Quick help with stateless firewall

Quick help with stateless firewall

[Alex Flex]

Hello,

I have the following simpel stateless firewall... the issue is iam not 
able to send ICMPs queries from within the machine. What could I modify 
or add for this to be able to happen .  Also iam only intending to run a 
HTTP service and DNS service is it fine the way it is?

Also, I intend to keep the script stateless not wanting to use conntrack 
at all.

Thanks
Alex


#!/bin/bash

/sbin/iptables -F
/sbin/iptables -X

/sbin/iptables -P INPUT DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -P OUTPUT ACCEPT

#Accept SSH
/sbin/iptables -A INPUT -p tcp -m tcp -s 204.199.62.74 --dport 22 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 1000:65535 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -p udp --dport 53 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 53 -j ACCEPT

Re: Quick help with stateless firewall

[Bryan Harris]

I think you need this,

iptables -I INPUT -p icmp --icmp-type 8 -j ACCEPT

You can also do -j LOG to see what makes it to a certain place in the chain.

Bryan

On Jun 15, 2013, at 7:38 PM, Alex Flex <aflexzor@gmail.com> wrote:

> Hello,
> 
> I have the following simpel stateless firewall... the issue is iam not able to send ICMPs queries from within the machine. What could I modify or add for this to be able to happen .  Also iam only intending to run a HTTP service and DNS service is it fine the way it is?
> 
> Also, I intend to keep the script stateless not wanting to use conntrack at all.
> 
> Thanks
> Alex
> 
> 
> #!/bin/bash
> 
> /sbin/iptables -F
> /sbin/iptables -X
> 
> /sbin/iptables -P INPUT DROP
> /sbin/iptables -P FORWARD DROP
> /sbin/iptables -P OUTPUT ACCEPT
> 
> #Accept SSH
> /sbin/iptables -A INPUT -p tcp -m tcp -s 204.199.62.74 --dport 22 -j ACCEPT
> 
> /sbin/iptables -A INPUT -p tcp --dport 1000:65535 -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
> /sbin/iptables -A INPUT -p udp --dport 53 -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 53 -j ACCEPT
> 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Quick help with stateless firewall

[Neal Murphy]

IPv4 doesn't work very well without ICMP; generally, one should always accept 
it, in and out. However, it's OK to drop icmp-type=8 (ECHO requests) on input 
from non-local sources when the system should not respond to pings from 
others.

On Saturday, June 15, 2013 07:50:34 PM Bryan Harris wrote:
> I think you need this,
> 
> iptables -I INPUT -p icmp --icmp-type 8 -j ACCEPT
> 
> You can also do -j LOG to see what makes it to a certain place in the
> chain.
> 
> Bryan
> 
> On Jun 15, 2013, at 7:38 PM, Alex Flex <aflexzor@gmail.com> wrote:
> > Hello,
> > 
> > I have the following simpel stateless firewall... the issue is iam not
> > able to send ICMPs queries from within the machine. What could I modify
> > or add for this to be able to happen .  Also iam only intending to run a
> > HTTP service and DNS service is it fine the way it is?
> > 
> > Also, I intend to keep the script stateless not wanting to use conntrack
> > at all.
> > 
> > Thanks
> > Alex
> > 
> > 
> > #!/bin/bash
> > 
> > /sbin/iptables -F
> > /sbin/iptables -X
> > 
> > /sbin/iptables -P INPUT DROP
> > /sbin/iptables -P FORWARD DROP
> > /sbin/iptables -P OUTPUT ACCEPT
> > 
> > #Accept SSH
> > /sbin/iptables -A INPUT -p tcp -m tcp -s 204.199.62.74 --dport 22 -j
> > ACCEPT
> > 
> > /sbin/iptables -A INPUT -p tcp --dport 1000:65535 -j ACCEPT
> > /sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
> > /sbin/iptables -A INPUT -p udp --dport 53 -j ACCEPT
> > /sbin/iptables -A INPUT -p tcp --dport 53 -j ACCEPT
> > 
> > 
> > --
> > To unsubscribe from this list: send the line "unsubscribe netfilter" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

RE: Quick help with stateless firewall

[André Paulsberg]

There are no ICMP rules at all in your example , I would reckon you need 2 rules on a stateless firewall ( atleast ).

ONE for ICMP type 8 on OUTPUT ( your machine sending ECHO REQUEST ) , not need as long as you have ACCEPT for all OUTPUT .
and ONE for ICMP type 0 on INPUT ( other machines sending ECHO REPLY back to your machine ) .

/sbin/iptables -A OUTPUT -p icmp -icmp-type 8 -j ACCEPT
/sbin/iptables -A INPUT -p icmp -icmp-type 0 -j ACCEPT

If you want others to be able to ping your machine you do the reverse way with the rules !

And since you ONLY need 2 services , you may want to remove this rule 
/sbin/iptables -A INPUT -p tcp --dport 1000:65535 -j ACCEPT

If you need to allow for outgoing return traffic you should allow source-services you need/use .
/sbin/iptables -A INPUT -p tcp --sport 80 --dport 1025:65535 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --sport 53 --dport 1025:65535 -j ACCEPT
/sbin/iptables -A INPUT -p udp --sport 53 --dport 1025:65535 -j ACCEPT

And same for OUTPUT ( unless you continue with all ACCEPT )
/sbin/iptables -A OUTPUT -p tcp --dport 80 --sport 1025:65535 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 53 --sport 1025:65535 -j ACCEPT
/sbin/iptables -A OUTPUT -p udp --dport 53 --sport 1025:65535 -j ACCEPT
Or just
/sbin/iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
/sbin/iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

As a common rule with stateless firewalls YOU might wanna accept 2 more ICMP types

/sbin/iptables -A OUTPUT -p icmp -icmp-type 3 -j ACCEPT
/sbin/iptables -A OUTPUT -p icmp -icmp-type 11 -j ACCEPT
/sbin/iptables -A INPUT -p icmp -icmp-type 3 -j ACCEPT
/sbin/iptables -A INPUT -p icmp -icmp-type 11 -j ACCEPT

Type 3 is used for all types of "unreachable" messages , and type 11 is "time exceed" -
most commonly used for traceroute replies , but it is also sent for packets that travel "too far" :)


Best regards
André Paulsberg
Senior Network Engineer 
Core Network
Operation, Network, Nordic Operations
andre.paulsberg@evry.com
M +47 xxx yyyyy