iptables, kan noen se over oppsettet før jeg kjører det?

[Noble]

Slik er det nå satt opp

 

Internet ----- eth0 | Ubuntu server | eth1 ------- LAN

 

Ubuntu server kjører SRCDS og Ventrilo som skal ut på nettet, resten av portene skal låses.

 

 

 

#!/bin/bash

 

# No spoofing

if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]

then

for filtre in /proc/sys/net/ipv4/conf/*/rp_filter

do

echo 1 > $filtre

done

fi

 

# No icmp

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

 

#load some modules you may need

modprobe ip_tables

modprobe ip_nat_ftp

modprobe ip_nat_irc

modprobe iptable_filter

modprobe iptable_nat

modprobe ip_conntrack_irc

modprobe ip_conntrack_ftp

 

# Log chain

iptables -N LOG_DROP

iptables -A LOG_DROP -j LOG --log-prefix '[iPTABLES DROP] : '

iptables -A LOG_DROP -j DROP

 

# Remove all rules and chains

iptables -F

iptables -X

 

# first set the default behaviour => accept connections

iptables -P INPUT ACCEPT

iptables -P OUTPUT ACCEPT

iptables -P FORWARD ACCEPT

 

# New chains

iptables -N FIREWALL

iptables -N TRUSTED

 

#Allow ESTABLISHED and RELATED incoming connection

iptables -A FIREWALL -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

 

# Allow self communication

iptables -A FIREWALL -i lo -j ACCEPT

iptables -A FIREWALL -o lo -j ACCEPT

 

# Send all package to the TRUSTED chain

iptables -A FIREWALL -j TRUSTED

 

# DROP all other packets

iptables -A FIREWALL -j DROP

 

# Send all through the FIREWALL chain

iptables -A INPUT -j FIREWALL

iptables -A FORWARD -j FIREWALL

iptables -A OUTPUT -j FIREWALL

 

# DROP all other packets

iptables -A FIREWALL -j DROP

 

# SET MASQUERADE

 

iptables --table nat -A POSTROUTING -o eth1 -j MASQUERADE

 

 

 

# OPEN PORTS

 

# Bittorrent

iptables -A TRUSTED -i eth0 -p tcp --sport 31839 -m state --state ESTABLISHED -j ACCEPT

iptables -A TRUSTED -o eth0 -p tcp --dport 31839 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A TRUSTED -i eth0 -p udp --sport 31839 -m state --state ESTABLISHED -j ACCEPT

iptables -A TRUSTED -o eth0 -p udp --dport 31839 -m state --state NEW,ESTABLISHED -j ACCEPT

 

#SRCDS

iptables -A TRUSTED -i eth0 -p tcp --sport 27015 -m state --state ESTABLISHED -j ACCEPT

iptables -A TRUSTED -o eth0 -p tcp --dport 27015 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A TRUSTED -i eth0 -p udp --sport 27015 -m state --state ESTABLISHED -j ACCEPT

iptables -A TRUSTED -o eth0 -p udp --dport 27015 -m state --state NEW,ESTABLISHED -j ACCEPT

 

#Ventrilo

iptables -A TRUSTED -i eth0 -p tcp --sport 3784 -m state --state ESTABLISHED -j ACCEPT

iptables -A TRUSTED -o eth0 -p tcp --dport 3784 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A TRUSTED -i eth0 -p udp --sport 3784 -m state --state ESTABLISHED -j ACCEPT

iptables -A TRUSTED -o eth0 -p udp --dport 3784 -m state --state NEW,ESTABLISHED -j ACCEPT

 

[Sokkalf™]

Litt off-topic kanskje, jeg har ikke så mye peiling på iptables..

 

..hvorfor ikke bruke f.eks shorewall til å håndtere oppsettet for deg? Personlig syns jeg det blir mye enklere å holde styr på, spesielt hvis du har en del regler.

[Wisd0m]

Bruk ufw istedet.

 

http://www.ubuntugeek.com/ufw-uncomplicate...untu-hardy.html

 

Egentlig bare en forenkling av iptables.