|
|
|
In this tutorial I'll show you how you can build a Linux firewall using iptables
#!/bin/sh
# Drop ICMP echo-request messages sent to broadcast or multicast addresses
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Drop source routed packets
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
# Enable TCP SYN cookie protection from SYN floods
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
# Don't accept ICMP redirect messages
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
# Don't send ICMP redirect messages
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
# Enable source address spoofing protection
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
# Log packets with impossible source addresses
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
# Flush all chains
iptables --flush
# Allow unlimited traffic on the loopback interface
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Set default policies
iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP
# Previously initiated and accepted exchanges bypass rule checking
# Allow unlimited outbound traffic
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# Allow incoming TCP port 22 (ssh) traffic
iptables -A INPUT -p tcp -s 192.168.0.2/32 --dport 22 -m state --state NEW -j ACCEPT
# Reject all other traffic
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
# Have these rules take effect when iptables is started
/sbin/service iptables save
That is the end of the original script.
If you want to make a syslog entry of dropped packets, change:
# Drop all other traffic
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
To:
# Create a LOGREJECT chain to log and reject packets
iptables -N LOGREJECT
iptables -A LOGREJECT -j LOG
iptables -A LOGREJECT -j REJECT --reject-with icmp-host-prohibited
# Reject all other traffic
iptables -A INPUT -j LOGREJECT
You may also want to configure the --log-level to log dropped packets to a separate file instead of /var/log/messages:
# Drop all other traffic
iptables -A INPUT -j LOGREJECT --log-level debug
/etc/syslog.conf change:
# Send iptables LOGREJECTs to /var/log/iptables
kern.=debug /var/log/iptables
Reload the syslogd service for the change to take effect.
/sbin/service syslog reload
If you do not want to allow incoming ssh, remove:
# Allow port 22 (ssh) TCP traffic
iptables -A INPUT -p tcp -s 192.168.0.2/32 --dport 22 -m state --state NEW -j ACCEPT
Beside this you may want to allow diffrent services like Passive FTP, UDP traceroute. In order to do
this, just add the following lines after or in the same place as ssh rule:
#Passive FTP
#iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 60000:65535 -j ACCEPT
#iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 5000:65535 -j ACCEPT
#UDP Traceroute
iptables -A INPUT -m state --state NEW -m udp -p udp --dport 33434:33523 -j ACCEPT
Note:
We use Hosting and VPS Hosting, from: www.star-host.org
We like and trust them.
Good prices, high security.
