Re: Best Practices for iptables

["Michael H. Warfield" <mhw@wittsend.com>]

[-- Attachment #1: Type: text/plain, Size: 2829 bytes --]

On Fri, Dec 05, 2003 at 04:11:42PM +0200, Ray Leach wrote:
> On Fri, 2003-12-05 at 16:01, Gabby James wrote:
> > Hi,

> > I want to allow everything on eth1 and be selective on eth0.  What is the 
> > best way of handling unwanted packets?

> > A) Change the policy of the chain to DROP then allow what I want.  Example:
> > iptables -P INPUT DROP
> > iptables -A INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT


> > B) or leave the policy of the INPUT chain to ACCEPT but put REJECT rules at 
> > the end. Example:
> > iptables -A INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT
> > iptables -A INPUT -p tcp -m tcp -j REJECT
> > iptables -A INPUT -p udp -m udp -j REJECT
> > iptables -A INPUT -p icmp -j DROP

> > This will give me the same outcome won't it?
> No, none of your rules reference the interface, e.g -i eth0
> So your rules allow/reject on all interfaces.

	One HUGE difference between A and B is what's not seen in there
at all.  Not all protocols are tcp, udp, or icmp.  There's also things
like AH, ESP, SIT (aka IPv6), and GRE.  All of these things would be
blocked by A and will pass straight through B unempeded.  SIT, especially,
could be problematical since an attacker could simply set up and IPv6 over
IPv4 tunnel that will pass straight through your firewall and route
entire subnets out to the Internet.  With 6to4 (6over4 using the 2002::/16
TLA) they don't even need static IPv6 configurations.  If you let that
pass through, your IPv4 iptables won't even see tcp or udp in that
tunnel, all it will see is IPv4 protocol 41 (SIT/ipv6).  Even if you have
iptables6 loaded, it wont see tcp or udp on IPv6, because it's IPv4
protocol 41 and not seen by the IPv6 iptables at all.  So, either way,
that protocol has to be stopped or you may end up with IPv6 on your network
and never realize it or successfully filter it.

	Always remember...  There's more riding on the next layer up than
just tcp, udp, and icmp.  A lot more.  And what you don't know can come
back to bite you.

> > Thanks in advance!

> > _________________________________________________________________
> > Winterize your home with tips from MSN House & Home. 
> > http://special.msn.com/home/warmhome.armx
> -- 
> --
> Raymond Leach <raymondl@knowledgefactory.co.za>
> Network Support Specialist
> http://www.knowledgefactory.co.za
> "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
> Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
> --

	Mike
-- 
 Michael H. Warfield    |  (770) 985-6132   |  mhw@WittsEnd.com
  /\/\|=mhw=|\/\/       |  (678) 463-0932   |  http://www.wittsend.com/mhw/
  NIC whois:  MHW9      |  An optimist believes we live in the best of all
 PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!

[-- Attachment #2: Type: application/pgp-signature, Size: 307 bytes --]