -d 192.168.2.0/255.255.255.0 -o eth0 -j LOG
-A OUTPUT -d 192.168.2.0/255.255.255.0 -o eth0 -j DROP
-A OUTPUT -d 255.255.255.255 -o eth0 -j ACCEPT
-A OUTPUT -s 10.0.0.1 -o eth0 -j ACCEPT
-A OUTPUT -s 10.255.255.255 -o eth0 -j ACCEPT
-A OUTPUT -j LOG
-A OUTPUT -j DROP
COMMIT
# Completed on Sun Mar 23 20:29:09 2003
# Generated by iptables-save v1.2.6a on Sun Mar 23 20:29:09 2003
*nat
:PREROUTING ACCEPT [5260:467218]
:POSTROUTING ACCEPT [261:17083]
:OUTPUT ACCEPT [14928:978050]
-A POSTROUTING -s 192.168.1.0/255.255.255.0 -j MASQUERADE
-A POSTROUTING -s 192.168.2.0/255.255.255.0 -j MASQUERADE
-A POSTROUTING -o eth0 -j SNAT --to-source 10.0.0.1
COMMIT
# Completed on Sun Mar 23 20:29:09 2003
andrea@tasso.info
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: help to build a small firewall for a child
2003-03-23 19:34 help to build a small firewall for a child Andrea Tasso
@ 2003-03-24 8:16 ` Joel Newkirk
2003-03-24 8:34 ` Joel Newkirk
1 sibling, 0 replies; 4+ messages in thread
From: Joel Newkirk @ 2003-03-24 8:16 UTC (permalink / raw)
To: Andrea Tasso, netfilter
On Sunday 23 March 2003 02:34 pm, Andrea Tasso wrote:
> hi all,
> this is a part of my configuration, now from 192.168.2.2 you can do
> surf the internet (I have default ipmask on 192.168.2.1, iptable
> based). the router I do not want to use it to do this stuffs, but the
> 192.168.2.1 server is what I want to use, with iptables, hopefully.
>
>
> child PC | | | | adsl
> | wlan0 | | wlan0 server eth0 | | router
It's generally believed to be a bad idea to post your complete firewall
rules and your public IP to the list. All posts to this list eventually
find themselves on a public web page indexed by search engines.
> I want my child on 192.168.2.2 to be able to connect to a limited list
> of web sites (or IPs), say
> 209.10.154.66
> 192.25.206.10
> 63.70.47.55
>
> On eth1 of server there is another net 192.168.1.0 (the server is
> 192.168.1.1 and the other is 192.168.1.0) I want to keep to be able to
> do everything
>
> any example for me ?
This is not the best way to handle this, it really shouldn't be a
firewall solution. Filtering in a proxy would be more appropriate. If
the child in question has their own computer, and it runs windows, you
can enable filtering in Internet Exploiter and create an 'approved' list
there, which will require a password to bypass or add to. But as far as
restricting via netfilter this should do what you ask:
iptables -N KidFilter
iptables -A FORWARD -s 192.168.2.2 -p tcp --dport 80 -j KidFilter
iptables -A FORWARD -s 192.168.2.2 -p tcp --dport 80 -j REJECT \
--reject-with icmp-host-prohibited
iptables -A KidFilter -d 209.10.154.66 -j ACCEPT
etc. You can also use the URL in a rule, like:
iptables -A KidFilter -d www.mamamedia.com -j ACCEPT
If you want to get fancier, you can keep a list of approved IPs (or URLs)
somewhere, like /usr/etc/KidFilterIPs, then add those from within a
firewall script with this loop:
for ip in $(cat /usr/etc/KidFilterIPs | grep -v #); do /sbin/iptables -A
KidFilter -d $ip -j ACCEPT; done
the "grep -v #" will match any line in the file that does NOT have a # in
it. This means you have to have each IP or URL on a separate line, and
you can insert comment lines in the list simply by having a # somewhere
in the line, traditionally the first character.
