I hate doing this, but I have typed up a mostly hand-worked out ipchains
ruleset, which now doesn't work. pppd (dial-on-demand) basically doesn't
work when this is running, and i'd like to see which rules are causing it
too do this. The script follows below:
#!/bin/sh
# Opening Comments
# ======= ========
# 0.0.0.0/0 is either, my local address or the local internet
# kludgy, but it works. 192.168.66.0/24 is the local network.
# Load Modules for IP Masq
# ==== ======= === == ====
# Required to load modules
/sbin/depmod -a
# FTP Masq module
/sbin/modprobe ip_masq_ftp
# DCC Masq module
/sbin/modprobe ip_masq_irc
# Enable IP forwarding
echo "1" > /proc/sys/net/ipv4/ip_forward
# Enable IP Dynamic Address Hacking
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
# Start Again
# ==== ======
/sbin/ipchains -F input
/sbin/ipchains -F output
/sbin/ipchains -F forward
# Masq Rules
# ==== =====
# Set Masq Timeouts
# --- ---- --------
/sbin/ipchains -M -S 7200 10 160
# Set Default Policy
# --- ------- ------
/sbin/ipchains -P forward DENY
# Internal Connections
# -------- -----------
/sbin/ipchains -A input -s 192.168.66.0/24 -d 192.168.66.0/24 -j ACCEPT
/sbin/ipchains -A output -s 192.168.66.0/24 -d 192.168.66.0/24 -j ACCEPT
# Masq Rules
# ---- -----
# Internal Rules
/sbin/ipchains -A forward -s 192.168.66.0/24 -d 192.168.66.0/24 -j ACCEPT
# ACCEPT the packet first
/sbin/ipchains -A forward -s 192.168.66.0/24 -d 0.0.0.0/0 -j ACCEPT
# then MASQ it
/sbin/ipchains -A forward -s 192.168.66.0/24 -d 0.0.0.0/0 -j MASQ
# Outside connections
/sbin/ipchains -A input -s 192.168.66.0/24 -d 0.0.0.0/0 -j ACCEPT
/sbin/ipchains -A output -s 192.168.66.0/24 -d 0.0.0.0/0 -j ACCEPT
# Input Rules
# ===== =====
# Default policy
# ------ -------
/sbin/ipchains -P input DENY
/sbin/ipchains -P output ACCEPT
# Port Blocks
# ---- ------
# General Bastard Port Block
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 1:1023 -j DENY
/sbin/ipchains -A input -p UDP -d 0.0.0.0/0 1:1023 -j DENY
# NetBEUI/Samba
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 139 -j DENY
/sbin/ipchains -A input -p UDP -d 0.0.0.0/0 139 -j DENY
# Microsoft SQL
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 1433 -j DENY
/sbin/ipchains -A input -p UDP -d 0.0.0.0/0 1433 -j DENY
# Network File System
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 2029 -j DENY
/sbin/ipchains -A input -p UDP -d 0.0.0.0/0 2049 -j DENY
# Postgres SQL
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 5432 -j DENY
/sbin/ipchains -A input -p UDP -d 0.0.0.0/0 5432 -j DENY
# X Displays
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 5999:6003 -j DENY
/sbin/ipchains -A input -p UDP -d 0.0.0.0/0 5999:6003 -j DENY
# X Font Server
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 7100 -j DENY
/sbin/ipchains -A input -p UDP -d 0.0.0.0/0 7100 -j DENY
# Back Orifice (logged)
/sbin/ipchains -A input -l -p TCP -d 0.0.0.0/0 31337 -j DENY
/sbin/ipchains -A input -l -p UDP -d 0.0.0.0/0 31337 -j DENY
# NetBus (logged)
/sbin/ipchains -A input -l -p TCP -d 0.0.0.0/0 12345:12346 -j DENY
/sbin/ipchains -A input -l -p UDP -d 0.0.0.0/0 12345:12346 -j DENY
# High Ports
# ---- -----
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 1023:65535 -j ACCEPT
/sbin/ipchains -A input -p UDP -d 0.0.0.0/0 1023:65535 -j ACCEPT
# Services
# --------
# FTP-data (20) and FTP (21)
# ------------- --- --------
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 20 -j ACCEPT
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 21 -j ACCEPT
# SSH
# ---
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 22 -j ACCEPT
# Telnet
# ------
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 23 -j ACCEPT
# Mail
# ----
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 25 -j ACCEPT
# WWW
# ---
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 80 -j ACCEPT
# Napster
# -------
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 6688 -j ACCEPT
# Proxy
# -----
/sbin/ipchains -A input -p TCP -d 0.0.0.0/0 8080 -j ACCEPT
# ICMP Rules
# ---- -----
# Incoming ICMP traffic
/sbin/ipchains -A input -p ICMP -s 0.0.0.0/0 -d 192.168.66.0/24 -j ACCEPT
# Outgoing ICMP traffic
/sbin/ipchains -A output -p ICMP -s 192.168.66.0/24 -d 0.0.0.0/0 -j ACCEPT
/sbin/ipchains -A output -p ICMP -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT
Steve
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
