IPtables script vurdering?

sunnhetsmannen · 11. februar 2005

Jeg skal arrangere LAN i vinterferien og for å dele Internet linja valgte jeg å kjøre IPCop. Valgte det på grunn av Gigabit støtte og båndbredde regulering. Og har en kraftig meskin som kjører det ( P4 2.8Ghz, 1 GB RAM, 2xGbit NIC)

Det jeg lurer på er rett og slett om firewallen er bra nok? Har ikke gjordt noe særlig med den. Det eneste jeg gjrode var å legge til

	# drop hits from Blaster worm
/sbin/iptables -A INPUT -p TCP -i $RED_DEV --dport 135 -s 0/0 -j DROP

For ikke å få loggen min full av Blaster hits...

Kan ikke noen med litt peiling ta en titt på den? Eventuellt forklare hva jeg må gjøre for å øke sikkerheten med tanke på virus, ormer og slikt.

Alle kommentarer er hjertlig velkommen :thumbup:

Herm følger koden fra filen rc.firewall (den er litt lang :whistle: )

#!/bin/sh
#
# $Id: rc.firewall,v 1.7.2.8 2004/11/30 20:51:37 alanh Exp $

eval $(/usr/local/bin/readhash /var/ipcop/ppp/settings)
eval $(/usr/local/bin/readhash /var/ipcop/ethernet/settings)
IFACE=`/bin/cat /var/ipcop/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
if [ -f /var/ipcop/red/device ]; then
DEVICE=`/bin/cat /var/ipcop/red/device 2> /dev/null | /usr/bin/tr -d '\012'`
fi

iptables_init() {
# Flush all rules and delete all custom chains
/sbin/iptables -F
/sbin/iptables -t nat -F
/sbin/iptables -t mangle -F
/sbin/iptables -X
/sbin/iptables -t nat -X
/sbin/iptables -t mangle -X

# Set up policies
/sbin/iptables -P INPUT DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -P OUTPUT ACCEPT

# drop hits from Blaster worm
/sbin/iptables -A INPUT -p TCP -i $RED_DEV --dport 135 -s 0/0 -j DROP

# Empty LOG_DROP and LOG_REJECT chains
/sbin/iptables -N LOG_DROP
/sbin/iptables -A LOG_DROP   -m limit --limit 10/minute -j LOG
/sbin/iptables -A LOG_DROP   -j DROP
/sbin/iptables -N LOG_REJECT
/sbin/iptables -A LOG_REJECT -m limit --limit 10/minute -j LOG
/sbin/iptables -A LOG_REJECT -j REJECT

# This chain will log, then DROPs packets with certain bad combinations
# of flags might indicate a port-scan attempt (xmas, null, etc)
/sbin/iptables -N PSCAN
/sbin/iptables -A PSCAN -p tcp  -m limit --limit 10/minute -j LOG --log-prefix "TCP Scan? "
/sbin/iptables -A PSCAN -p udp  -m limit --limit 10/minute -j LOG --log-prefix "UDP Scan? "
/sbin/iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "ICMP Scan? "
/sbin/iptables -A PSCAN -f      -m limit --limit 10/minute -j LOG --log-prefix "FRAG Scan? "
/sbin/iptables -A PSCAN -j DROP

# New tcp packets without SYN set - could well be an obscure type of port scan
# that's not covered above, may just be a broken windows machine
/sbin/iptables -N NEWNOTSYN
/sbin/iptables -A NEWNOTSYN  -m limit --limit 10/minute -j LOG  --log-prefix "NEW not SYN? "
/sbin/iptables -A NEWNOTSYN  -j DROP

# Chain to contain all the rules relating to bad TCP flags
/sbin/iptables -N BADTCP

# Disallow packets frequently used by port-scanners
# nmap xmas
/sbin/iptables -A BADTCP -p tcp --tcp-flags ALL FIN,URG,PSH  -j PSCAN
# Null
/sbin/iptables -A BADTCP -p tcp --tcp-flags ALL NONE -j PSCAN
# FIN
/sbin/iptables -A BADTCP -p tcp --tcp-flags ALL FIN -j PSCAN
# SYN/RST (also catches xmas variants that set SYN+RST+...)
/sbin/iptables -A BADTCP -p tcp --tcp-flags SYN,RST SYN,RST -j PSCAN
# SYN/FIN (QueSO or nmap OS probe)
/sbin/iptables -A BADTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j PSCAN
# NEW TCP without SYN
/sbin/iptables -A BADTCP -p tcp ! --syn -m state --state NEW -j NEWNOTSYN

