That is one of the clearest explanations of setting up ipchains I have seen, and I read a lot when trying to get to grips with it a while back. Nice Job.
-----Original Message----- From: Nathan Clark [mailto:[EMAIL PROTECTED]] Sent: 15 October 2002 08:13 To: [EMAIL PROTECTED] Subject: Re: [hlds_linux] [OT?]Securing a linux box running HLDS Hi James and Adam You'll find that most of the stuff written about iptables is by geeks, for geeks, and isn't much help to anyone who just wants to get a box up and running safely. This is a VERY simple explanation, it takes a WHOLE lot more than this to secure a box properly, but this should help you understand iptables a bit more. Basically there are three components to iptables 1. The INPUT chain 2. The FORWARD chain 3. The OUTPUT chain You can add rules to these components to allow/disallow network traffic that meets a certain set of criteria. I'll go over the criteria in a moment. 1. INPUT - this is the chain that monitors and applies rules to connections being made TO your server (i.e. other computers wanting to connect to your server) 2. FORWARD - this chain is used when routing traffic across your server, not covered here 3. OUTPUT - this chain monitors and applies rules to connections being made FROM your server to other computers on the internet (i.e. applications running on your server that want to connect to other computers on the internet) Determine what interface you want to use i.e. eth0 ppp0 etc. Basically which interface the game is going to run on. Now making rules to add to the chains. The default rule I first set is on the INPUT chain, in fact it's not a rule but a policy and that policy is set to drop ALL traffic coming across that interface. Oh yeah, be logged in as root. iptables -P INPUT DROP Now nothing can connect to any network service running on your server. All traffic will be dropped. Now you can add your exceptions, i'll explain what each one does. iptables -A INPUT -i eth0 -p tcp --dport 27015 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT explanation of above line 1. iptables - this is the iptables program 2. -A INPUT - this adds the rule to the INPUT chain 3. -i eth0 - this tells iptables that we are making a rule which only applies to this interface, in this case the first network card in my machine, eth0 4. -p tcp - this tells me which protocol i'm dealing with, in this case i want to allow tcp traffic across eth0 on the INPUT chain 5. --dport 27015 - this is the port I'm running my server on and i want tcp connections allowed to it across eth0 on the INPUT chain 6. -m state - this is the stateful part of the rule, it means I can really control what sort of packets are allowed into my server 7. --state NEW,ESTABLISHED,RELATED - these are actually three different states and they don't all have to be used together. NEW means this rule will allow NEW connection packets to establish a connection to the server. ESTABLISHED means the packet already has an established connection with the server and is allowed to proceed. RELATED means that the packet is related to a connection already established but may be something different such as an ICMP error. This is not needed for running hl game servers. 8. -j ACCEPT - this says basically says "if all these criteria are met then jump off and do THIS, the "THIS" being ACCEPT, which allows the traffic through. You'd also want to add the same for the udp protocol so you'd make another rule: iptables -A INPUT -i eth0 -p udp --dport 27015 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT Anyways that's basically how it works. You then save it by typing: service iptables save You'll find things may not be working since you put the rules in, research how the apps on your server work and make exceptions to you rules accordingly. Hope that helps. Cheers Nathan ----- Original Message ----- From: "James Gurney" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, October 15, 2002 2:20 PM Subject: Re: [hlds_linux] [OT?]Securing a linux box running HLDS > Adam Hobbs wrote: > > rule, or can even point me to an online guide to doing it I would be most > > appriciative. > > Go to Google and do a search for "Linux firewall howto" and you'll find > probably a dozen guides to setting up a firewall using ipchains/iptables. > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, please visit: > http://list.valvesoftware.com/mailman/listinfo/hlds_linux > _______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux _______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
