[CentOS] IPTables help

[Robert Spangler]

On Friday 23 May 2008 11:03, Fajar Priyanto wrote:

>  On Thursday 22 May 2008 22:30:29 Joseph L. Casale wrote:
>  > I have a dual homed server in an install for someone who is very cost
>  > sensitive. This server originally is being setup as an Asterisk server,
>  > but now the simplest thing for me to do is also set it up to provide
>  > internet access for the small shop as well.
>  >
>  > So it will have one external, WAN  facing nic that needs all incoming
>  > ports except UDP 5060 and 10000 -> 60000 blocked for all but two ips.
>  >
>  > The internal, LAN facing  NIC will need all ports except voip/dns/http
>  > blocked to it, and need to provide masquerading.
>  >
>  > I have limited experience with iptables and would love some guidelines.
>  > Any pointers would be greatly appreciated!
>
>  Hi JLC,
>  There are 2 ways to implement firewall: negative list and positive list.
> Looks like you want a very strict one that is positive list.
>
>  Assuming eth0 is WAN, and eth1 is LAN (assuming 192.168.0.0/24)(please
> mind the word wrap):
>  #Clear all rules and policies first:
>  iptables -P INPUT ACCEPT
>  iptables -P OUTPUT ACCEPT
>  iptables -P FORWARD ACCEPT
>  iptables -F
>  iptables -t nat -F

Since you believe that he wants a very strict firewall why are you setting the 
default policy's to ACCEPT?  Security 101, strict firewall drops everything 
from the start.  Then you open the access you require, not the other way 
around.

>  #Give access for localhost:
>  iptables -I INPUT -i lo -j ACCEPT
>  iptables -I OUTPUT -o lo -j ACCEPT
>
>  #To make life easier:
>  iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>  iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>  iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
>
>  #Allowing needed ports:
>  iptables -A INPUT -i eth0 -m multiport -p udp --dport 5060,10000:60000 -s
>  ipthatyouwantallow -j ACCEPT
>  iptables -A INPUT -i eth1 -m multiport -p udp --dport
>  53,80,5060,10000:60000 -j ACCEPT
>  iptables -A OUTPUT -m multiport -p udp --dport 53 -j ACCEPT
>  iptables -A FORWARD -m multiport -p udp --dport 53,5060,10000:60000 -s
>  ipthatyouallow -j ACCEPT
>  iptables -A FORWARD -m multiport -p tcp --dport 80 -j ACCEPT

First question you need to ask yourself is there any hosting services on this 
box that will require a connection form the WAN side.  If not then you should 
change your input statements to allow only the LAN.  You do not require the 
INPUT statements for packets that pass through the box as the FORWARD will 
handle all traffic passing through.

Second question is if you are using ESTABLISHED,RELATED why are you not using 
NEW in the above rules?

Third question is have you enables connection tracking?  If you are using 
ESTABLISHED,RELATED then the system needs a way to keep track of the 
connection.

If you want a 100% secure firewall then you will not allow any INPUT.  All 
modification would have to be done from the box using a keyboard.  If this is 
not an option then you can allow access from a trusted IP only and setup other 
security options.

>  #For masquerading:
>  iptables -t nat -A POSTROUTING -o eth0 -d ! 192.168.0.0/24 -j MASQUERADE

If the WAN port is connected directly to the Internet then you should MASQ all 
out going traffic and anything that is heading to 192.168.0.0/24 should be 
dropped.

>  #For logging (troubleshooting):
>  iptables -A INPUT -m limit --limit 2/m --limit-burst 2 -j LOG --log-prefix
> '** INPUT DROP ** '
>  iptables -A FORWARD -m limit --limit 2/m --limit-burst 2 -j
>  LOG --log-prefix '** FORWARD DROP ** '
>  iptables -A OUTPUT -m limit --limit 2/m --limit-burst 2 -j
>  LOG --log-prefix '** OUTPUT DROP ** '

Logging any packets that make it this far is a good idea.

>  #Finally dropping all other traffic (positive list firewall):
>  iptables -P INPUT DROP
>  iptables -P OUTPUT DROP
>  iptables -P FORWARD DROP

This should be at the top for the firewall not the ACCEPT you have there 
now.

>  #Don't forget to save it:
>  service iptables save
>
>  I might make some mistakes up there, so the logging is very important. You

Just a few.  :)

For your reading enjoyment.

http://iptables.rlworkman.net/chunkyhtml/index.html


-- 

Regards
Robert

Smile... it increases your face value!
Linux User #296285
http://counter.li.org