I'm trying to set up a basic firewall - as a start, I'm just trying to have ssh
traffic and nothing else running. However, this just doesn't work. What am I
doing wrong?
Script... ( eth0 *is* internet facing, and nothing upstream is interfering )
# Default policy drop everything
$IPTables -P INPUT DROP
$IPTables -P FORWARD DROP
$IPTables -P OUTPUT DROP
# Initialise the firewalling
# 1. Flush tables
$IPTables -F INPUT
$IPTables -F OUTPUT
$IPTables -F FORWARD
# 2. Set up input stuff.
# Loopback's good.
$IPTables -A INPUT -i lo -j ACCEPT
$IPTables -A OUTPUT -s 127.0.0.0/24 -j ACCEPT
$IPTables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# No non-routable IP address sources
$IPTables -A INPUT -p tcp -i eth0 -s 192.168.0.0/16 -j DROP
$IPTables -A INPUT -p tcp -i eth0 -s 172.16.0.0/12 -j DROP
$IPTables -A INPUT -p tcp -i eth0 -s 10.0.0.0/8 -j DROP
# Allowed services - just ssh atm.
$IPTables -A INPUT -p tcp -i eth0 --dport 22 -m state --state NEW,ESTABLISHED
-j ACCEPT
# 3. Set up output stuff.
$IPTables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
# iptables --list -n -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- eth0 * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 DROP tcp -- eth0 * 192.168.0.0/16 0.0.0.0/0
0 0 DROP tcp -- eth0 * 172.16.0.0/12 0.0.0.0/0
0 0 DROP tcp -- eth0 * 10.0.0.0/8 0.0.0.0/0
0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0
tcp dpt:22 state NEW,ESTABLISHED
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- * * 127.0.0.0/24 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp spt:22 state ESTABLISHED
--
Steve Holdoway <[EMAIL PROTECTED]>
