Need help writing firewall/iptables script

BuckRogers01 · 02-26-2006, 08:11 AM

OK, heres the background...

Network layout:

/\/\/\/\/\/\/\/\/\/\/\/\ ..... /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
\ .. 192.168.0.2/51 .. / ===== \ 192.168.0.1 ... SERVER ..[DHCP]... / ====== (next line)
/ ....... LAN ........ \ ===== / .. eth1 ................... eth0 . \ ======
\/\/\/\/\/\/\/\/\/\/\/\/ ..... \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/

..... /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ ....... /\/\/\/\/\/\/\/\/\
===== \ ............ ROUTER .................. / ======= \ .. INTERNET .. /
===== / 10.0.0.1 ............. 123.123.123.123 \ ======= / .............. \
..... \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/ ....... \/\/\/\/\/\/\/\/\/

I need to write a firewall script that allows:

Secure protection for the server (from internet and LAN side), as all ports will be forwarded from the router to the server, it needs protecting...
Internet access for the workstations on the LAN, however not through a proxy like squid
Access to the server's web server, ssh server, ftp server, and any other services which are running and I want access to (DNS etc...)
port forwarding to workstations on the LAN (for services like bittorrent)
Allow internet access to the server (so that I can use wget and lynx for example)

If this is not possible with the server having a DHCP assigned IP for the internet side, then I can make it static, however I would like to keep it DHCP based

I've read many howtos and tutorials on iptables scripting, NATing etc... But I just find that each tutorial does it their own way, which gets a bit confusing.

So, heres what I've got already...

PHP Code:



#!/bin/bash

# Define variables
LAN=eth1
WAN=eth0

# Tell the kernel that ip forwarding is OK
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/conf/all/forwarding

# Clear out any iptables rules
iptables -F
iptables -t nat -F

# Set up default policies
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Should 'iptables -P FORWARD DROP' be here?

# ------ TCP,UDP,ICMP Rules for server firewall ------
# Rules for new incoming packets (from LAN + WAN)
iptables -A INPUT -p TCP --destination-port 21 -j ACCEPT
iptables -A INPUT -p TCP --destination-port 22 -j ACCEPT
iptables -A INPUT -p TCP --destination-port 80 -j ACCEPT

iptables -A INPUT -p ICMP --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP --icmp-type 11 -j ACCEPT

# Rules for new incoming packets (from LAN)
iptables -A INPUT -m state --state NEW -i ! $WAN -j ACCEPT

# Rules for new incoming packets (from WAN)

# Rules for incoming packets from established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# ------ (END) TCP,UDP,ICMP Rules for server firewall ------

# NAT rules
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

I know this script doesnt do port forwarding (yet).

Please could someone verify
A) that this will work
B) that it's working as a firewall (protecting the server)
C) It does everything else that I want it to do

If anyone has any ideas on how to improve this (or make it work, dunno if it will yet), then please speak up! :P

Any information would be of great help, as I'm a little confused by iptables's workings

Thanks in advance, Buck

BuckRogers01 · 02-26-2006, 08:36 AM

Rewritten for port forwarding:

PHP Code:



#!/bin/bash

# Define variables
LAN=eth1
WAN=eth0

# Tell the kernel that ip forwarding is OK
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/conf/all/forwarding

# Clear out any iptables rules
iptables -F
iptables -t nat -F
iptables -t mangle -F

# Set up default policies
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

# ------ TCP,UDP,ICMP Rules for server firewall ------
# Rules for new incoming packets (from LAN + WAN)
iptables -A INPUT -p TCP --destination-port 21 -j ACCEPT
iptables -A INPUT -p TCP --destination-port 22 -j ACCEPT
iptables -A INPUT -p TCP --destination-port 80 -j ACCEPT

iptables -A INPUT -p ICMP --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP --icmp-type 11 -j ACCEPT

# Rules for new incoming packets (from LAN)
iptables -A INPUT -m state --state NEW -i ! $WAN -j ACCEPT

# Rules for new incoming packets (from WAN)

# Rules for incoming packets from established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# ------ (END) TCP,UDP,ICMP Rules for server firewall ------

# FORWARD rules
iptables -A FORWARD -i $LAN -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# NAT rules
iptables -t nat -A POSTROUTING -o $LAN -j MASQUERADE

# Port forwarding rules
iptables -t nat -I PREROUTING -i $LAN -p tcp --dport 6881 -j DNAT --to 192.168.0.2:6881
iptables -A FORWARD -i $WAN -p tcp -o $LAN --dport 6881 -j ACCEPT

BuckRogers01 · 02-26-2006, 03:48 PM

sorted!. This does everything (just incase someone else wants it).
The WAN interface does not need an IP, it can work with a DHCP assigned address

PHP Code:



# Set network interface identifiers
export WAN="eth0"
export LAN="eth1"

# Misc. iptables configuration
iptables -F; iptables -t nat -F; iptables -t mangle -F
echo 1 > /proc/sys/net/ipv4/ip_forward

# Set default policies
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

# Set up NATing
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE

# Allow any packets into server that are eith from an established
# or related connection, or are not from the WAN (IE. the LAN)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! $WAN -j ACCEPT

# Allow packets to be forwarded as long as they pass through the LAN
# interface, or are established or related
# (prevents WAN to WAN forwarding (spoofing)
iptables -A FORWARD -i $LAN -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT


# ------ Server Firewall ------
# WAN + LAN TCP
iptables -A INPUT --protocol tcp --dport 20 -j ACCEPT
iptables -A INPUT --protocol tcp --dport 21 -j ACCEPT
iptables -A INPUT --protocol tcp --dport 22 -j ACCEPT
iptables -A INPUT --protocol tcp --dport 80 -j ACCEPT
iptables -A INPUT --protocol tcp --dport 443 -j ACCEPT

# WAN + LAN UDP

# WAN + LAN ICMP

# LAN TCP

# LAN UDP
iptables -A INPUT -i $LAN --protocol udp --dport 53 -j ACCEPT

# LAN ICMP
iptables -A INPUT -p icmp -i $LAN --icmp-type 8 -j ACCEPT
iptables -A INPUT -p icmp -i $LAN --icmp-type 11 -j ACCEPT


# ------ Port Forwarding ------

# Bittorrent to 192.168.0.41
iptables -t nat -I PREROUTING -i $WAN -p udp --dport 6881 -j DNAT --to 192.168.0.41:6881
iptables -I FORWARD -i $WAN -p udp --dport 6881 -j ACCEPT 

# Azureus distributed database to 192.168.0.41
iptables -t nat -I PREROUTING -i $WAN -p udp --dport 6881 -j DNAT --to 192.168.0.41:6881
iptables -I FORWARD -i $WAN -p udp --dport 6881 -j ACCEPT