Re: about iptables
- From: Grant <bugsplatter@xxxxxxxxx>
- Date: Fri, 28 Apr 2006 09:33:47 +1000
On 27 Apr 2006 15:45:54 -0700, "ParTizan" <ParTizanPuPkin@xxxxxxxxx> wrote:
Hi All,
I guess, this is a simple question, but I couldn't find an answer in
internet.
my setup:
dsl modem <---> linksys router+dhcp (192.168.1.1) <---> linux box (1
nic)
dhcp 192.168.1.1
dns1 71.0.0.1
dns1 151.0.0.2
Your firewall doesn't need to know about the DNS servers.
Bits of my firewall setup:
<http://bugsplatter.mine.nu/bash/firewall/> for net topology
rc.firewall:
....
X_LOCAL="eth0" # main local net: 100-Base-T
X_WORLD="ppp0" # expected ADSL modem interface
....
MSTATE="--match state --state"
....
report " policy"
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
report " local"
iptables -A INPUT -p all $MSTATE ESTABLISHED,RELATED -j ACCEPT ##[1]
iptables -A INPUT -p all -i lo -j ACCEPT
iptables -A INPUT -p all -i $X_LOCAL -j ACCEPT
....
[1] This comes first, it allows expected traffic back into the box
Now you need add rules to allow incoming traffic, if you are not
offering services to the public, you don't need any. ;)
Also:
# NAT table
# ``````````
# Perform SNAT or MASQUERADE for localnet to world connections
# Difference between SNAT and MASQUERADE?
# SNAT is more efficient for static public IP address, and established
# connections will survive a reconnect. MASQUERADE is for dynamic IP
# where established connections are dropped when link goes down as a
# new, likely different, IP address is expected on the next connection.
install_nat_table()
{
report " nat"
if [ -n "$IP_WORLD" ]; then
report " SNAT $IP_WORLD"
iptables -t nat -A POSTROUTING -o $X_WORLD \
-j SNAT --to-source $IP_WORLD
else
report " MASQUERADE"
iptables -t nat -A POSTROUTING -o $X_WORLD \
-j MASQUERADE
fi
}
[part of firewall startup, for context]
case $1 in
restart )
# called from ip-up when ADSL connection established, parameters:
# $1 restart -- anything else switches firewall to local mode
# $2 <interface> -- example ppp0
# $3 <IP>, optional -- if specified the output will be SNAT to the
# supplied IP address, otherwise MASQUERADE is used
install_firewall_local_mode
if [ -z "$2" ]; then
echo -e "\nrc.firewall: warning: restart without \c"
echo -e "<interface>, local mode running."
exit 0
else
X_WORLD=$2 # eg. ppp0
fi
if [ -z "$3" ]; then
IP_WORLD="" # MASQUERADE
else
IP_WORLD=$3 # SNAT to supplied IP address
fi
install_firewall_world_mode
echo -e "\n\nrc.firewall: finish: world mode running."
;;
....
Not posting the whole thing 'cos it's a ~600 line bash script.
Grant.
--
Memory fault -- brain fried
.
- Follow-Ups:
- Re: about iptables
- From: ParTizan
- Re: about iptables
- References:
- about iptables
- From: ParTizan
- about iptables
- Prev by Date: about iptables
- Next by Date: Re: about iptables
- Previous by thread: about iptables
- Next by thread: Re: about iptables
- Index(es):
Relevant Pages
|