If you go with this you'll need to ensure that /usr/etc/KidFilterIPs is
readable by root at least.
> and this iptables-save
Do you use iptables-load and iptables-save each time, or just to generate
this listing? If you use it all the time, then the above approach would
still work, but obviously you wouldn't have a script you could place the
mentioned loop in...
> -A FORWARD -s 192.168.2.0/255.255.255.0 -i wlan0 -o eth0 -j ACCEPT
Just make sure that the rules for this specific computer are reached
before this rule here. You want to filter 192.168.2.2 first, ACCEPTing
what is acceptable, REJECTing what you don't want to permit, THEN the
rest of 192.168.2.0/24 will still be handled by this rule. If
connections from 192.168.2.2 hit this rule first, they will always get
through.
> andrea@tasso.info
j
--
There are only 10 types of people in the world:
those who understand binary notation,
and those who don't.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: help to build a small firewall for a child
2003-03-23 19:34 help to build a small firewall for a child Andrea Tasso
2003-03-24 8:16 ` Joel Newkirk
@ 2003-03-24 8:34 ` Joel Newkirk
1 sibling, 0 replies; 4+ messages in thread
From: Joel Newkirk @ 2003-03-24 8:34 UTC (permalink / raw)
To: netfilter
On Sunday 23 March 2003 02:34 pm, Andrea Tasso wrote:
> hi all,
> this is a part of my configuration, now from 192.168.2.2 you can do
> surf the internet (I have default ipmask on 192.168.2.1, iptable
> based). the router I do not want to use it to do this stuffs, but the
> 192.168.2.1 server is what I want to use, with iptables, hopefully.
> child PC | | | | adsl
> | wlan0 | | wlan0 server eth0 | | router
It's generally believed to be a bad idea to post your complete firewall
rules and your public IP to the list. All posts to this list eventually
find themselves on a public web page indexed by search engines.
> I want my child on 192.168.2.2 to be able to connect to a limited list
> of web sites (or IPs), say
> 209.10.154.66
> 192.25.206.10
> 63.70.47.55
> On eth1 of server there is another net 192.168.1.0 (the server is
> 192.168.1.1 and the other is 192.168.1.0) I want to keep to be able to
> do everything
> any example for me ?
This is not the best way to handle this, it really shouldn't be a
firewall solution. Filtering in a proxy would be more appropriate. If
the child in question has their own computer, and it runs windows, you
can enable filtering in Internet Exploiter and create an 'approved' list
there, which will require a password to bypass or add to. But as far as
restricting via netfilter this should do what you ask:
iptables -N KidFilter
iptables -A FORWARD -s 192.168.2.2 -p tcp --dport 80 -j KidFilter
iptables -A FORWARD -s 192.168.2.2 -p tcp --dport 80 -j REJECT \
--reject-with icmp-host-prohibited
iptables -A KidFilter -d 209.10.154.66 -j ACCEPT
etc. You can also use the URL in a rule, like:
iptables -A KidFilter -d www.mamamedia.com -j ACCEPT
If you want to get fancier, you can keep a list of approved IPs (or URLs)
somewhere, like /usr/etc/KidFilterIPs, then add those from within a
firewall script with this loop:
for ip in $(cat /usr/etc/KidFilterIPs | grep -v #); do /sbin/iptables -A
KidFilter -d $ip -j ACCEPT; done
the "grep -v #" will match any line in the file that does NOT have a # in
it. This means you have to have each IP or URL on a separate line, and
you can insert comment lines in the list simply by having a # somewhere
in the line, traditionally the first character.
If you go with this you'll need to ensure that /usr/etc/KidFilterIPs is
readable by root at least.
> and this iptables-save
Do you use iptables-load and iptables-save each time, or just to generate
this listing? If you use it all the time, then the above approach would
still work, but obviously you wouldn't have a script you could place the
mentioned loop in...
