Hi there.
I'll post a script here. This is what I use. I name it something like rc.myscript.iptables and save it in /etc/rc.d
#!/bin/bash
####################
# Here we create names and connect it to interfaces and subnets
# then we don't have to change IP here and there, just all in one place
# Because of that we can use this as a template, only one place to change.
LAN1="eth1"
#LAN2="eth2"
#LAN3="eth3"
WAN="eth0"
VPN1="ipsec0"
LAN_SUB1="192.168.1.0/24"
#LAN_SUB2="192.168.2.0/24"
#LAN_SUB3="192.168.3.0/24"
VPN_SUB1="192.168.10.0/24"
WANIP1="xxx.xxx.xxx.xxx"
#WANIP2=
####################
# What is left:
# * Reject everything, not just tcp connections
# *
modprobe ip_tables
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ip_nat_irc
iptables -Z # Reset counters
iptables -t filter -F # clear filter table
iptables -t filter -X
iptables -t filter -P INPUT ACCEPT
iptables -t filter -P OUTPUT ACCEPT
iptables -t filter -P FORWARD DROP
iptables -t nat -F # clear nat table
iptables -t nat -X
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
####################
# Packet spoofing protection
iptables -t filter -N EVILNETS
iptables -t filter -A EVILNETS -s 192.168.0.0/16 -j REJECT
iptables -t filter -A EVILNETS -s 10.0.0.0/8 -j REJECT
iptables -t filter -A EVILNETS -s 172.16.0.0/20 -j REJECT
# Kill "standard-evil" stuff
iptables -t filter -N STDEVILSTUFF
iptables -t filter -A STDEVILSTUFF -p igmp -j REJECT
iptables -t filter -A STDEVILSTUFF -p icmp --icmp-type 13 -j DROP
# Speed bumps
iptables -t filter -N SPEEDBUMPS
####################
# Apply the evilnetstuff and standard evil stuff to out interfaces
iptables -t filter -N OUT_INTERFACES
iptables -t filter -A OUT_INTERFACES -i $WAN -j EVILNETS # Spoofing protection
iptables -t filter -A OUT_INTERFACES -i $WAN -j STDEVILSTUFF # Kill evil crap
####################
# Not all Mac Adresses are allowed to travel through eth2
# This will allow us to limit traffic to specific MAC addresses
# The formatid needs to be xx:xx:xx:xx:xx:xx for this to work.
# Then you have to uncomment the lines
#iptables -t filter -N MAC_FILTER
#iptables -t filter -A MAC_FILTER -i $LAN2 --match mac --mac-source 00:00:00:00:00:00 -j ACCEPT
# OK HiJacker! HiJack This!
#iptables -t filter -A MAC_FILTER -i $LAN2 -j DROP
####################
# Forwards
# Here we say which traffic is allowed between interfaces
iptables -t filter -N FORWARDS
# LAN1
iptables -t filter -A FORWARDS -s $LAN_SUB1 -i $LAN1 -o $WAN -j ACCEPT
iptables -t filter -A FORWARDS -d $LAN_SUB1 -i $WAN -o $LAN1 -j ACCEPT
iptables -t filter -A OUTPUT -s $LAN_SUB1 -o $WAN -j ACCEPT
# LAN2
#iptables -t filter -A FORWARDS -s $LAN_SUB2 -i $LAN2 -o $WAN -j ACCEPT
#iptables -t filter -A FORWARDS -d $LAN_SUB2 -i $WAN -o $LAN2 -j ACCEPT
#iptables -t filter -A OUTPUT -s $LAN_SUB2 -o $WAN -j ACCEPT
####################
# Portforward
# Here is a portforward example
# For this to work you have to uncomment the lines
#iptables -t nat -N DNATS
#iptables -t nat -A DNATS -s xxx -d xxx -p tcp -m tcp --dport xx -j DNAT --to xxx
####################
# Protection for local machine applied.
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A INPUT -j OUT_INTERFACES # Kill evil packets
iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 21 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 8080 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 161 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 3389 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 3389 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 3390 -j ACCEPT
#iptables -t filter -A INPUT -p tcp --dport 1723 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 1149 -j ACCEPT
#iptables -t filter -A INPUT -p udp --dport 500 -j ACCEPT
#iptables -t filter -A INPUT -p udp --dport 3390 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 9000 -j ACCEPT # radius-db
iptables -t filter -A INPUT -p tcp --syn -j REJECT # Reject incoming connections
####################
# DNAT, MASQ and FORWARDS
# Toflur virkjadar
iptables -t filter -A FORWARD -j SPEEDBUMPS
#iptables -t filter -A FORWARD -j MAC_FILTER
iptables -t filter -A FORWARD -j FORWARDS
#iptables -t nat -A PREROUTING -j DNATS # portforwards
iptables -t nat -A POSTROUTING -o lo -j ACCEPT
iptables -t nat -A POSTROUTING -o $WAN -s $LAN_SUB1 -j SNAT --to $WANIP1
#iptables -t nat -A POSTROUTING -o $WAN -s $LAN_SUB2 -j SNAT --to $WANIP1
iptables -t nat -A POSTROUTING -o $WAN -j ACCEPT
####################
Then you have to edit /etc/rc.local
#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.
touch /var/lock/subsys/local
/etc/rc.d/rc.myscript
And make a file under /etc/rc.d called rc.myscript
#!/bin/bash
# This file is used to run things that is hard to run from kernel or
# won't start at all
echo "Sleeping for 10 seconds to lets things settle."
echo "I can be disabled from /etc/rc.myscript, but do it only temporarly!"
sleep 10
INITTY=/dev/tty[1-8]
for tty in $INITTY ; do
setleds -D +num < $tty
done
echo "Did you see the flashing light on your keyboard? :-)"
# GRR. Damn DMA!
#hdparm -d 0 /dev/hdc
/etc/rc.d/rc.myscript.iptables
Then you restart iptables: service iptables restart
To check if it works you do service iptables status and if you see something about evilnets then everything is rocking. If not you might have to run it manually lik bash rc.myscript.iptables
I hope this will help you.
the forwarding stoped working. just to clarify i am using iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE, and echo 1 > /proc/sys/net/ipv4/ip_forward to get the forwarding working aswell as DHCP server for my other computers,, dont no if that makes any difference,Here are the files i created. did i miss anything stupidly simple ?
