Re: iptables - newbie

On 2006-01-06, explodingGo4@xxxxxxxxx <explodingGo4@xxxxxxxxx> wrote:
> Bear with me if I'm not using the terminology correctly, but I'm new to
> linux and firewalls.
> I have been using Linux Firewalls, 3rd Edition. Good book, not good to
> copy the iptables scripts, lots of missing or in correct info.


It's a good book - hang in there and give it some time -- it will all
come together soon enough...


> I have an internal lan that I'd like to protect with iptables.
> eth0=internet and eth1 connects to my LAN. I'd like to default the
> routing to pass only specific ports. Lets say 80. Masquerading with
> NAT passes everything. Can someone point me to a resource that
> explains the code in plain english?


I would normally direct you to Oskar Andreasson's tutorial at frozentux,
but it's been down for a few weeks. I have a mirror of an older version
at http://iptables.rlworkman.net - read through it completely.


> Here is what I have, it appears using TCPDump, data is passed from eth0
> to eth1, but not back to the workstation that requested it. I assume
> this is called a choke firewall, per the book.... <SNIPPED>


I would suggest starting with something simple, with very little actual
filtering - get that working properly, and then you can worry about
tightening it.
What you're wanting will require filtering in the FORWARD chain of the
filter table.

Try this:

#!/bin/bash

# Set variables
IPT=/usr/sbin/iptables
INT_IF=eth0 # Internet-facing NIC
LAN_IF=eth1 # LAN-facing NIC
LAN_IPRANGE=192.168.0.0/24 # IP Range of LAN
PRIV_IP=x.x.x.x # Private IP address (LAN) of gateway
PUBLIC_IP=x.x.x.x # Public IP Address of gateway

# Set default policies
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT ACCEPT

# Turn off packet forwarding until all rules are applied
echo 0 > /proc/sys/net/ipv4/ip_forward

# Allow all traffic on loopback interface
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

# Allow all packets of established connections and those related to
# established connections
$IPT -A INPUT -i $INT_IF -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH from LAN
$IPT -A INPUT -i $LAN_IF -s $LAN_IPRANGE --sport 1024:65535 \
-d $PRIV_IP --dport 22 -m state --state NEW --syn -j ACCEPT

# Allow all traffic destined for the internet to leave the LAN
# (goes through FORWARD chain)
$IPT -A FORWARD -i $LAN_IF -s $LAN_IPRANGE -o $INT_IP -j ACCEPT

# Allow all valid return traffic for the LAN
$IPT -A FORWARD -i $INT_IP -m state --state ESTABLISHED,RELATED \
-j ACCEPT

# SNAT the traffic leaving the LAN
$IPT -t nat -A POSTROUTING -s $LAN_IPRANGE -j SNAT --to-source $PUBLIC_IP

# Turn on packet forwarding now that all rules are applied
echo 1 > /proc/sys/net/ipv4/ip_forward


I did this from memory, so if I missed something obvious, please excuse
me - I'm sure someone will point it out :-)

RW
.

Relevant Pages

  • Re: [fw-wiz] Info Request: Looking for alternatives in HA/Load balancing firewallsthat are also
    ... a 'high bandwidth' server farm on the Internet is generally doing traffic in the tens to hundreds of Mb/sec, a 'high bandwidth' server on a LAN is probably connected to multple 100Mb or 1Gb ethernets. ... In both the Internet and LAN environments I lean towards multiple smaller firewalls, each doing one thing as opposed to a large firewall doing it all. ... in general I don't think that people realize this, the mentality seems to be 'I need a big, scaleable firewall to protect my Internet servers' and at the same time 'oh, that's only on the lan, it doesn't need a big firewall to protect it'. ... and it's impossible to answer anything about scalability without knowing ...
    (Firewall-Wizards)
  • P2P apps & filewalls
    ... I'm just trying to figure out how these P2P apps work behind firewalls? ... PC is on a LAN, I have server connected to the Net which serves the LAN ... Internet access using NAT software. ... the two PCs talk directly to each other? ...
    (comp.security.misc)
  • P2P apps & firewalls
    ... I'm just trying to figure out how these P2P apps work behind firewalls? ... PC is on a LAN, I have server connected to the Net which serves the LAN ... Internet access using NAT software. ... the two PCs talk directly to each other? ...
    (comp.security.firewalls)
  • Re: Linksys router with xp network
    ... What firewalls did you turn off? ... and the mentioned ports only opened for the assigned ip addresses. ... Don't disable SSID broadcast - some configurations require the SSID broadcast. ... Install a software firewall on every computer connected to a wireless LAN. ...
    (microsoft.public.windowsxp.network_web)