Answer by mitio

mitio — Tue, 17 Aug 2010 10:54:35 -0400

Hi,

at the end, how is your /etc/iptables.rules look like? If i am not in mistake... ..you are doing nat & ip forwarding, but you are dropping all forwarding packets. Also, whole your firewall is oriented only for INPUT. It's not good way to drop ICMP type 8 packets (ping), especially for routers. Here is some notes, from the way I saw how it's done (copy from configuration file - i'am using fedora):

-A INPUT -p icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp --icmp-type 8 -m limit --limit 10/second -j ACCEPT
-A INPUT -p icmp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p icmp -j DROP

It's good to accept everything ESTABLISHED and RELATED, so after that rule, everything else should be with state NEW, right? So it doesn't sense to put : -m state --state NEW.

I saw, that you are using SSH. My suggestion is to use separate chain for that port. With that chain you can manage more precision way.:

:IN_proto_SSH - [0:0]
-A INPUT -p tcp --dport 22 -j IN_proto_SSH
-A IN_proto_SSH -s 192.168.100.1 -j ACCEPT
-A IN_proto_SSH -j REJECT_unr_PORT

Note, that i use separate chain for dropping. (When i drop, i want to be SURE that it's drop, no matter how ;) ). First it's good to be done friendly. If it's just DROP-ing, the sender will try AGAIN shortly. But if you reject and say "man, there is nothing there", the sender stop sending that requests:

:REJECT_unr_PORT - [0:0]
-A REJECT_unr_PORT -p tcp -j REJECT --reject-with tcp-reset
-A REJECT_unr_PORT -p udp -j REJECT --reject-with icmp-port-unreachable
-A REJECT_unr_PORT -j DROP

Also, you can find useful to work with '-m limit --limit 20/minute -j ACCEPT' and '-j LOG --log-level debug --log-prefix ":note: " '

Answer by kainosnous

kainosnous — Thu, 12 Aug 2010 05:52:19 -0400

I'm not an iptables expert, but I can give a few pointers. With iptables order is important as the first commands executed will be the first rules in the chains. I would start the file with a --flush command to make sure that other rules won't get in the way. Then, I like to set the default policy (-P). Since you say in your file that you want unlimited outbound traffic, I would give OUTPUT a default of ACCEPT. All others I would set to DROP. Then, I would allow for internal packets to be accpeted.

With this as a starting place, I would go through first finding the things that I don't want to allow out and then things that I do want to allow in. Remember that once a packet is dropped, it won't be able to be logged, so do the logging before dropping. Usually, I put the rules together in the file so that it is logged right before it is dropped. At the very end of the file, I would then allow all remaining ESTABLISHED,RELATED packets to INPUT to ACCEPT. However, right before that, I would DROP all NEW tcp packets not marked with SYN (iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP).

You may note that this is more of a whitelist, but you really want some sort of a whitelist for security reasons. You can allays give certain protocols and ACCEPT rule at the end to make it a blacklist. These are mostly very broad and vague suggestions, but perhaps they show the method that I use to write my iptables script.

Answers to: iptables configuration script - need help with it

Answer by mitio

Answer by kainosnous