Re: [gentoo-user] workstation iptables

[Tom H]

On Tue, Oct 6, 2015 at 3:14 PM, James  wrote:
>
> #!/bin/bash
> # A basic stateful firewall for a workstation or laptop that isn't running any
> # network services like a web server, SMTP server, ftp server, etc.
>
> if [ "$1" = "start" ]
> then
> echo "Starting firewall..."
> iptables -P INPUT DROP
> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> elif [ "$1" = "stop" ]
> then
> echo "Stopping firewall..."
> iptables -F INPUT
> iptables -P INPUT ACCEPT
> fi

Since you're starting from scratch, you might want to replace "-m
state --state" by "-m conntrack --ctstate" because the former's
deprecated and is now an alias to the latter.

Re: [gentoo-user] workstation iptables

[Alon Bar-Lev]

On 6 October 2015 at 22:14, James  wrote:
>
> Hello,
>
> I just ran across this page:
>
> http://gentoo-en.vfose.ru/wiki/Iptables/Iptables_and_stateful_firewalls#State_basics
>
> It has a basic firewall using iptables.
> Not bad for a generic firewall on a openrc workstation.
> What is the best way to auto lauch this sort of firewall.sh ?
>
> Any improvements in this basic workstation firewall
> everything out, nothing in?
> A simple rule for ssh in only from the local lan
> (use 192.168.100.100 for example rule(s).
>
>

Hi,

I suggest you look into firehol package.
It creates iptables rules out of human readable policy.

Regards,
Alon

> ...
> firewall.sh
> ...
> #!/bin/bash
> # A basic stateful firewall for a workstation or laptop that isn't running any
> # network services like a web server, SMTP server, ftp server, etc.
>
> if [ "$1" = "start" ]
> then
> echo "Starting firewall..."
> iptables -P INPUT DROP
> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> elif [ "$1" = "stop" ]
> then
> echo "Stopping firewall..."
> iptables -F INPUT
> iptables -P INPUT ACCEPT
> fi
> 
>
> just launched manually as a script.
>
>
> Any good tools to quickly test this firewall from another local workstation?
>
>
> wwr,
> James
>
>

Re: [gentoo-user] workstation iptables

[Mick]

On Tuesday 06 Oct 2015 20:14:59 James wrote:
> Hello,
> 
> I just ran across this page:
> 
> http://gentoo-en.vfose.ru/wiki/Iptables/Iptables_and_stateful_firewalls#Sta
> te_basics
> 
> It has a basic firewall using iptables.
> Not bad for a generic firewall on a openrc workstation.
> What is the best way to auto lauch this sort of firewall.sh ?

Start iptables, run the script, stop iptables with '/etc/init.d/iptables stop' 
which will save your rules to /var/lib/iptables/rules-save, or run 'iptables-
save /var/lib/iptables/rules-save'.  Add any sysctl changes to 
/etc/sysctl.conf, so that they are permanent.  Re-run the script if you want 
to change things in it.

 
> Any improvements in this basic workstation firewall
> everything out, nothing in?

Yes, but such improvements are suggested in subsequent scripts on the same 
page, e.g. ICMP handling, selective logging, etc.  If all you want is "a basic 
firewall using iptables" for the IPv4 workspace, then what you have will do 
the job.


> Any good tools to quickly test this firewall from another local
> workstation?

nmap -A -T4 -P0 -vvv -p1-65535 XXX.XX.XXX.XX

-- 
Regards,
Mick


signature.asc
Description: This is a digitally signed message part.

[gentoo-user] workstation iptables

[James]

Hello,

I just ran across this page:

http://gentoo-en.vfose.ru/wiki/Iptables/Iptables_and_stateful_firewalls#State_basics

It has a basic firewall using iptables. 
Not bad for a generic firewall on a openrc workstation.
What is the best way to auto lauch this sort of firewall.sh ? 

Any improvements in this basic workstation firewall
everything out, nothing in?
A simple rule for ssh in only from the local lan
(use 192.168.100.100 for example rule(s).


...
firewall.sh
...
#!/bin/bash
# A basic stateful firewall for a workstation or laptop that isn't running any
# network services like a web server, SMTP server, ftp server, etc.

if [ "$1" = "start" ]
then
echo "Starting firewall..."
iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
elif [ "$1" = "stop" ]
then
echo "Stopping firewall..."
iptables -F INPUT
iptables -P INPUT ACCEPT
fi


just launched manually as a script.


Any good tools to quickly test this firewall from another local workstation?


wwr,
James