simplefirewall
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
simplefirewall [2006/11/08 07:13] – remove disgusting wiki spam---don't let it be so easy to add 63.247.196.230 | simplefirewall [2007/12/11 13:56] (current) – old revision restored 62.177.78.190 | ||
---|---|---|---|
Line 1: | Line 1: | ||
+ | ====== simplefirewall ====== | ||
+ | |||
+ | The firewall below will let in SSH, HTTP and FTP. To avoid SSH brute force dictionary attacks it uses the iptables recent match module for connection rate limiting. It is intended for a Host with a single interface connected to the net, eg. a webserver. | ||
+ | |||
+ | |||
+ | Hint before enabling it add this to your ''/ | ||
+ | |||
+ | < | ||
+ | */5 * * * * root / | ||
+ | </ | ||
+ | |||
+ | And check ''/ | ||
+ | |||
+ | |||
+ | <code bash> | ||
+ | #!/bin/bash | ||
+ | | ||
+ | # Very simple firewall for a single interface | ||
+ | |||
+ | IF=" | ||
+ | HIPORT=" | ||
+ | | ||
+ | IPTABLES=`which iptables` || IPTABLES="/ | ||
+ | | ||
+ | case $1 in | ||
+ | close) | ||
+ | $IPTABLES -F | ||
+ | $IPTABLES -X | ||
+ | $IPTABLES -F INPUT | ||
+ | $IPTABLES -F OUTPUT | ||
+ | $IPTABLES -P INPUT DROP | ||
+ | $IPTABLES -P OUTPUT ACCEPT | ||
+ | $IPTABLES -A INPUT -p icmp --icmp-type 8 -j ACCEPT | ||
+ | $IPTABLES -A INPUT -i lo -j ACCEPT | ||
+ | echo " | ||
+ | exit 0 | ||
+ | ;; | ||
+ | | ||
+ | stop) | ||
+ | $IPTABLES -F | ||
+ | $IPTABLES -X | ||
+ | $IPTABLES -F INPUT | ||
+ | $IPTABLES -F OUTPUT | ||
+ | $IPTABLES -P INPUT ACCEPT | ||
+ | $IPTABLES -P OUTPUT ACCEPT | ||
+ | echo " | ||
+ | exit 0 | ||
+ | ;; | ||
+ | |||
+ | start) | ||
+ | # First of all, flush all rules | ||
+ | $IPTABLES -F | ||
+ | $IPTABLES -F -t nat | ||
+ | $IPTABLES -X | ||
+ | $IPTABLES -F INPUT | ||
+ | $IPTABLES -F OUTPUT | ||
+ | $IPTABLES -F FORWARD | ||
+ | |||
+ | # set default policy and create additional chains | ||
+ | $IPTABLES -P INPUT DROP | ||
+ | $IPTABLES -P OUTPUT DROP | ||
+ | $IPTABLES -P FORWARD DROP | ||
+ | $IPTABLES -N dropchain | ||
+ | $IPTABLES -N ssh | ||
+ | $IPTABLES -N blacklist | ||
+ | |||
+ | # enable additional kernel security | ||
+ | echo " | ||
+ | echo " | ||
+ | echo " | ||
+ | echo " | ||
+ | echo " | ||
+ | echo " | ||
+ | echo " | ||
+ | echo " | ||
+ | echo " | ||
+ | |||
+ | # tune tcp params see for info: | ||
+ | # http:// | ||
+ | echo " | ||
+ | echo " | ||
+ | echo " | ||
+ | |||
+ | # local processes: | ||
+ | $IPTABLES -A INPUT -i lo -j ACCEPT | ||
+ | $IPTABLES -A OUTPUT -o lo -j ACCEPT | ||
+ | |||
+ | # icmp stuff: | ||
+ | $IPTABLES -A INPUT -i $IF -p icmp --icmp-type echo-request -j ACCEPT | ||
+ | $IPTABLES -A INPUT -i $IF -p icmp --icmp-type echo-reply -j ACCEPT | ||
+ | $IPTABLES -A OUTPUT -o $IF -p icmp --icmp-type echo-request -j ACCEPT | ||
+ | $IPTABLES -A OUTPUT -o $IF -p icmp --icmp-type echo-reply -j ACCEPT | ||
+ | $IPTABLES -A OUTPUT -o $IF -p icmp --icmp-type source-quench -j ACCEPT | ||
+ | $IPTABLES -A INPUT -i $IF -p icmp --icmp-type time-exceeded -j ACCEPT | ||
+ | $IPTABLES -A OUTPUT -o $IF -p icmp --icmp-type time-exceeded -j ACCEPT | ||
+ | $IPTABLES -A INPUT -i $IF -p icmp --icmp-type parameter-problem -j ACCEPT | ||
