[SOLVED] Iptables

Barskalas · 04-07-2013, 08:56 AM

Hello everybody,

I have to do school project with iptables, and after a week of trying to understand iptables I still didnt figure out how to do my project. So maybe someone here can help me.

I have to make .sh scripts. First one should let everybody on the network use only http and https. Second one should let only two computers on the network to use http and https.

Eth0 is IN and Eth1 is OUT.

I would be very thankful if someone could help me.

gdejonge · 04-07-2013, 09:15 AM

So what have you done to this point.
For example: did you take an existing linux box with an active firewall and made a listing of the rules and studied them.
What rules did already write.

Cheers

Barskalas · 04-07-2013, 09:24 AM

Until now, I studied about linux scripts, and learned few basics about iptables. Still newbie in linux. I ask for help because I have not much time left to show this project. It took me a while to understand the task it self.

Lexus45 · 04-07-2013, 10:07 AM

Assuming, your router's internal IP is 192.168.0.1, internal network is 192.168.0.0/24 and external IP is 12.13.14.15, your LAN clients can reach only HTTP (tcp/80) and HTTPS (tcp/443) outside:

Code:

#!/bin/bash
firewall_start() {
    iptables -F
    iptables -t nat -F
    iptables -t mangle -F

# Setting default policies
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

# makros
GATE_LAN_HOME="192.168.0.0/24"
GATE_LAN_HOME_IP="192.168.0.1"
GATE_WAN="12.13.14.15"


###### NAT
iptables -t nat -A POSTROUTING		-s $GATE_LAN_HOME -o eth1 -j SNAT --to $GATE_WAN


##### INCOMING #####
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT


######## FORWARDING #########
iptables -A FORWARD -p all -s $GATE_LAN_HOME --dport 80,443 -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT


}

firewall_stop() {
    iptables -F
    iptables -t nat -F
}
firewall_restart() {
    firewall_stop
    sleep 1
    firewall_start
}

case "$1" in
'start')
  firewall_start
  ;;
'stop')
  firewall_stop
  ;;
'restart')
  firewall_restart
  ;;
*)
echo "usage $0 start|stop|restart"
esac

Assuming, your router's internal IP is 192.168.0.1, internal network is 192.168.0.0/24 and external IP is 12.13.14.15, your LAN clients with IP addresses 192.168.0.8 and 192.168.0.19 can reach only HTTP (tcp/80) and HTTPS (tcp/443) outside:

Code:

#!/bin/bash
firewall_start() {
    iptables -F
    iptables -t nat -F
    iptables -t mangle -F

# Setting default policies
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

# makros
GATE_LAN_HOME="192.168.0.0/24"
GATE_LAN_HOME_IP="192.168.0.1"
GATE_WAN="12.13.14.15"


###### NAT
iptables -t nat -A POSTROUTING		-s $GATE_LAN_HOME -o eth1 -j SNAT --to $GATE_WAN


##### INCOMING #####
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT


######## FORWARDING #########
iptables -A FORWARD -p all -s 192.168.0.8  --dport 80,443 -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -p all -s 192.168.0.19 --dport 80,443 -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT


}

firewall_stop() {
    iptables -F
    iptables -t nat -F
}
firewall_restart() {
    firewall_stop
    sleep 1
    firewall_start
}

case "$1" in
'start')
  firewall_start
  ;;
'stop')
  firewall_stop
  ;;
'restart')
  firewall_restart
  ;;
*)
echo "usage $0 start|stop|restart"
esac

This script must be executable. If you'll place it as me (/etc/rc.d/rc.firewall , but it may depend on your distribution), do 'chmod +x /etc/rc.d/rc.firewall' and tell your system to load it at startup. In my case it's done in /etc/rc.d/rc.local .
You may also start/stop/restart it by typing /etc/rc.d/rc.firewall start (or stop or restart).