Re: Re: Firewall

Thomas,

Thanks very much for replying this is exactly what I am after :). I will need to turn web surfing on and off as and when needed. Can you recommend some iptables entries for this also?

Thanks again,

Steve



>Steve,
>
>Assuming you don't want to web-surf or anything, this is the minimalist 
>set of rules that will allow ssh into the linux box and tunneled VNC 
>into the windows box.
>
># start with a clean slate
>iptables --flush
>
># turn off everything by default
>iptables --policy FORWARD  DROP
>iptables --policy INPUT  DROP
>iptables --policy OUTPUT  DROP
>
># let's poke holes in it....
># if you can't trust yourself....
>iptables --append INPUT  --in-interface lo --jump ACCEPT
>iptables --append OUTPUT --out-interface lo --jump ACCEPT
>
># allow continuation of previously approved traffic
>iptables --append INPUT  --proto tcp --state REALTED --jump ACCEPT
>iptables --append OUTPUT --proto tcp --state REALTED --jump ACCEPT
>
># allow traffic from the LINUX box to the VNC port on the windos one
># put eth<whatever> in place of $XXX
># put IP address of window box in place of $YYY
>iptables --append OUTPUT --out-interface $XXX --proto tcp --destination $YYY  --destination-port 5900 --jump ACCEPT
>
># allow traffic from the WWW on port to the ssh port
># put eth<whatever> or ppp<whatever> in place of $ZZZ
>iptables --append INPUT --in-interface $ZZZ --proto tcp --destination-port 22 --jump ACCEPT
>
># now save it so that your box will load these things
>iptables-save > /etc/sysconfig/iptables
>
># use ntsysv to make sure iptables is loaded AND ipchains IS NOT!
>
>
>locked down very tight, sacrificing functionality for security.
>You'll probably need more holes in the f/w to allow you to do things like web-surfing etc.
>I'd advise against NAT or anything like that, just run proxy servers on your linux box and 
>run XP through those.
>
>Now you need to ssh into the linux box and with -R 5900:<ip-of-XP>:5900, the vnc to localhost and you're in!
>sshd can be tightened down also so that it won't allow local shell logins, only port forwarding to the XP box.
>
>
>
>On Sat, 5 Apr 2003, SWilkes wrote:
>
>> Hello all,
>>  
>> I am about to build a firewall for my home network which will have a
>> broadband connection. After much investigation I have decided to use
>> RedHat (8 or 9) as a software firewall. I will be installing it on an
>> old PC I have (400Mhz AMD K63, 96MB, 20GB HD, GF2) and will be dedicated
>> as a firewall. Has anyone done this already and have a sample iptables
>> entry they can share with me?
>>  
>> My ultimate goal is to be able to log onto my XP machine at home from
>> any computer that has an internet connection. I plan to use VNC and
>> tunnel this through Open SSH connection for security. Therefore, I
>> believe that I will only need to have one ssh port open to the internet.
>> If anyone can share any knowledge about this then please let me know.
>>  
>> Thanks in advance.
>>  
>> Steve
>> 
>
>-- 
>Thomas Sprinkmeier     /"\
>Ebor Computing         \ /    ASCII Ribbon Campaign
>+61 8 8351 7122         X     Against   HTML   Mail
>+61 8 8351 7079 (fax)  / \  Better  Safe  Than  Sorry
>
>pub  1024D/40521F2E 2001-11-02 <[email protected]>
>     9561 6DD5 A0D2 7334 1853  B227 2053 74D1 4052 1F2E
>sub  1024g/736BCEAC 2001-11-02
>
>"Everything should be made as simple as possible, but not simpler."
>		Albert Einstein
>