+ | $IPTABLES -A OUTPUT -o $IF -p icmp --icmp-type parameter-problem -j ACCEPT | ||
+ | $IPTABLES -A INPUT -i $IF -p icmp --icmp-type fragmentation-needed -j ACCEPT | ||
+ | $IPTABLES -A OUTPUT -o $IF -p icmp --icmp-type fragmentation-needed -j ACCEPT | ||
+ | |||
+ | # let answers out: | ||
+ | $IPTABLES -A OUTPUT -m state --state ESTABLISHED, | ||
+ | $IPTABLES -A OUTPUT -m state --state ESTABLISHED -o $IF -p udp -j ACCEPT | ||
+ | |||
+ | # let all answers in: | ||
+ | $IPTABLES -A INPUT -m state --state ESTABLISHED, | ||
+ | $IPTABLES -A INPUT -m state --state ESTABLISHED -i $IF -p udp -j ACCEPT | ||
+ | |||
+ | # ssh rate limit support - iptables recent module needed! | ||
+ | # see http:// | ||
+ | |||
+ | # prepare blacklist | ||
+ | $IPTABLES -A blacklist -m recent --name blacklist --set | ||
+ | $IPTABLES -A blacklist -j LOG --log-level info --log-prefix "FW log BLACKLIST: " | ||
+ | $IPTABLES -A blacklist -j DROP | ||
+ | |||
+ | # drop everyone currently on the blacklist | ||
+ | $IPTABLES -A ssh -m recent --update --name blacklist --seconds 600 --hitcount 1 -j DROP | ||
+ | |||
+ | # count incomers | ||
+ | $IPTABLES -A ssh -m recent --set --name counting1 | ||
+ | $IPTABLES -A ssh -m recent --set --name counting2 | ||
+ | $IPTABLES -A ssh -m recent --set --name counting3 | ||
+ | $IPTABLES -A ssh -m recent --set --name counting4 | ||
+ | |||
+ | # add to blacklist on rate exceed | ||
+ | $IPTABLES -A ssh -m recent --update --name counting1 --seconds | ||
+ | $IPTABLES -A ssh -m recent --update --name counting2 --seconds | ||
+ | $IPTABLES -A ssh -m recent --update --name counting3 --seconds | ||
+ | $IPTABLES -A ssh -m recent --update --name counting4 --seconds 20000 --hitcount 400 -j blacklist | ||
+ | |||
+ | # accept at the end of SSH chain | ||
+ | $IPTABLES -A ssh -j ACCEPT | ||
+ | |||
+ | # put all SSH traffic in the ssh chain | ||
+ | $IPTABLES -A INPUT -m state --state NEW -i $IF -p tcp --sport $HIPORT --dport ssh -j ssh | ||
+ | |||
+ | ########### start of custom rules ############ | ||
+ | |||
+ | # let HTTP in | ||
+ | $IPTABLES -A INPUT -m state --state NEW -i $IF -p tcp --sport $HIPORT --dport http -j ACCEPT | ||
+ | |||
+ | # let FTP in (needs loaded ip_conntrack_ftp module) | ||
+ | $IPTABLES -A INPUT -m state --state NEW -i $IF -p tcp --sport $HIPORT --dport ftp -j ACCEPT | ||
+ | |||
+ | ########### end of custom rules ############ | ||
+ | |||
+ | # drop & log everything else | ||
+ | $IPTABLES -A INPUT -j dropchain | ||
+ | $IPTABLES -A OUTPUT -j dropchain | ||
+ | | ||
+ | # dropchain: every packet will be dropped, and, if defined logged... | ||
+ | $IPTABLES -A dropchain -p icmp -j DROP #dont log outgoing icmp | ||
+ | $IPTABLES -A dropchain -p tcp -m state --state INVALID -j LOG --log-level info --log-prefix "FW log INVALID: " | ||
+ | $IPTABLES -A dropchain -j LOG --log-level info --log-prefix "FW log: " | ||
+ | $IPTABLES -A dropchain -j DROP | ||
+ | |||
+ | #done | ||
+ | echo " | ||
+ | exit 0 | ||
+ | ;; | ||
+ | |||
+ | *) | ||
+ | echo " | ||
+ | exit 1 | ||
+ | ;; | ||
+ | esac | ||
+ | |||
+ | exit 1; | ||
+ | </ | ||