Please don't point me to a link or man page, been there done that, if you don't know, don't post please.
A short and incomplete history - I am an instructor in a HS vocational setting that had to learn networking "the hard way".
I now manage the building I am in AND teach 11 & 12 Tech Prep at the same time, ie , I have no time. I fell in love with Linux and networking is kind of fun too.
I use Suse 9 atm for my NAT and web server. I NEED to branch into mail, SAMBA, MRTG etc. but I want to start with my firewall.
I want to learn how to do this "manually" thru shell ( and scripts ) or ssh. I know there are tools, SWAT for Samba for instance, not want I want to do, thanks.
for a simple firewall If I :
Code:
#!/bin/sh
set -e
###############################
## IT Lab Firewall
## October 2005
###############################
## iptable setup interfaces and Ips variables, declared here for global use for ease of change
EXT_IFACE=eth1
EXT_IP=zzzz # top nic
WEB_IFACE=eth1
WEB_IP=yyyy # routed live
DMZ_IFACE=eth2
DMZ_IP=yyyy
DMZ_NET=yyyy/y
LAN_IFACE=eth0
LAN_IP=xxxx
LAN_NET=xxxx/x
LAN_BCAST=xxxx
ANYWHERE=0/0
WEB_SERVER=yyyy #should the mail, etc ips go in here as well?
MAIL_SERVER= #
DNS_SERVER=
FTP_SERVER=
GAME_SERVER=
GATEWAY=xxxx
#LOGLEVEL=/var/log/firewall #where the log daemon sends the log
load ()
{
# Flush all rules
iptables -F
iptables -t nat -F
iptables -t mangle -F
# Erase all non-default chains
iptables -X
iptables -t nat -X
iptables -t mangle -X
echo -e "Enabling IP forwarding.\n"
echo 1 > /proc/sys/net/ipv4/ip_forward
# disable to protect against flood / Denial of Service attacks
echo -e "Enabling SYN Protection\n"
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# reset the default policies in the nat table.
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P LANOUTPUT ACCEPT
# reset the default policies in the mangle table.
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
# allow ssh connection to this machine
iptables -A INPUT -p tcp -m tcp --destination-port 22 -j ACCEPT
# accept packets intended for this machine
iptables -A INPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 127.0.0.1 -j ACCEPT
# FWD: Allow all connections OUT and only existing and related ones IN"
iptables -A FORWARD -i $EXT_IFACE -o $LAN_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $LAN_IFACE -o $EXT_IFACE -j ACCEPT
iptables -A FORWARD -i $DMZ_IFACE -o $EXT_IFACE -j ACCEPT
# Enabling SNAT (MASQUERADE) functionality on $EXTIF"
iptables -t nat -A POSTROUTING -o $EXT_IFACE -s $LAN_NET -j MASQUERADE
iptables -t nat -A POSTROUTING -o $EXT_IFACE -s $DMZ_NET -j MASQUERADE
# RFC1918 - all other private ip access from external not permitted
...........................
( so many schools of thought here - so many different opinions )
Is this basically a good to start?
what should I look at ?
( anti-spoofing )
( blocking DNS, DHCP requests ... )
( route incoming port 80 traffic to DMZ .....)
( open ftp to DMZ for webserver )
I wish I knew more.
The script was easy to mod, I have programmed off and on for years, not my total original but cool.
Thanks Mike
