Final IPTables script (hopefully)

Final IPTables script (hopefully)

[Jason Williams]

Hello everyone.

Back from a much needed vacation today and started back at IPTables. After 
reading up on a lot of documentation and taking some very good advice from 
this list, here is what i have come up with, in hopes of getting it right, 
to act as a personal firewall for my home network.

Without further a due...

#External interface
INET_IP="xxx.xxx.xxx.xxx"
INET_IFACE="eth0"

#Internal/Private LAN
LAN_IP="192.168.0.2"
LAN_IP_RANGE="192.168.0.0/24"
LAN_IFACE="eth1"

#LOOPback
LO_IFACE="lo"
LO_IP="127.0.0.1"

Variables. As always...

# 1.5 IPTables Configuration.

IPTABLES="/usr/sbin/iptables"

#Default Policy Setting

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

Not much needs to be said here.

#Custom chains

$IPTABLES -N tcp_packets

# bad_tcp_packets chain

$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state 
--state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG 
--log-prefix "New not syn:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

Like the idea of this rule. Trying to prevent NMAP scans, xmas scans etc.

# Rules for incoming packets from the internet.

$IPTABLES -A INPUT -p ALL -d $INET_IFACE -m state --state 
ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -i $LAN_IFACE -s 172.16.1.2 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT

Should allow traffic to flow freely from the firewall to the internet and 
accept returning connections. No connections from the internet that are 
intiated will be accepted.
Acceping SSH from 172.16.1.2 on the private LAN.
Accceptin loopback interface.

# Accept the packets we actually want to forward

$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $LAN_IFACE -o $INET_IFACE -s $LAN_IP_RANGE -j ACCEPT

Pass out private LAN traffic and return it. First rule is in line for 
better performance.

# Special OUTPUT rules to decide which IP's to allow.

$IPTABLES -A OUTPUT -j ACCEPT

Simple enough.


#NAT SETUP

$IPTABLES -t nat -A POSTROUTING -s $LAN_IP -o $INET_IFACE -j SNAT 
--to-source $INET_IP

Do SNAT for trafffic on the private LAN.


Feel good about these rules. Just wante to ask one last time before I go 
live, in case i booger it up and need help

Appreciate the feedback.

Jason

Re: Final IPTables script (hopefully)

[cldavis]

> -----Original Message-----
> From: Jason Williams [mailto:jwilliams@courtesymortgage.com]
> Sent: Tuesday, December 28, 2004 11:48 PM
> To: netfilter@lists.netfilter.org
> Subject: Final IPTables script (hopefully)
>
> Hello everyone.
>
> Back from a much needed vacation today and started back at IPTables. After
> reading up on a lot of documentation and taking some very good advice from
> this list, here is what i have come up with, in hopes of getting it right,
> to act as a personal firewall for my home network.
>
[...]
> $IPTABLES -P INPUT DROP
> $IPTABLES -P OUTPUT DROP
> $IPTABLES -P FORWARD DROP
[...]
> $IPTABLES -A OUTPUT -j ACCEPT
>
[...]
Looks pretty good...except you have the policy for OUTPUT set to DROP, but you are allowing all unmatched traffic on OUTPUT to pass through.  If you want to allow all traffic outbound you may want to eliminate the line: $IPTABLES -A OUTPUT -j ACCEPT and change your OUTPUT policy to ACCEPT.

If you want to really tighten the belt so to speak and leave the policy for OUTPUT to drop, you might want to consider using nmap, strace, and log all dropped packets for a while and set rules specifically for outbound traffic.

I say looks good otherwise...if you plan on admining the box via remote interfaces make sure to leave yourself a way in :)

~Regards,
Chris

Re: Final IPTables script (hopefully)

[Jason Opperisano]

On Tue, 2004-12-28 at 18:48, Jason Williams wrote:
> #Custom chains
> 
> $IPTABLES -N tcp_packets

typo:  $IPTABLES -N bad_tcp_packets

> # bad_tcp_packets chain
> 
> $IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state 
> --state NEW -j REJECT --reject-with tcp-reset
> $IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG 
> --log-prefix "New not syn:"
> $IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

you also never jump to this custom chain anywhere in your rules below. 
maybe you wanted:

  $IPTABLES -A INPUT -j bad_tcp_packets
  $IPTABLES -A FORWARD -j bad_tcp_packets

but i don't really know for sure.

> Like the idea of this rule. Trying to prevent NMAP scans, xmas scans etc.
> 
> # Rules for incoming packets from the internet.
> 
> $IPTABLES -A INPUT -p ALL -d $INET_IFACE -m state --state 
> ESTABLISHED,RELATED -j ACCEPT

typo:  "-d $INET_IFACE" expands to "-d eth0" my guess is you either mean
"-d $INET_IP" or "-i $INET_IFACE" from your explanation below i guess
it's the latter.

and the "-p ALL" is still unnecessary...

> $IPTABLES -A INPUT -i $LAN_IFACE -s 172.16.1.2 --dport 22 -j ACCEPT
> $IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
> 
> Should allow traffic to flow freely from the firewall to the internet and 
> accept returning connections. No connections from the internet that are 
> intiated will be accepted.
> Acceping SSH from 172.16.1.2 on the private LAN.
> Accceptin loopback interface.
> 
> # Accept the packets we actually want to forward
> 
> $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> $IPTABLES -A FORWARD -i $LAN_IFACE -o $INET_IFACE -s $LAN_IP_RANGE -j ACCEPT
> 
> Pass out private LAN traffic and return it. First rule is in line for 
> better performance.
> 
> # Special OUTPUT rules to decide which IP's to allow.
> 
> $IPTABLES -A OUTPUT -j ACCEPT
> 
> Simple enough.
> 
> 
> #NAT SETUP
> 
> $IPTABLES -t nat -A POSTROUTING -s $LAN_IP -o $INET_IFACE -j SNAT 
> --to-source $INET_IP
> 
> Do SNAT for trafffic on the private LAN.

typo:  $LAN_IP = 192.168.0.2; which i'm guessing is the IP of the
firewall itself.  i think you mean $LAN_IP_RANGE

> Feel good about these rules. Just wante to ask one last time before I go 
> live, in case i booger it up and need help

the theory is good; just missing some polish in the execution.

-j

--
"Kids, you tried your best and you failed miserably. The lesson is,
 never try."
	--The Simpsons