Muchas gracias tdlinux! Welcome much appreciated.
I see I am back to init and iptables, is that right? Centos and Fedora are
moving to systemd and firewalld and I was just starting to get the hang of
iptables. I read that debian was also moving to systemd, is that going to
happen to trisquel too?
I have debian on my laptop and was working with iptables but never figured
out how to get them to load at boot. I would always have to open up a
terminal and issue a iptable-restore command. I had better luck tonight with
my trisquel using iptables-persistent.
Just in case anyone wants to know what worked for the iptables and
iptables-persistent (also some may teach me by their comments):
Step 1 Make a directory
$ sudo mkdir /etc/iptables
Step 2 Put rules in the directory, I edited these rules and saved them in my
Documents folder as FirewallProj.txt
*filter
:INPUT DROP
:OUTPUT DROP
:FORWARD DROP
-A INPUT -i lo -j ACCEPT
-A OUTPUT -p udp -m multiport --dports 53,80,123,443,465,546,993,6667 -j
ACCEPT
-A OUTPUT -p tcp -m multiport --dports 53,80,123,443,465,546,993,6667 -j
ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-N LOGGING
-A INPUT -j LOGGING
-A LOGGING -m limit --limit 5/min -j LOG --log-prefix "iptables denied: "
--log-level 7
-A LOGGING -j DROP
COMMIT
Step 3 Copy the file to /etc/iptables/rules.v4 and, since no ip addresses are
listed, can also copy to /etc/iptables/rules.v6
$ sudo cp FirewallProj.txt /etc/iptables/rules.v4
$ sudo cp FirewallProj.txt /etc/iptables/rules.v6
Step 4 Troubleshoot all my mistakes and typos in the rules by issuing the
following command over and over while hunting for my mistakes and fixing them
in FirewallProj.txt and redoing the last step again and then this step again
until this step simply worked. Ha, ha.
$ sudo iptables-restore /etc/iptables/rules.v4
$ sudo iptables-restore /etc/iptables/rules.v6
Step 5 Install iptables-persistent
$ sudo apt-get install iptables-persistent
Step 6 Answer Yes to the two questions that popped up during the install of
iptables-persistent
Step 7 Start iptables-persistent
$ service iptables-persistent start
Step 8 Reboot and check if it worked (I've had problems with these things not
working before)
$ sudo iptables -L
[sudo] password for Geshmy:
Sorry, try again.
[sudo] password for Geshmy:
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate
RELATED,ESTABLISHED
DROP all -- anywhere anywhere ctstate INVALID
LOGGING all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT udp -- anywhere anywhere multiport
dports domain,http,ntp,https,465,dhcpv6-client,imaps,6667
ACCEPT tcp -- anywhere anywhere multiport
dports domain,http,ntp,https,urd,dhcpv6-client,imaps,ircd
ACCEPT all -- anywhere anywhere ctstate
RELATED,ESTABLISHED
Chain LOGGING (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg
5/min burst 5 LOG level debug prefix "iptables denied: "
DROP all -- anywhere anywhere
and after that,
$ cd /var/log
$ dmesg | grep iptables
Well, my son is always playing games on his really noisy Windows machine so
the entries are piling up.
One small step laid towards locking down!
What's next?