> -A FORWARD -s 192.168.2.0/255.255.255.0 -i wlan0 -o eth0 -j ACCEPT
Just make sure that the rules for this specific computer are reached
before this rule here. You want to filter 192.168.2.2 first, ACCEPTing
what is acceptable, REJECTing what you don't want to permit, THEN the
rest of 192.168.2.0/24 will still be handled by this rule. If
connections from 192.168.2.2 hit this rule first, they will always get
through.
> andrea@tasso.info
j
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: help to build a small firewall for a child
@ 2003-03-24 8:58 Joel Newkirk
0 siblings, 0 replies; 4+ messages in thread
From: Joel Newkirk @ 2003-03-24 8:58 UTC (permalink / raw)
To: netfilter
On Sunday 23 March 2003 02:34 pm, Andrea Tasso wrote:
> hi all,
> this is a part of my configuration, now from 192.168.2.2 you can do
> surf the internet (I have default ipmask on 192.168.2.1, iptable
> based). the router I do not want to use it to do this stuffs, but the
> 192.168.2.1 server is what I want to use, with iptables, hopefully.
> child PC | | | | adsl
> | wlan0 | | wlan0 server eth0 | | router
It's generally believed to be a bad idea to post your complete firewall
rules and your public IP to the list. All posts to this list eventually
find themselves on a public web page indexed by search engines.
> I want my child on 192.168.2.2 to be able to connect to a limited list
> of web sites (or IPs), say
> 209.10.154.66
> 192.25.206.10
> 63.70.47.55
> On eth1 of server there is another net 192.168.1.0 (the server is
> 192.168.1.1 and the other is 192.168.1.0) I want to keep to be able to
> do everything
> any example for me ?
This is not the best way to handle this, it really shouldn't be a
firewall solution. Filtering in a proxy would be more appropriate. If
the child in question has their own computer, and it runs windows, you
can enable filtering in Internet Exploiter and create an 'approved' list
there, which will require a password to bypass or add to. But as far as
restricting via netfilter this should do what you ask:
iptables -N KidFilter
iptables -A FORWARD -s 192.168.2.2 -p tcp --dport 80 -j KidFilter
iptables -A FORWARD -s 192.168.2.2 -p tcp --dport 80 -j REJECT \
--reject-with icmp-host-prohibited
iptables -A KidFilter -d 209.10.154.66 -j ACCEPT
etc. You can also use the URL in a rule, like:
iptables -A KidFilter -d www.mamamedia.com -j ACCEPT
If you want to get fancier, you can keep a list of approved IPs (or URLs)
somewhere, like /usr/etc/KidFilterIPs, then add those from within a
firewall script with this loop:
for ip in $(cat /usr/etc/KidFilterIPs | grep -v #); do /sbin/iptables -A
KidFilter -d $ip -j ACCEPT; done
the "grep -v #" will match any line in the file that does NOT have a # in
it. This means you have to have each IP or URL on a separate line, and
you can insert comment lines in the list simply by having a # somewhere
in the line, traditionally the first character.
If you go with this you'll need to ensure that /usr/etc/KidFilterIPs is
readable by root at least.
> and this iptables-save
Do you use iptables-load and iptables-save each time, or just to generate
this listing? If you use it all the time, then the above approach would
still work, but obviously you wouldn't have a script you could place the
mentioned loop in...
> -A FORWARD -s 192.168.2.0/255.255.255.0 -i wlan0 -o eth0 -j ACCEPT
Just make sure that the rules for this specific computer are reached
before this rule here. You want to filter 192.168.2.2 first, ACCEPTing
what is acceptable, REJECTing what you don't want to permit, THEN the
rest of 192.168.2.0/24 will still be handled by this rule. If
connections from 192.168.2.2 hit this rule first, they will always get
through.
> andrea@tasso.info
j
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2003-03-24 8:58 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-03-23 19:34 help to build a small firewall for a child Andrea Tasso
2003-03-24 8:16 ` Joel Newkirk
2003-03-24 8:34 ` Joel Newkirk
-- strict thread matches above, loose matches on Subject: below --
2003-03-24 8:58 Joel Newkirk
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox