From mboxrd@z Thu Jan 1 00:00:00 1970 From: Nicolas KOWALSKI Subject: Re: ip6tables icmp conntracking on 2.6.18 vs 2.6.24 Date: Fri, 04 Apr 2008 19:57:00 +0200 Message-ID: <87y77tpkpf.fsf@petole.dyndns.org> References: <47F4A36A.2010600@plouf.fr.eu.org> <20080403102632.GA22035@piper.oerlikon.madduck.net> <47F4F2B0.9020205@plouf.fr.eu.org> <873aq3ymr1.fsf@petole.dyndns.org> <20080403153847.GA17170@piper.oerlikon.madduck.net> <87y77vx7kn.fsf@petole.dyndns.org> <20080404085100.GB27854@piper.oerlikon.madduck.net> <87lk3uq9p3.fsf@petole.dyndns.org> <20080404110428.GA32555@piper.oerlikon.madduck.net> <877ifdrfu4.fsf@petole.dyndns.org> <20080404123940.GA9157@piper.oerlikon.madduck.net> Mime-Version: 1.0 Return-path: In-Reply-To: <20080404123940.GA9157@piper.oerlikon.madduck.net> Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@vger.kernel.org martin f krafft writes: > Ideally, however, --syn is no longer needed if you do > > -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT > -A INPUT -m state --state INVALID -j DROP > -A INPUT -m state --state NEW -j in-new > > -A in-new -p tcp --dport 22 -j ACCEPT > [...] > > -A INPUT -j log-and-drop > > I /think/ this is the correct way to write iptables rules, but > please correct me if I am wrong, anyone! Ok, I use your suggestion. > Now make sure that your hosts don't honour redirects. I actually > don't think passing *all* ICMPv6 is a good idea. Do read the RFC > (see followup thread). I read the RFC (whose example script contains typos). "Just for fun", I applied the recommandations, and ended up with the following. Note the ruleset for ICMPv6... This is getting scary, isn't it ? These certainly need some cleanup, but you get it. # Generated by ip6tables-save v1.3.6 on Fri Apr 4 19:54:58 2008 *filter :INPUT ACCEPT [1:200] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [5:360] :IN-NEW - [0:0] :icmpv6-filter - [0:0] :icmpv6-filter-from-internal - [0:0] :icmpv6-filter-to-internal - [0:0] :icmpv6-filter-to-internal-s - [0:0] -A INPUT -s ::/0 -d ::/0 -i lo -j ACCEPT -A INPUT -s ::/0 -d ::/0 -p ipv6-icmp -j ACCEPT -A INPUT -s ::/0 -d ::/0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -s ::/0 -d ::/0 -m state --state INVALID -j DROP -A INPUT -s ::/0 -d ::/0 -m state --state NEW -j IN-NEW -A INPUT -s ::/0 -d ::/0 -j DROP -A FORWARD -s ::/0 -d ::/0 -p ipv6-icmp -j icmpv6-filter -A FORWARD -s ::/0 -d 2001:6f8:3f1::/48 -i sixxs -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 2001:6f8:3f1::/48 -d ::/0 -i eth0 -o sixxs -j ACCEPT -A FORWARD -s ::/0 -d ::/0 -j DROP -A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 22 -j ACCEPT -A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 25 -j ACCEPT -A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 80 -j ACCEPT -A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 443 -j ACCEPT -A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 465 -j ACCEPT -A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 993 -j ACCEPT -A IN-NEW -s ::/0 -d ::/0 -j DROP -A icmpv6-filter -s ::/0 -d fe80::/10 -p ipv6-icmp -j DROP -A icmpv6-filter -s fe80::/10 -d ::/0 -p ipv6-icmp -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 137 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 135 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 136 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 133 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 134 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 130 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 131 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 132 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 143 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 138 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 139 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 140 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -j ACCEPT -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m state --state RELATED,ESTABLISHED -m icmp6 --icmpv6-type 129 -j ACCEPT -A icmpv6-filter -s 2001:6f8:3f1::/48 -d ::/0 -j icmpv6-filter-from-internal -A icmpv6-filter -s ::/0 -d 2001:6f8:3f1::/48 -j icmpv6-filter-to-internal -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -j DROP -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 128 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 1 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 2 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 3/0 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 3/1 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/2 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 145 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 147 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/2 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -j DROP -A icmpv6-filter-to-internal -s ::/0 -d ::/0 -m state --state RELATED,ESTABLISHED -j icmpv6-filter-to-internal-s -A icmpv6-filter-to-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 128 -j ACCEPT -A icmpv6-filter-to-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 144 -j ACCEPT -A icmpv6-filter-to-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 146 -j ACCEPT -A icmpv6-filter-to-internal -s ::/0 -d ::/0 -j DROP -A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 1 -j ACCEPT -A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 2 -j ACCEPT -A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 3/0 -j ACCEPT -A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 3/1 -j ACCEPT -A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -j ACCEPT -A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/2 -j ACCEPT -A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -j DROP COMMIT # Completed on Fri Apr 4 19:54:58 2008 -- Nicolas