The basic IPCHAINS principle how I understand it:
Assuming one knows about TCP/UDP/ICMP packet headers each having sender and
receiver addresses.
These are the steps:
1. A packet comes in on an interface (input) or is going out on an interface
(output).
2. First firewall (IPCHAINS) rule is checked.
2a. If the rule applies (if the rule checks against IP packet's sender and
receiver IP address and/or the protocol and/or the interface and/or whatever
else you want to qualify) the rule is actioned (DENY, ACCEPT, REJECT,
REDIRECT..) No other rules are checked!! (unless part of the actioning
process --> see user defined rules)
2b. If the rule does not match, the next rule is checked if it applies.
3a. If it applies it is actioned and no other rules will be checked (unless
part of the actioning process --> see user defined rules)
3b. If the rule does not match, the next rule is checked if it applies. This
continues until all rules have been checked.
4. If a packet header does not match any rule the default policy (DENY,
ACCEPT, REJECT, REDIRECT..) is applied.
I hope this helps (and is correct)
Regards
Bernhard
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Aussie
Sent: Sunday, 5 March 2000 18:12
To: [EMAIL PROTECTED]
Subject: Re: [SLUG] More IPChains Problems
From: [EMAIL PROTECTED]
Date sent: Sun, 5 Mar 2000 17:02:22 +1100 (EST)
> I hate doing this, but I have typed up a mostly hand-worked out ipchains
> ruleset, which now doesn't work. pppd (dial-on-demand) basically doesn't
> work when this is running, and i'd like to see which rules are causing
> it too do this. The script follows below:
>
<<SNIPPED>>
> # General Bastard Port Block
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 1:1023 -j DENY
> /sbin/ipchains -A input -p UDP -d 0.0.0.0/0 1:1023 -j DENY
>
> # NetBEUI/Samba
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 139 -j DENY
> /sbin/ipchains -A input -p UDP -d 0.0.0.0/0 139 -j DENY
I may be wrong on this, but isn't this rule ignored due to the
proceeding rule already being fulfilled and denied?? I was under the
impression that the rules were walked only until one of two conditions
were fulfilled; the connection fulfills a rule, or the ruleset is
completed. Consequently, further rules (those below), including
accepts, falling between ports 1-1023 would be ignored. Feel free to
correct me if I'm wrong.
<<SNIPPED>>
> # FTP-data (20) and FTP (21)
> # ------------- --- --------
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 20 -j ACCEPT
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 21 -j ACCEPT
>
> # SSH
> # ---
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 22 -j ACCEPT
>
> # Telnet
> # ------
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 23 -j ACCEPT
>
> # Mail
> # ----
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 25 -j ACCEPT
>
> # WWW
> # ---
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 80 -j ACCEPT
>
> # Napster
> # -------
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 6688 -j ACCEPT
>
> # Proxy
> # -----
> /sbin/ipchains -A input -p TCP -d 0.0.0.0/0 8080 -j ACCEPT
A better statement here would be to only allow _some_ ICMP incoming and
to block them generally. Saves you from being DOSed.
> # ICMP Rules
> # ---- -----
> # Incoming ICMP traffic
> /sbin/ipchains -A input -p ICMP -s 0.0.0.0/0 -d 192.168.66.0/24 -j
> ACCEPT
>
> # Outgoing ICMP traffic
> /sbin/ipchains -A output -p ICMP -s 192.168.66.0/24 -d 0.0.0.0/0 -j
> ACCEPT /sbin/ipchains -A output -p ICMP -s 0.0.0.0/0 -d 0.0.0.0/0 -j
> ACCEPT
Aussie (definitely NOT an ipchains guru)
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
