Re: firewall using iptables

On Mon, 2002-10-14 at 15:35, Per-Erik Westerberg wrote:
> Hi all,
> 
> I am trying to figure out how to setup a firewall using iptables and
> have not yet benn able to figure it out. I wan't to be able to play
> Quake 3, RTCW etc. and I wan't my machine to be as secure as possible.
> What are you guys and girls using? Any examples? My machine has one
> network interface connected to a cable modem, obtaining the IP address
> using DHCP when it boots.
> 
>   Regards / Per-Erik
> 
This is what I use. It works pretty well for me. Although I don't use it
for Quake and so forth, it should be straightforward to change it so it
works for that.

I do have one problem with it - it's incompatible with my wife's
employer's vpn server. When she logs in with the vpn client on her
computer, she can't access anything outside our house. Does anyone have
any suggestions to fix that? Thanks.

My rc.firewall script follows. Note that I can't take credit for this,
but I've forgotten where I got it.

Tony


#!/bin/sh
#
# IPCHAINS-FIREWALL V1.6.2m
#
# ----------------------------------------- Ipchains Firewall and MASQ Script -
#
# Original script by Ian Hall-Beyer ([email protected])
#
# Contributors:
# terminus ([email protected]) (ICQ & DHCP, @home testing)

# ---------------------------------------------------------------- Interfaces -
# Local Interface
# This is the interface that is your link to the world

ADSL_IF="eth1"

# Internal Interface
# This is the interface for your local network
# NOTE: INTERNALNET is a *network* address. All host bits should be 0

INTERNALNET="192.168.1.0/24"
INTERNALIF="eth0"

# ------------------------------------------------------- Variable definition -
#
# Set the location of ipchains.

IPCHAINS="/sbin/ipchains"

# You shouldn't need to change anything in the rest of this section

ADSL_IP=`ifconfig $ADSL_IF | grep inet | cut -d : -f 2 | cut -d \  -f 1`
ADSL_MASK=`ifconfig $ADSL_IF | grep Mask | cut -d : -f 4`
ADSL_NET="$ADSL_IP/$ADSL_MASK"

echo "Internal ($INTERNALIF): $INTERNALNET"
echo "External ($ADSL_IF): $ADSL_NET"
echo "-------------------------------------"

ANYWHERE="0/0"

# -------------------------------------- Flush everything, start from scratch -

echo -n "Flushing rulesets.."

# Incoming packets from the outside network
$IPCHAINS -F input
echo -n "."

# Outgoing packets from the internal network
$IPCHAINS -F output   
echo -n "."

# Forwarding/masquerading
$IPCHAINS -F forward
echo -n "."

echo "Done!"

# ---------------------------------- Allow all connections within the network -

echo -n "Internal.."

#$IPCHAINS -A input -s $INTERNALNET -d $INTERNALNET -j ACCEPT
#$IPCHAINS -A output -s $INTERNALNET -d $INTERNALNET -j ACCEPT
echo -n ".."

echo "Done!"

# -------------------------------------------------- Allow loopback interface -

echo -n "Loopback.."

$IPCHAINS -A input -i lo -s 0/0 -d 0/0 -j ACCEPT
$IPCHAINS -A output -i lo -s 0/0 -d 0/0 -j ACCEPT
echo -n ".."

echo "Done!"

# -------------------------------------------------------------- Masquerading -

echo -n "Masquerading.."

# don't masquerade internal-internal traffic
$IPCHAINS -A forward -s $INTERNALNET -d $INTERNALNET -j ACCEPT
echo -n "."

# don't Masquerade external interface direct
$IPCHAINS -A forward -s $ADSL_NET -d $ANYWHERE -j ACCEPT 
echo -n "."

# masquerade all internal IP's going outside
$IPCHAINS -A forward -s $INTERNALNET -d $ANYWHERE -j MASQ
echo -n "."

# set Default rule on MASQ chain to Deny
$IPCHAINS -P forward DENY
echo -n "."

# --------------------- Allow all connections from the network to the outside -

$IPCHAINS -A input -s $INTERNALNET -d $ANYWHERE -j ACCEPT   
$IPCHAINS -A output -s $INTERNALNET -d $ANYWHERE -j ACCEPT
echo -n ".."

echo "Done!"

# ----------------------------------Set telnet, www and FTP for minimum delay -
# This section manipulates the Type Of Service (TOS) bits of the 
# packet. For this to work, you must have CONFIG_IP_ROUTE_TOS enabled
# in your kernel

echo -n "TOS flags.."