/sbin/iptables -A INPUT   -j BADTCP
/sbin/iptables -A FORWARD -j BADTCP

}

iptables_red() {
/sbin/iptables -F REDINPUT
/sbin/iptables -F REDFORWARD
/sbin/iptables -t nat -F REDNAT

# PPPoE / PPTP Device
if [ "$IFACE" != "" ]; then
 # PPPoE / PPTP
 if [ "$DEVICE" != "" ]; then
 	/sbin/iptables -A REDINPUT -i $DEVICE -j ACCEPT
 fi
 if [ "$RED_TYPE" = "PPTP" -o "$RED_TYPE" = "PPPOE" ]; then
 	if [ "$RED_DEV" != "" ]; then
   /sbin/iptables -A REDINPUT -i $RED_DEV -j ACCEPT
 	fi
 fi
fi

# PPTP over DHCP
if [ "$DEVICE" != "" -a "$TYPE" = "PPTP" -a "$METHOD" = "DHCP" ]; then
 /sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
 /sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
fi

# Orange pinholes
if [ "$ORANGE_DEV" != "" ]; then
 # This rule enables a host on ORANGE network to connect to the outside
 # (only if we have a red connection)
 if [ "$IFACE" != "" ]; then
 	/sbin/iptables -A REDFORWARD -i $ORANGE_DEV -p tcp \
   -o $IFACE -j ACCEPT
 	/sbin/iptables -A REDFORWARD -i $ORANGE_DEV -p udp \
   -o $IFACE -j ACCEPT
 fi
fi

if [ "$IFACE" != "" -a -f /var/ipcop/red/active ]; then
 # DHCP
 if [ "$RED_DEV" != "" -a "$RED_TYPE" = "DHCP" ]; then
 	/sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 	/sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 fi
 if [ "$METHOD" = "DHCP"  -a "$PROTOCOL" = "RFC1483" ]; then
 	/sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 	/sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 fi

 # Outgoing masquerading
 /sbin/iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
fi
}

# See how we were called.
case "$1" in
 start)
iptables_init

# Limit Packets- helps reduce dos/syn attacks
/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 10/sec

# Fix for braindead ISP's
/sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

# CUSTOM chains, can be used by the users themselves
/sbin/iptables -N CUSTOMINPUT
/sbin/iptables -A INPUT -j CUSTOMINPUT
/sbin/iptables -N CUSTOMFORWARD
/sbin/iptables -A FORWARD -j CUSTOMFORWARD
/sbin/iptables -N CUSTOMOUTPUT
/sbin/iptables -A OUTPUT -j CUSTOMOUTPUT
/sbin/iptables -t nat -N CUSTOMPREROUTING
/sbin/iptables -t nat -A PREROUTING -j CUSTOMPREROUTING
/sbin/iptables -t nat -N CUSTOMPOSTROUTING
/sbin/iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING

# Accept everything connected
/sbin/iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow ICMP echo-request (ping), all other essential ICMP will be either
# ESTABLISHED or RELATED, and the rest caught by the default DENY policy
/sbin/iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT

# localhost and ethernet.
/sbin/iptables -A INPUT   -i lo          -m state --state NEW -j ACCEPT
/sbin/iptables -A INPUT   -s 127.0.0.0/8 -m state --state NEW -j DROP   # Loopback not on lo
/sbin/iptables -A INPUT   -d 127.0.0.0/8 -m state --state NEW -j DROP
/sbin/iptables -A FORWARD -i lo          -m state --state NEW -j ACCEPT
/sbin/iptables -A FORWARD -s 127.0.0.0/8 -m state --state NEW -j DROP
/sbin/iptables -A FORWARD -d 127.0.0.0/8 -m state --state NEW -j DROP
/sbin/iptables -A INPUT   -i $GREEN_DEV  -m state --state NEW -j ACCEPT -p ! icmp
/sbin/iptables -A FORWARD -i $GREEN_DEV  -m state --state NEW -j ACCEPT

