# this file normally resides in /etc # as you can see, together with the local firewall file # # greetz, # harry IPTABLES="/sbin/iptables" LOCALFIREWALL="/etc/firewall.local" HOSTNAME=`hostname` # our own servers S1E=134.58.10.96 S2E=134.58.10.97 S1I=192.168.28.1 S2I=192.168.28.2 Q1=134.58.126.129 Q2=134.58.127.129 H2O=134.58.10.103 INTERNAL_NET=192.168.30.0/24 CONFIG=192.168.28.3 SYSLOGNG=192.168.28.4 SYSLOG=134.58.10.103 MONITORE=134.58.242.12 MONITORI=192.168.28.13 TSM=10.33.38.1 TSMSRV1=10.33.38.2 TSMSRV1D=192.168.33.250 P5HMC=192.168.29.5 DRHMC=192.168.29.6 # kulnet servers KULNETFTP=134.58.250.2 NS1=134.58.126.3 NS2=134.58.127.1 NTP1=134.58.255.1 SMTP=134.58.240.0/24 # external servers DEBIAN_SECURITY1=212.211.132.32 DEBIAN_SECURITY2=128.31.0.36 DEBIAN_SECURITY3=212.211.132.250 DEBIAN_SECURITY4=128.101.240.212 DEBIAN_BE=193.190.198.20 DEBIAN_DE=141.76.2.4 DEBIAN_UK=195.224.53.39 REDHAT_RHN1=66.187.224.100 REDHAT_RHN2=209.132.177.100 if [ -f $LOCALFIREWALL ] then . $LOCALFIREWALL else run_input_chains() { echo "No input rules" } run_output_chains() { echo "No output rules" } run_forward_chains() { echo "No forward rules" } fi echo "Part 1: Clearing existing rules and setting default policies to DROP" echo 1 > /proc/sys/net/ipv4/conf/all/log_martians echo 0 > /proc/sys/net/ipv4/ip_forward $IPTABLES -F $IPTABLES -X $IPTABLES -P INPUT DROP $IPTABLES -P OUTPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -N Icmp_Related_And_New # established,related doorlaten $IPTABLES -I INPUT 1 -p ! icmp -m state --state RELATED,ESTABLISHED -j ACCEPT # icmp regels behandelen $IPTABLES -I INPUT 2 -p icmp -j Icmp_Related_And_New # alles wat niet nieuw is nu... drop (hou je fw logs clean) $IPTABLES -I INPUT 3 -m state --state ! NEW -j DROP # established,related doorlaten $IPTABLES -I OUTPUT 1 -p ! icmp -m state --state RELATED,ESTABLISHED -j ACCEPT # icmp regels behandelen $IPTABLES -I OUTPUT 2 -p icmp -j Icmp_Related_And_New # alles wat niet nieuw is nu... drop (hou je fw logs clean) $IPTABLES -I OUTPUT 3 -m state --state ! NEW -j DROP # established,related doorlaten $IPTABLES -I FORWARD 1 -p ! icmp -m state --state RELATED,ESTABLISHED -j ACCEPT # icmp regels behandelen $IPTABLES -I FORWARD 2 -p icmp -j Icmp_Related_And_New # alles wat niet nieuw is nu... drop (hou je fw logs clean) $IPTABLES -I FORWARD 3 -m state --state ! NEW -j DROP echo "Part 2: Defining chainrules" # ----------- # INPUT rules # ----------- # default input rules $IPTABLES -A INPUT --source $MONITORE -j ACCEPT $IPTABLES -A INPUT --source $MONITORI -j ACCEPT $IPTABLES -A INPUT -p tcp --source $INTERNAL_NET --destination-port ssh -j ACCEPT $IPTABLES -A INPUT -p tcp --source $H2O --destination-port ssh -j ACCEPT $IPTABLES -A INPUT -p tcp --source $S1E --destination-port ssh -j ACCEPT $IPTABLES -A INPUT -p tcp --source $S2E --destination-port ssh -j ACCEPT $IPTABLES -A INPUT -p tcp --source $S1I --destination-port ssh -j ACCEPT $IPTABLES -A INPUT -p tcp --source $S2I --destination-port ssh -j ACCEPT $IPTABLES -A INPUT -p tcp --source $Q1 --destination-port ssh -j ACCEPT $IPTABLES -A INPUT -p tcp --source $Q2 --destination-port ssh -j ACCEPT $IPTABLES -A INPUT -p tcp --source $CONFIG --destination-port ssh -j ACCEPT $IPTABLES -A INPUT -p tcp --source $TSM --destination-port 1501 -j ACCEPT $IPTABLES -A INPUT -p tcp --source $TSMSRV1 --destination-port 1501 -j ACCEPT $IPTABLES -A INPUT -p tcp --source $TSMSRV1D --destination-port 1501 -j ACCEPT $IPTABLES -A INPUT -p tcp --destination-port auth -j REJECT # keeping the logs a bit cleaner # if we are config or syslog, we want haeartbeat! if [ $HOSTNAME != "config" ] && [ $HOSTNAME != "syslogng" ] then $IPTABLES -A INPUT -p udp --destination-port 694 -j DROP # heartbeat (config/syslogng) $IPTABLES -A INPUT -p udp --source-port 67 -j DROP # Bootp stuff $IPTABLES -A INPUT -p udp --destination-port 67 -j DROP # Bootp stuff fi $IPTABLES -A INPUT -p udp --source-port 137 -j DROP # Windows crap $IPTABLES -A INPUT -p udp --source-port 138 -j DROP # Windows crap $IPTABLES -A INPUT -p udp --destination-port 137 -j DROP # Windows crap $IPTABLES -A INPUT -p udp --destination-port 138 -j DROP # Windows crap $IPTABLES -A INPUT -p udp --destination-port 520 -j DROP # HMC Marijke $IPTABLES -A INPUT -p udp --source $P5HMC --destination-port 9900 -j DROP # HMC Marijke $IPTABLES -A INPUT -p udp --source $DRHMC --destination-port 9900 -j DROP # HMC Marijke $IPTABLES -A INPUT -d 224.0.0.0/24 -j DROP # multicast # allow all loopback traffic $IPTABLES -A INPUT -i lo -j ACCEPT # time to load the serverspecific rules run_input_chains # log all that's not matched by the rules $IPTABLES -A INPUT -j LOG --log-prefix "illegal INPUT: " --log-level notice # ------------ # OUTPUT rules # ------------ # default output rules $IPTABLES -A OUTPUT --destination $MONITORE -j ACCEPT $IPTABLES -A OUTPUT --destination $MONITORI -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $KULNETFTP --destination-port ftp -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $KULNETFTP --destination-port http -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $DEBIAN_SECURITY1 --destination-port http -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $DEBIAN_SECURITY2 --destination-port http -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $DEBIAN_SECURITY3 --destination-port http -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $DEBIAN_SECURITY4 --destination-port http -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $DEBIAN_BE --destination-port http -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $DEBIAN_DE --destination-port http -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $DEBIAN_UK --destination-port http -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $REDHAT_RHN1 --destination-port http -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $REDHAT_RHN2 --destination-port http -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $REDHAT_RHN1 --destination-port https -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $REDHAT_RHN2 --destination-port https -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $SMTP --destination-port smtp -j ACCEPT $IPTABLES -A OUTPUT -p udp --destination $NTP1 --destination-port ntp -j ACCEPT $IPTABLES -A OUTPUT -p udp --destination $NS1 --destination-port domain -j ACCEPT $IPTABLES -A OUTPUT -p udp --destination $NS2 --destination-port domain -j ACCEPT $IPTABLES -A OUTPUT -p udp --destination $SYSLOGNG --destination-port syslog -j ACCEPT $IPTABLES -A OUTPUT -p udp --destination $SYSLOG --destination-port syslog -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $TSM --destination-port 1500 -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $TSMSRV1 --destination-port 1500 -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination $TSMSRV1D --destination-port 1500 -j ACCEPT $IPTABLES -A OUTPUT -p tcp --destination-port auth -j REJECT # allow all loopback traffic $IPTABLES -A OUTPUT -o lo -j ACCEPT # time to load the serverspecific rules run_output_chains # log all that's not matched by the rules $IPTABLES -A OUTPUT -j LOG --log-prefix "illegal OUTPUT: " --log-level notice # ------------- # FORWARD rules # ------------- run_forward_chains # log all that's not matched by the rules $IPTABLES -A FORWARD -j LOG --log-prefix "illegal FORWARD: " --log-level notice # ---------- # ICMP rules # ---------- $IPTABLES -A Icmp_Related_And_New -p icmp --icmp-type echo-reply -m state --state ESTABLISHED -j ACCEPT $IPTABLES -A Icmp_Related_And_New -p icmp --icmp-type echo-request -m state --state NEW -j ACCEPT $IPTABLES -A Icmp_Related_And_New -p icmp --icmp-type destination-unreachable -m state --state RELATED -j ACCEPT $IPTABLES -A Icmp_Related_And_New -p icmp --icmp-type source-quench -m state --state RELATED -j ACCEPT $IPTABLES -A Icmp_Related_And_New -p icmp --icmp-type parameter-problem -m state --state RELATED -j ACCEPT $IPTABLES -A Icmp_Related_And_New -p icmp --icmp-type time-exceeded -m state --state RELATED -j ACCEPT # log all that's not matched by the rules $IPTABLES -A Icmp_Related_And_New -j LOG --log-prefix "illegal Icmp: " --log-level notice $IPTABLES -A Icmp_Related_And_New -j DROP echo "Firewall started!"