From: [EMAIL PROTECTED]
Date sent: Sun, 5 Mar 2000 17:02:22 +1100 (EST)
> I hate doing this, but I have typed up a mostly hand-worked out ipchains
> ruleset, which now doesn't work. pppd (dial-on-demand) basically doesn't
> work when this is running, and i'd like to see which rules are causing
> it too do this. The script follows below:
>
<<SNIPPED>>
> # General Bastard Port Block
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 1:1023 -j DENY
> /sbin/ipchains -A input -p UDP -d 0.0.0.0/0 1:1023 -j DENY
>
> # NetBEUI/Samba
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 139 -j DENY
> /sbin/ipchains -A input -p UDP -d 0.0.0.0/0 139 -j DENY
I may be wrong on this, but isn't this rule ignored due to the
proceeding rule already being fulfilled and denied?? I was under the
impression that the rules were walked only until one of two conditions
were fulfilled; the connection fulfills a rule, or the ruleset is
completed. Consequently, further rules (those below), including
accepts, falling between ports 1-1023 would be ignored. Feel free to
correct me if I'm wrong.
<<SNIPPED>>
> # FTP-data (20) and FTP (21)
> # ------------- --- --------
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 20 -j ACCEPT
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 21 -j ACCEPT
>
> # SSH
> # ---
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 22 -j ACCEPT
>
> # Telnet
> # ------
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 23 -j ACCEPT
>
> # Mail
> # ----
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 25 -j ACCEPT
>
> # WWW
> # ---
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 80 -j ACCEPT
>
> # Napster
> # -------
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 6688 -j ACCEPT
>
> # Proxy
> # -----
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 8080 -j ACCEPT
A better statement here would be to only allow _some_ ICMP incoming and
to block them generally. Saves you from being DOSed.
> # ICMP Rules
> # ---- -----
> # Incoming ICMP traffic
> /sbin/ipchains -A input -p ICMP -s 0.0.0.0/0 -d 192.168.66.0/24 -j
> ACCEPT
>
> # Outgoing ICMP traffic
> /sbin/ipchains -A output -p ICMP -s 192.168.66.0/24 -d 0.0.0.0/0 -j
> ACCEPT /sbin/ipchains -A output -p ICMP -s 0.0.0.0/0 -d 0.0.0.0/0 -j
> ACCEPT
Aussie (definitely NOT an ipchains guru)
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