# accept all traffic from ipsec interfaces
/sbin/iptables -A INPUT   -i ipsec+ -j ACCEPT
/sbin/iptables -A FORWARD -i ipsec+ -j ACCEPT

# allow DHCP on BLUE to be turned on/off
/sbin/iptables -N DHCPBLUEINPUT 
/sbin/iptables -A INPUT -j DHCPBLUEINPUT

# IPSec chains
/sbin/iptables -N IPSECRED
/sbin/iptables -A INPUT -j IPSECRED
/sbin/iptables -N IPSECBLUE
/sbin/iptables -A INPUT -j IPSECBLUE

# WIRELESS chains
/sbin/iptables -N WIRELESSINPUT
/sbin/iptables -A INPUT -j WIRELESSINPUT
/sbin/iptables -N WIRELESSFORWARD
/sbin/iptables -A FORWARD -j WIRELESSFORWARD

# RED chain, used for the red interface
/sbin/iptables -N REDINPUT
/sbin/iptables -A INPUT -j REDINPUT
/sbin/iptables -N REDFORWARD
/sbin/iptables -A FORWARD -j REDFORWARD
/sbin/iptables -t nat -N REDNAT
/sbin/iptables -t nat -A POSTROUTING -j REDNAT

iptables_red

# DMZ pinhole chain.  setdmzholes setuid prog adds rules here to allow
# ORANGE to talk to GREEN / BLUE.
/sbin/iptables -N DMZHOLES
if [ "$ORANGE_DEV" != "" ]; then
 /sbin/iptables -A FORWARD -i $ORANGE_DEV -m state --state NEW -j DMZHOLES
fi

# XTACCESS chain, used for external access
/sbin/iptables -N XTACCESS
/sbin/iptables -A INPUT -m state --state NEW -j XTACCESS

# PORTFWACCESS chain, used for portforwarding
/sbin/iptables -N PORTFWACCESS
/sbin/iptables -A FORWARD -m state --state NEW -j PORTFWACCESS

# Custom prerouting chains (for transparent proxy and port forwarding)
/sbin/iptables -t nat -N SQUID
/sbin/iptables -t nat -A PREROUTING -j SQUID
/sbin/iptables -t nat -N PORTFW
/sbin/iptables -t nat -A PREROUTING -j PORTFW

# Custom postrouting chain (for port forwarding)
/sbin/iptables -t nat -N POSTPORTFW
/sbin/iptables -t nat -A POSTROUTING -j POSTPORTFW

# run local firewall configuration, if present
 if [ -x /etc/rc.d/rc.firewall.local ]; then
 /etc/rc.d/rc.firewall.local start
fi

# last rule in input and forward chain is for logging.
/sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "INPUT "
/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "OUTPUT "
      ;;
 stop)
iptables_init

# Accept everyting connected
/sbin/iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT

# localhost and ethernet.
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A INPUT -i $GREEN_DEV -m state --state NEW -j ACCEPT

if [ "$RED_DEV" != "" -a "$RED_TYPE" = "DHCP" ]; then
 /sbin/iptables -A INPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 /sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
fi
if [ "$PROTOCOL" = "RFC1483" -a "$METHOD" = "DHCP" ]; then
 /sbin/iptables -A INPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 /sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
fi

# run local firewall configuration, if present
 if [ -x /etc/rc.d/rc.firewall.local ]; then
 /etc/rc.d/rc.firewall.local stop
fi

/sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "INPUT "
/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "OUTPUT "
      ;;
 reload)
iptables_red

# run local firewall configuration, if present
 if [ -x /etc/rc.d/rc.firewall.local ]; then
 /etc/rc.d/rc.firewall.local reload
fi
;;
 restart)
$0 stop
$0 start
;;
 *)
       echo "Usage: $0 {start|stop|reload|restart}"
       exit 1
;;
esac

exit 0

Logg inn

IPtables script vurdering?

Anbefalte innlegg

sunnhetsmannen

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Opprett konto

Logg inn

Hvem er aktive 0 medlemmer