$IPCHAINS -A output -p tcp -d 0/0 www -t 0x01 0x10
$IPCHAINS -A output -p tcp -d 0/0 telnet -t 0x01 0x10   
$IPCHAINS -A output -p tcp -d 0/0 ftp -t 0x01 0x10
echo -n "..."

# Set ftp-data for maximum throughput
$IPCHAINS -A output -p tcp -d 0/0 ftp-data -t 0x01 0x08
echo -n "."

echo "Done!"

# ---------------------------------------------------------- Trusted Networks -
# Add in any rules to specifically allow connections from hosts/nets that
# would otherwise be blocked.

# echo -n "Trusted Networks.."
echo "UC VPN.."
$IPCHAINS -A input -s 129.137.3.5 -d $ADSL_NET -j ACCEPT
$IPCHAINS -A input -s 129.137.3.6 -d $ADSL_NET -j ACCEPT

# $IPCHAINS -A input -s [trusted host/net] -d $ADSL_NET <ports> -j ACCEPT 
# echo -n "."

# echo "Done!"

# ----------------------------------------------------------- Banned Networks -
# Add in any rules to specifically block connections from hosts/nets that
# have been known to cause you problems. These packets are logged.

# echo -n "Banned Networks.."

# This one is generic
# $IPCHAINS -A input -l -s [banned host/net] -d $ADSL_NET <ports> -j DENY
# echo -n "."

# This one blocks ICMP attacks
# $IPCHAINS -A input -l -b -i $ADSL_IF -p icmp -s [host/net] -d $ADSL_NET -j DENY
# echo -n "."

# echo "Done!"

# ------------------------------------------------------ @home-specific rules -
# This @home stuff is pretty specific to me (terminus).  I get massive port
# scans from my neighbors and from pokey admins at @home, so I just got harsh
# and blocked all their stuff, with a few exceptions, listed below.
#
# If someone out there finds out the ip ranges of JUST tci@home, let me know
# so i don't end up blocking ALL cablemodems like it's doing now.

echo -n "Cable Modem Nets.."

# so we can check mail, use the proxy server, hit @home's webpage.
# you will want to set these to your local servers, and uncomment them

# $IPCHAINS -A input -p tcp -s ha1.rdc1.wa.home.com -d $ADSL_NET 1023:65535 -j ACCEPT
# $IPCHAINS -A input -p tcp -s mail.tcma1.wa.home.com -d $ADSL_NET 1023:65535 -j ACCEPT
# $IPCHAINS -A input -p tcp -s www.tcma1.wa.home.com -d $ADSL_NET 1023:65355 -j ACCEPT
# $IPCHAINS -A input -p tcp -s proxy.tcma1.wa.home.com -d $ADSL_NET 1023:65535  -j ACCEPT
# echo -n "...."

# so we can resolve the above hostnames, allow dns queries back to us
# $IPCHAINS -A input -p tcp -s ns1.home.net -d $ADSL_NET 1023:65535 -j ACCEPT
# $IPCHAINS -A input -p tcp -s ns2.home.net -d $ADSL_NET 1023:65535 -j ACCEPT
# $IPCHAINS -A input -p udp -s ns1.home.net -d $ADSL_NET 1023:65535 -j ACCEPT
# $IPCHAINS -A input -p udp -s ns2.home.net -d $ADSL_NET 1023:65535 -j ACCEPT
# echo -n ".."

# linux ipchains building script page (I think)
# $IPCHAINS -A input -p tcp -s 24.128.61.117 -d $ADSL_NET 1023:65535 -j  ACCEPT
# echo -n "."

# Non-@home users may want to leave this uncommented, just to block all
# the wannabe crackers. Add any @home hosts you want to allow BEFORE this line.

# Blast all other @home connections into infinity and log them.
$IPCHAINS -A input -l -s 24.0.0.0/8 -d $ADSL_NET -j DENY
echo -n "."

echo "Done!"

# ---------------------------- Specific port blocks on the external interface -
# This section blocks off ports/services to the outside that have
# vulnerabilities. This will not affect the ability to use these services
# within your network. 

echo -n "Port Blocks.."
 
# NetBEUI/Samba
$IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 139 -j DENY
$IPCHAINS -A input -p udp -s $ANYWHERE -d $ADSL_NET 139 -j DENY
echo -n "."

# Microsoft SQL
$IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 1433 -j DENY
$IPCHAINS -A input -p udp -s $ANYWHERE -d $ADSL_NET 1433 -j DENY
echo -n "."

# Postgres SQL

$IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 5432 -j DENY
$IPCHAINS -A input -p udp -s $ANYWHERE -d $ADSL_NET 5432 -j DENY
echo -n "."

