[ale] Lets design a firewall "baseline"....

Robert L. Harris Robert.L.Harris at rdlg.net
Wed Oct 3 13:11:36 EDT 2001



I've been attaching my rules to those curious.  I'll attach and CC now.

So far I have a Maintainer for ipchains and a maintainer for iptables.
How about the others?  Anyone wanna take those, preferably after we
get a base for iptables and ipchains working?  Lets get something stable
and then add on.

One concern I have.  Make sure that if we specify our Internet/Public
side IP it has to deal with dynamics.  I'm on a cable modem and was stable
with the same IP for about 5 months then it changed out of the blue.  My
script didn't ahve anything hardcoded I believe, but I did have some other
things that bit me.



Thus spake Dow Hurst (dhurst at kennesaw.edu):

> Thanks Jonathon!
> This is a great place to start for the iptables!  A set of variables can
> be added at the front end to simplify static parts of the rules and ease
> configuration.  I'll be looking into the SuSE ipchains setup to see what
> I can do to create an explanation on setting it up or replacing it. 
> Note from Bob Toxen's book how the interface settings can be extracted
> into variables for dealing with more than one interface or differing
> netmasks.
> 
> Robert, can you post your rules?  My email to you last night bounced
> twice so I am not sure you got my reply, but I would like to see your
> ruleset.
> Dow
> 
> Jonathan Rickman wrote:
> > 
> > On Tue, 2 Oct 2001, Robert L. Harris wrote:
> > 
> > > Would anyone be interested in creating a "generic" template of sorts?
> > > This way when someone sends "hey, I need a firewall" we can point them
> > > at the achives, or even forward them a current "master" copy?
> > >
> > > Just throwing out a thought.  I could put mine up as a starter, or we
> > > could use someone elses.  I'd be happy to host a "site" of sorts
> > > with revisions and all.  My html works but isn't very pretty generally.
> > 
> > Here's one of the scripts I use on workstations. Note Class B reserved
> > address space commented out...adjust to suit taste. Replace eth0 with your
> > interface name. Remove all opened ports for a workstation with no
> > services.
> > 
> > ================================================
> > ================================================
> > #!/bin/sh
> > 
> > # flush tables
> > /usr/sbin/iptables -F
> > 
> > # set default policies
> > /usr/sbin/iptables -P INPUT DROP
> > /usr/sbin/iptables -P OUTPUT ACCEPT
> > /usr/sbin/iptables -P FORWARD DROP
> > 
> > # create DUMP table
> > /usr/sbin/iptables -N DUMP > /dev/null
> > /usr/sbin/iptables -F DUMP
> > /usr/sbin/iptables -A DUMP -j LOG --log-tcp-options --log-ip-options
> > /usr/sbin/iptables -A DUMP -j DROP
> > 
> > # create Stateful table
> > /usr/sbin/iptables -N STATEFUL > /dev/null
> > /usr/sbin/iptables -F STATEFUL
> > /usr/sbin/iptables -I STATEFUL -m state --state ESTABLISHED,RELATED -j ACCEPT
> > /usr/sbin/iptables -A STATEFUL -m state --state NEW -i ! eth0 -j ACCEPT
> > /usr/sbin/iptables -A STATEFUL -j DUMP
> > 
> > # loopback rules
> > /usr/sbin/iptables -A INPUT -i lo -j ACCEPT
> > /usr/sbin/iptables -A OUTPUT -o lo -j ACCEPT
> > 
> > # drop reserved addresses incoming
> > /usr/sbin/iptables -A INPUT -i eth0 -s 127.0.0.0/8 -j DUMP
> > /usr/sbin/iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DUMP
> > #/usr/sbin/iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DUMP
> > /usr/sbin/iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DUMP
> > 
> > # allow ICMP
> > /usr/sbin/iptables -A INPUT -i eth0 -p icmp -j ACCEPT
> > 
> > #allow DNS
> > /usr/sbin/iptables -A INPUT -p udp -i eth0 -s 166.102.165.11 --sport 53 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p udp -i eth0 -s 166.102.165.13 --sport 53 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p udp -i eth0 -s 205.152.0.5 --sport 53 -j ACCEPT
> > 
> > # opened ports
> > 
> > # ssh on non-standard port
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 8380 -j ACCEPT
> > # www server on standard port
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 80 -j ACCEPT
> > 
> > # Sneaky portscan catchers--Lets snort see traffic (fake services)
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 79 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 81 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 110 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 111 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 143 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 21 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p udp -i eth0 --dport 161 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 23 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 109 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p udp -i eth0 --dport 137 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 139 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 445 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 443 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 6667 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 8080 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 17 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 19 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 5000:8379 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 8381:10000 -j ACCEPT
> > /usr/sbin/iptables -A INPUT -p tcp -i eth0 --dport 10000:60000 -j ACCEPT
> > 
> > #Broadcast Filters
> > /usr/sbin/iptables -A INPUT -i eth0 -d 216.76.72.95 -j DROP
> > /usr/sbin/iptables -A INPUT -i eth0 -d 255.255.255.255 -j DROP
> > 
> > # push everything else to state table
> > /usr/sbin/iptables -A INPUT -j STATEFUL
> > =====================================================
> > =====================================================
> > 
> > I'm willing to host any templates the group comes up with at my site.
> > 
> > --
> > Jonathan Rickman
> > X Corps Security
> > http://www.xcorps.net
> 
> -- 
> __________________________________________________________
> Dow Hurst                   Office: 770-499-3428
> Systems Support Specialist  Fax:    770-423-6744
> 1000 Chastain Rd.
> Chemistry Department SC428  Email:dhurst at kennesaw.edu
> Kennesaw State University         Dow.Hurst at mindspring.com
> Kennesaw, GA 30144
> *********************************
> *Computational Chemistry is fun!*
> *********************************
> --
> To unsubscribe: mail majordomo at ale.org with "unsubscribe ale" in message body.



:wq!
---------------------------------------------------------------------------
Robert L. Harris                |  Micros~1 :  
Senior System Engineer          |    For when quality, reliability 
  at RnD Consulting             |      and security just aren't
                                \_       that important!
DISCLAIMER:
      These are MY OPINIONS ALONE.  I speak for no-one else.
FYI:
 perl -e 'print $i=pack(c5,(41*2),sqrt(7056),(unpack(c,H)-2),oct(115),10);'


 NAT.sh




More information about the Ale mailing list