HOWTO Setup iptables - Revision history

Gordp: /* Kernel Configuration */

2010-07-29T17:11:09Z

Kernel Configuration

← Older revision		Revision as of 17:11, 29 July 2010
Line 1:		Line 1:
	==Kernel Configuration==		==Kernel Configuration==
	NOTE This configuration is for basic firewalling only; we don't do NAT/packet-forwarding... so, if you're reading this, and wish to use NAT/forwarding, you will be missing a few key configuration items :-O		NOTE This configuration is for basic firewalling only; we don't do NAT/packet-forwarding... so, if you're reading this, and wish to use NAT/forwarding, you will be missing a few key configuration items :-O
	Typical kernel 2.6.25 and higher kernel options for our ~~very-basic~~ firewalling:		Typical kernel 2.6.25 and higher kernel options for our firewalling:

	Networking ---->		Networking ---->
Line 7:		Line 7:
	Network packet filtering framework (Netfilter)--->		Network packet filtering framework (Netfilter)--->
	Core Netfilter Configuration ---->		Core Netfilter Configuration ---->
	~~["enable"]~~ Netfilter connection tracking support		<*> Netfilter connection tracking support
	~~["enable"]~~ Amanda backup protocol support		<*> Amanda backup protocol support
	~~["enable"]~~ Netfilter Xtables support (required for ip_tables)		-*- Netfilter Xtables support (required for ip_tables)
	~~["enable"]~~ "limit" match support ~~''really only needed if you want to rate-limit some connection, like ICMP-echo''~~		<*> "limit" match support
	["~~enable~~"] "state" match support		<*> "multiport" Multiple port match support
			<*> "state" match support
	IP: Netfilter Configuration --->		IP: Netfilter Configuration --->
	~~["enable"]~~ IPv4 connection tracking support (required for NAT) ~~''required by "Layer 3 Independent Connection tracking" above (caused many headaches)''~~		<*> IPv4 connection tracking support (required for NAT)
	~~["enable"]~~ IP tables support (required for filtering/masq/NAT)		<*> IP tables support (required for filtering/masq/NAT)
	~~["enable"]~~ Packet ~~Filtering~~		<*> Packet filtering
	~~["enable"]~~ REJECT target support		<*> REJECT target support

	==Iptables Installation==		==Iptables Installation==

Gordp: /* Scripting the Rules */

2010-07-07T15:34:51Z

Scripting the Rules

← Older revision		Revision as of 15:34, 7 July 2010
Line 66:		Line 66:

	==Scripting the Rules==		==Scripting the Rules==
	Once '''''iptables''''' is up-and-running, simply execute one of the scripts ~~below~~, to implement ~~the~~ policies, Or, use these scripts as a basis for your own similar-but-custom rulesets, which Google can help you with. Our standard is to save the ruleset-script as '''''/etc/iptables.bak'''''. So, once iptables is running (in very-basic-form), invoking the ruleset-script is very simple:		Once '''''iptables''''' is up-and-running, simply execute one of the scripts above, to implement your choice of working-policies, Or, use these scripts above as a basis for your own similar-but-custom rulesets, which Google can help you with. Our standard is to save the ruleset-script as '''''/etc/iptables.bak'''''. So, once iptables is running (in very-basic-form), invoking the ruleset-script is very simple:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''sh /etc/iptables.bak'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''sh /etc/iptables.bak'''

Line 72:		Line 72:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''etc/init.d/iptables save'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''etc/init.d/iptables save'''

	~~And~~ then ~~back~~ up your working configuration in case you break something later you can quickly revert:		...then ack up your known-working configuration in case you break something later you can quickly revert:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''cp /var/lib/iptables/rules-save /var/lib/iptables/rules.working'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''cp /var/lib/iptables/rules-save /var/lib/iptables/rules.working'''

	~~Viewing/checking~~ the active ruleset:		View and check the active ruleset:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''iptables -L'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''iptables -L'''

Gordp at 17:38, 9 December 2009

2009-12-09T17:38:31Z

← Older revision		Revision as of 17:38, 9 December 2009
Line 77:		Line 77:
	Viewing/checking the active ruleset:		Viewing/checking the active ruleset:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''iptables -L'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''iptables -L'''