# Network File System
$IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 2049 -j DENY
$IPCHAINS -A input -p udp -s $ANYWHERE -d $ADSL_NET 2049 -j DENY
echo -n "."

# X Displays :0-:2-
$IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 5999:6003 -j DENY
$IPCHAINS -A input -p udp -s $ANYWHERE -d $ADSL_NET 5999:6003 -j DENY
echo -n "."

# X Font Server :0-:2-
$IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 7100 -j DENY
$IPCHAINS -A input -p udp -s $ANYWHERE -d $ADSL_NET 7100 -j DENY
echo -n "."

# Back Orifice (logged)
$IPCHAINS -A input -l -p tcp -s $ANYWHERE -d $ADSL_NET 31337 -j DENY
$IPCHAINS -A input -l -p udp -s $ANYWHERE -d $ADSL_NET 31337 -j DENY
echo -n "."

# NetBus (logged)
$IPCHAINS -A input -l -p tcp -s $ANYWHERE -d $ADSL_NET 12345:12346 -j DENY
$IPCHAINS -A input -l -p udp -s $ANYWHERE -d $ADSL_NET 12345:12346 -j DENY
echo -n "."

echo "Done!"

# --------------------------------------------------- High Unprivileged ports -
# These are opened up to allow sockets created by connections allowed by 
# ipchains

echo -n "High Ports.."

$IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 1023:65535 -j ACCEPT
$IPCHAINS -A input -p udp -s $ANYWHERE -d $ADSL_NET 1023:65535 -j ACCEPT
echo -n "."

echo "Done!"

# ------------------------------------------------------------ Basic Services -

echo -n "Services.."

# ftp-data (20) and ftp (21)
# $IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 20 -j ACCEPT
# $IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 21 -j ACCEPT
# echo -n ".."

# ssh (22)
# $IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 22 -j ACCEPT
# echo -n "."

# telnet (23)
# $IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 23 -j ACCEPT
# echo -n "."

# smtp (25)
# $IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 25 -j ACCEPT
# echo -n "."

# DNS (53)
$IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 53 -j ACCEPT
$IPCHAINS -A input -p udp -s $ANYWHERE -d $ADSL_NET 53 -j ACCEPT
echo -n ".."

# now block nuisance sites:
if [ -x /etc/rc.d/rc.block_nuisances ]; then
	. /etc/rc.d/rc.block_nuisances
fi


# DHCP on LAN side (to make @Home DHCP work) (67/68)
# $IPCHAINS -A input -i $INTERNALIF -p udp -s $ANYWHERE -d 255.255.255.255/24 67 -j ACCEPT
# $IPCHAINS -A output -i $INTERNALIF -p udp -s $ANYWHERE -d 255.255.255.255/24 68 -j ACCEPT
# echo -n ".."

# http (80)
# $IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 80 -j ACCEPT
# echo -n "."

# POP-3 (110)
# $IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 110 -j ACCEPT
# echo -n "."

# identd (113)
# $IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 113 -j ACCEPT
# echo -n "."

# nntp (119)
# $IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 119 -j ACCEPT
# echo -n "."

# https (443)
# $IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 443 -j ACCEPT
# echo -n "."

# ICQ Services (it's a server service) (4000)
# $IPCHAINS -A input -p tcp -s $ANYWHERE -d $ADSL_NET 4000 -j ACCEPT
# echo -n "."

echo "Done!"

# ---------------------------------------------------------------------- ICMP -

echo -n "ICMP Rules.."

# Use this to deny ICMP attacks from specific addresses
# $IPCHAINS -A input -b -i $EXTERNALIF -p icmp -s <address> -d 0/0 -j DENY
# echo -n "."

# Allow incoming ICMP
$IPCHAINS -A input -p icmp -s $ANYWHERE -d $ADSL_NET -j ACCEPT
$IPCHAINS -A input -p icmp -s $ANYWHERE -d $ADSL_NET -j ACCEPT
echo -n ".."

# Allow outgoing ICMP
$IPCHAINS -A output -p icmp -s $ADSL_NET -d $ANYWHERE -j ACCEPT
$IPCHAINS -A output -p icmp -s $ADSL_NET -d $ANYWHERE -j ACCEPT
$IPCHAINS -A output -p icmp -s $INTERNALNET -d $ANYWHERE -j ACCEPT
$IPCHAINS -A output -p icmp -s $INTERNALNET -d $ANYWHERE -j ACCEPT
echo -n "...."

echo "Done!"

# -------------------------------------------------------- set default policy -

$IPCHAINS -A input -j DENY
$IPCHAINS -A output -j ACCEPT

echo ""
echo "Finished Establishing Firewall."


>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>> End of included firewall script from Tony Rein
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>