From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: Ruleset Date: Tue, 10 Aug 2004 09:27:22 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200408100927.22281.Antony@Soft-Solutions.co.uk> References: Reply-To: "iptables" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: iptables On Tuesday 10 August 2004 8:22 am, Brent Clark wrote: > Hi all > > If possible would someone be so kind as to have a look at my ruleset and if > possible, share some pointers. I have another linux box (Ip address > 192.168.3.3, connected to eth1 on the FW) I have a lan (192.168.2.0/24) > connected to eth0 For my internet handling I have a ppp connection. Im also > currently toying with dyndns (ez-ipupdate). 1. For efficiency I would put the ESTABLISHED,RELATED rule first in your INPUT chain. 2. I do not entirely approve of running a DNS server on the firewall. Since you have another box availabel on 192.168.3.3 I would suggest running DNS on that and redirecting requests (or configuring clients to know what's where to find it). 3. I do not think you will see any packets addressed to 192.168.2.255 in the FORWARD chain - they would appear in the INPUT chain. I also think they should be logged as "BROADCAST", not as "INVALID". 4. Do you *really* want to allow *all* NEW packets from the Internet to the DMZ, no matter what protocol they are? You might as well simply stick your 192.168.3.3 machine on a public IP address with no firewall.... 5. For efficiency I would put the ESTABLISHED,RELATED rule first in your OUTPUT chain. 6. The default DROP policy on OUTPUT is rather misleading (and may give you a false sense of security), since the ruleset allows all NEW, ESTABLISHED, and RELATED packets. That means everything which can be part of a connection. Regards, Antony. -- The idea that Bill Gates appeared like a knight in shining armour to lead all customers out of a mire of technological chaos neatly ignores the fact that it was he who, by peddling second-rate technology, led them into it in the first place. - Douglas Adams in The Guardian, 25th August 1995 Please reply to the list; please don't CC me.