On Wednesday 07 Oct 2015 14:23:39 James wrote:
> Mick gmail.com> writes:
> > > http://gentoo-en.vfose.ru
> > > /wiki/IptablesIptables_and_stateful_firewalls#State_basics
> >
> > Start iptables, run the script, stop iptables with '/etc/init.d/iptables
> > >
>
> stop' which will save your rules to /var/lib/iptables/rules-save,
>
>
> after starting iptables, I ran /etc/firewall.sh (the previously published
> script) and the stop with the syntax above::
>
> cat /var/lib/iptables/rules-save
> # Generated by iptables-save v1.4.21 on Wed Oct 7 09:13:59 2015
> *mangle
>
> :PREROUTING ACCEPT [16022765:14170972269]
> :INPUT ACCEPT [16022479:14170935323]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [19311825:1508198446]
> :POSTROUTING ACCEPT [19311825:1508198446]
>
> COMMIT
> # Completed on Wed Oct 7 09:13:59 2015
> # Generated by iptables-save v1.4.21 on Wed Oct 7 09:13:59 2015
> *filter
>
> :INPUT DROP [471:17192]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [722751:44404539]
>
> [740388:740719942] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
> COMMIT
> # Completed on Wed Oct 7 09:13:59 2015
>
>
> was the ouput.
Are you sure that restarting iptables did not produce errors on the CLI? The
script you are using is somewhat old and the iptables syntax has changed since
then.
Have a look here:
https://wiki.gentoo.org/wiki/Iptables
Your single rule line above should therefore look like this:
-A INPUT -i eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
but before this rule you should specify a default policy for your INPUT and
other chains - ideally one to DROP all packets coming in and allow all going
out; e.g.
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
Also, to accept any INPUT packets on interfaces other than eth0, you would
precede these lines with:
-A INPUT ! -i eth0 -j ACCEPT
More details on syntax can be found in 'man iptables-extensions'. You will
need to modify your script accordingly for this new syntax. To see if you are
getting syntax errors run each rule on the CLI first, e.g.
/sbin/iptables -A INPUT -i eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j
ACCEPT
and check that it takes with:
/sbin/iptables -L -v -n
NOTE: The order in which you add iptables rules on the CLI is the order in
which they will end up listed in /var/lib/iptables/rules-save.
BTW, I recall a thread posted for a firewall script within the last couple of
years, but can't recall exactly who was the contributor. Have a quick search
in Gmane to see if you can find it.
> sysctl is not set up. I did find this page on that::
> https://wiki.gentoo.org/wiki/Procfs
>
> Any suggestions on setting up sysctl for iptables and other future
> usage?
According to the URL you posted above you should use /etc/sysctl.d/local.conf,
rather than the legacy /etc/sysctl.conf which I suggested. Apologies for a
bum steer. Use your previous URL for stateful firewalls to see what sysctl
settings you need to add here.
> > nmap -A -T4 -P0 -vvv -p1-65535 XXX.XX.XXX.XX
>
> Worked flawlessly. Very precise syntax (thanks). Here are the highlights::
>
> Not shown: 65534 closed ports
Not good. Unless you have set up a default policy to REJECT packets, this
shows ports that are not firewalled, but happen to be closed (no service is
running there). If you had a DROP policy/rule for INPUT packets it should say
"65534 filtered ports".
> PORT STATE SERVICE VERSION
> 22/tcp open ssh OpenSSH 5.9p1-hpn13v11lpk (protocol 2.0)
Not good. Unless you have also defined a rule for allowing connections to
port 22, this shows an open port, to which a service (ssh) is currently
listening for incoming connections.
If you want to only allow ssh connections from some local address
192.168.1.27, you can try adding a rule for it like this:
-A INPUT -s 192.168.1.27/32 -i eth0 -p tcp -m conntrack --ctstate NEW -m mac
--mac-source 67:35:AC:34:89:48 -m conntrack --ctorigdstport 22 -j ACCEPT
> Not bad for a quick workstation firewall(s). After I get sysctl setup,
> I'll test a few other verssions and post again. Then wikify these
> for community consumption.
Your script needs more work. Look first at the iptables URL I posted above,
which has the modern syntax. Also, either define a default INPUT chain policy
to DROP or REJECT packets, or end your script with rules to drop all other
packets, not already accepted by previous rules:
-A INPUT -i eth0 -j DROP
PS. Instead of running some script, you can always specify your rules in your
/var/lib/iptables/rules-save and also back it up. Then use this file to
change settings as you see fit and reload/start the firewall for the settings
to take.
--
Regards,
Mick
signature.asc
Description: This is a digitally signed message part.
