Firewall rules question

65_289 · 01-29-2003, 04:44 PM

Say you're running Linux on your regular home box. Web surfing, games, school papers, etc. You're not running ANY services (http, ftp, etc) at all. Why would you run anything other than this one rule:

/sbin/iptables -A INPUT -p tcp --syn -j DROP

To me, that seems to be perfect. If it didn't come from a connection originated by your box, it's ignored. Is there something I'm missing? It seems like that almost *hack-proof* your box.

*No box is hack-proof

unSpawn · 02-02-2003, 07:21 AM

How about UDP, ICMP and other protocols?

Netfilter+Iptables HOWTO:
LQ search: iptables+howto,
IPTables Tutorial,
IPSysctl Tutorial,
Linuxguruz.org,
Netfilter.org Packetfiltering HOWTO,
Linuxsecurity.com Iptables tutorial,
Andreasson's Iptables tutorial,
Iptables Connection tracking.
Taking care of the New-not-SYN vulnerability.

Other resources/misc stuff:
CERT: Home Network Security,
Firewall FAQ,
Assigned ports > 1024,
Port designations,
FAQ: Firewall Forensics (What am I seeing?),
Linux Firewall and Security Site,
Auditing Your Firewall Setup (old, still usefull),
TLDP: Firewall Piercing mini-HOWTO"],
Something called the "Home PC Firewall Guide",
Vendor/Ethernet MAC Address Lookup,
Netfilter Iptabes/Ipchains Log Format,
Dshield (find out if IP was marked as used in attacks),
(Snort) Port search,
Neohapsis Port search,
(IPMasq) P2P ports,
Infosyssec's Firewall Security and the Internet (badly updated site),
Is "Stealth" important?.