			==Manually Working With Rules==
			You may wish to manually block some bad guy who is trying to access your SSH service (in this example). You can add lines like these to '''/etc/iptables.bak''' ''(of course, substitute the bad-guy's IP-address)'':
			# Manually added blocking-rules, often from watching log-output:
			# =============================================================
			#awk '($(NF-7) = /invalid user/){print $(NF-3)}' /var/log/messages \| sort \| uniq -c \| sort
			iptables -I INPUT -p tcp -s 83.103.96.33 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 41.206.41.90 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 87.139.25.251 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 200.171.229.109 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 217.91.80.206 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 61.74.75.56 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 80.169.105.159 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 62.96.29.34 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 190.146.246.36 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 195.202.52.155 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 80.153.59.28 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 82.106.226.77 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 194.51.12.238 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 61.74.75.43 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 113.105.82.13 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 211.115.234.143 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 92.79.128.167 --dport ssh -j REJECT --reject-with tcp-reset
			iptables -I INPUT -p tcp -s 58.247.222.163 --dport ssh -j REJECT --reject-with tcp-reset

Gordp: /* Kernel Configuration */

2009-01-02T18:38:55Z

Kernel Configuration

← Older revision		Revision as of 18:38, 2 January 2009
Line 10:		Line 10:
	["enable"] Amanda backup protocol support		["enable"] Amanda backup protocol support
	["enable"] Netfilter Xtables support (required for ip_tables)		["enable"] Netfilter Xtables support (required for ip_tables)
			["enable"] "limit" match support ''really only needed if you want to rate-limit some connection, like ICMP-echo''
	["enable"] "state" match support		["enable"] "state" match support
	IP: Netfilter Configuration --->		IP: Netfilter Configuration --->

Gordp: /* Kernel Configuration */

2008-11-24T18:35:51Z

Kernel Configuration

Gordp: /* Creating iptables Rulesets */

2008-03-10T15:48:30Z

Creating iptables Rulesets

← Older revision		Revision as of 15:48, 10 March 2008
Line 60:		Line 60:

	[[example_ldap_samba_iptable_ruleset\|Example 4 - /etc/iptables.bak for samba-server, LDAP, amanda-tape-backup-client, SSH connectivity, and monitoring by nagios]]		[[example_ldap_samba_iptable_ruleset\|Example 4 - /etc/iptables.bak for samba-server, LDAP, amanda-tape-backup-client, SSH connectivity, and monitoring by nagios]]

			[[example_svnserve_nfsserve_iptable_ruleset\|Example 5 - /etc/iptables.bak for SVN-server, NFS-server, amanda-tape-backup-client, SSH connectivity, and monitoring by nagios]]
	<hr>		<hr>

Gordp: /* Kernel Configuration */

2008-02-07T21:31:02Z

Kernel Configuration

← Older revision		Revision as of 21:31, 7 February 2008
Line 8:		Line 8:
	Core Netfilter Configuration ---->		Core Netfilter Configuration ---->
	["enable"] Netfilter connection tracking support--->Layer 3 Independent Connection tracking		["enable"] Netfilter connection tracking support--->Layer 3 Independent Connection tracking
			["enable"] Amanda backup protocol support
	["enable"] Netfilter Xtables support (required for ip_tables)		["enable"] Netfilter Xtables support (required for ip_tables)
	["enable"] "state" match support		["enable"] "state" match support

Gordp: /* Creating iptables Rulesets */

2008-01-30T18:31:46Z

Creating iptables Rulesets

← Older revision		Revision as of 18:31, 30 January 2008
Line 45:		Line 45:

	===Creating iptables Rulesets===		===Creating iptables Rulesets===
	~~To develop rulesets, it~~'s ~~often~~ a great starting-point to see what ports are currently in-use, and ~~reckon~~ that these may need to be opened through our firewall~~, in order for the server to perform it's intended function~~. ~~So, let's~~ see what ports are in-use, and by what programs/services:		It's a great starting-point for ruleset development to see what ports are currently in-use, and consider that these may need to be opened through our firewall. To see what ports are in-use, and by what programs/services:
	<font color=red>hostname</font> <font color=blue>~ #</font> '''netstat -alnp'''		<font color=red>hostname</font> <font color=blue>~ #</font> '''netstat -alnp'''
	<br>		<br>
	On a complex server, there can be ~~many,~~ many unfamiliar ports open, and some may vary with each invocation of the associated program :-( Google around, and first see if you can identify all the services. ~~Then~~, see if you can nail down these services to always use a known/specific port~~. Some examples are provided below, which may help~~.		On a complex server, there can be many unfamiliar ports open, and some may vary with each invocation of the associated program :-( Google around, and first see if you can identify all the services. Secondly, see if you can nail down these services to always use a known/specific port.
	<br>		<br>
	In a worst-case scenario, you may decide it's too scary to actually begin blocking ports and breaking services to users~~. While~~ this ~~is a crummy approach, it~~ can work OK with fail2ban! ~~So, you~~ will gain some protection ~~anyway,~~ against dictionary-attacks~~. This basically starts with our all-pass default filter~~ (~~shown above~~)~~, and along with the fail2ban script invocation adding a few extra lines for you, to perform it's blocking~~.		In a worst-case scenario, you may decide it's too scary to actually begin blocking ports and breaking services to users - this can work OK with fail2ban! You will gain some protection against dictionary-attacks, which is better than you had a moment ago (see Example 1).<br>
			<hr>
	[[example_simple_iptable_ruleset\|Example 1 - very-basic /etc/iptables.bak to prevent breaking extensive/weird/complex services]]		[[example_simple_iptable_ruleset\|Example 1 - very-basic /etc/iptables.bak to prevent breaking extensive/weird/complex services]]

Line 59:		Line 59:

	[[example_ldap_samba_iptable_ruleset\|Example 4 - /etc/iptables.bak for samba-server, LDAP, amanda-tape-backup-client, SSH connectivity, and monitoring by nagios]]		[[example_ldap_samba_iptable_ruleset\|Example 4 - /etc/iptables.bak for samba-server, LDAP, amanda-tape-backup-client, SSH connectivity, and monitoring by nagios]]
	<br>		<hr>

	==Scripting the Rules==		==Scripting the Rules==

Gordp: /* Creating iptables Rulesets */

2008-01-30T18:19:20Z

Creating iptables Rulesets

← Older revision		Revision as of 18:19, 30 January 2008
Line 59:		Line 59:

	[[example_ldap_samba_iptable_ruleset\|Example 4 - /etc/iptables.bak for samba-server, LDAP, amanda-tape-backup-client, SSH connectivity, and monitoring by nagios]]		[[example_ldap_samba_iptable_ruleset\|Example 4 - /etc/iptables.bak for samba-server, LDAP, amanda-tape-backup-client, SSH connectivity, and monitoring by nagios]]
			<br>

	==Scripting the Rules==		==Scripting the Rules==

Gordp: /* Creating iptables Rulesets */

2008-01-30T17:48:34Z

Creating iptables Rulesets

← Older revision		Revision as of 17:48, 30 January 2008
Line 57:		Line 57:

	[[example_webserver_nfs_keyserver_iptable_ruleset\|Example 3 - /etc/iptables.bak for a web-server with both http and https, nfs-client, amanda-tape-backup-client, SSH connectivity, a Sassafrass keyserver, a flexlm license-server, and monitoring by nagios]]		[[example_webserver_nfs_keyserver_iptable_ruleset\|Example 3 - /etc/iptables.bak for a web-server with both http and https, nfs-client, amanda-tape-backup-client, SSH connectivity, a Sassafrass keyserver, a flexlm license-server, and monitoring by nagios]]

			[[example_ldap_samba_iptable_ruleset\|Example 4 - /etc/iptables.bak for samba-server, LDAP, amanda-tape-backup-client, SSH connectivity, and monitoring by nagios]]

	==Scripting the Rules==		==Scripting the Rules==

← Older revision		Revision as of 18:35, 24 November 2008
Line 1:		Line 1:
	==Kernel Configuration==		==Kernel Configuration==
	NOTE This configuration is for basic firewalling only; we don't do NAT/packet-forwarding... so, if you're reading this, and wish to use NAT/forwarding, you will be missing a few key configuration items :-O		NOTE This configuration is for basic firewalling only; we don't do NAT/packet-forwarding... so, if you're reading this, and wish to use NAT/forwarding, you will be missing a few key configuration items :-O
	Typical kernel 2.6.22 and higher kernel options for our very-basic firewalling:		Typical kernel 2.6.25 and higher kernel options for our very-basic firewalling:

	Networking ---->		Networking ---->
Line 7:		Line 7:
	Network packet filtering framework (Netfilter)--->		Network packet filtering framework (Netfilter)--->
	Core Netfilter Configuration ---->		Core Netfilter Configuration ---->
	["enable"] Netfilter connection tracking support~~--->Layer 3 Independent Connection tracking~~		["enable"] Netfilter connection tracking support
	["enable"] Amanda backup protocol support		["enable"] Amanda backup protocol support
	["enable"] Netfilter Xtables support (required for ip_tables)		["enable"] Netfilter Xtables support (required for ip_tables)
	["enable"] "state" match support		["enable"] "state" match support
	IP: Netfilter Configuration --->		IP: Netfilter Configuration --->
	["enable"] IPv4 connection tracking support (required for NAT) required by "Layer 3 Independent Connection tracking" above (caused many headaches)		["enable"] IPv4 connection tracking support (required for NAT) ''required by "Layer 3 Independent Connection tracking" above (caused many headaches)''
	["enable"] IP tables support (required for filtering/masq/NAT)		["enable"] IP tables support (required for filtering/masq/NAT)
	["enable"] Packet Filtering		["enable"] Packet Filtering