LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 12-24-2007, 11:54 PM   #1
DBabo
Member
 
Registered: Feb 2003
Distribution: Scientific Linux 6
Posts: 384

Rep: Reputation: 33
Question iptables doesn't work


hello,
it seems that i'm missing smth simple here.
The objective is to let the traffic from and to router and local machine ( static ip ).
The log seems not to work and all connections are blocked.

Any tips will be appreciated:
Code:
#!/bin/sh

ipt="/sbin/iptables"

ssh_port=22
www_port=80
wws_port=443


local_net="192.168.0.0/24"
win_host="192.168.1.205"
_host="192.168.1.204"
router="192.168.1.1"
self_host="127.0.0.1"
any="0.0.0.0/0"

$ipt -F
$ipt -Z
$ipt -X

$ipt -A INPUT -i lo -s $self_host -j ACCEPT
$ipt -A OUTPUT -o lo -d $self_host -j ACCEPT

# 
#	WWW amd SSH only 
#

$ipt -A INPUT -i eth0 -s $router -d $_host -p tcp --dport 80 --sport 1024:65535  -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$ipt -A INPUT -i eth0 -s $router -d $_host -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$ipt -A INPUT -i eth0 -s $win_host -d $_host -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$ipt -A INPUT -i eth0 -s $win_host -d $_host -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$ipt -A INPUT -i eth0 -p tcp -s $win_host --dport $ssh_port --sport 1024:65535 -d $_host -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$ipt -A OUTPUT -o eth0 -d $local_net -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

#	DNS, YUM and NTP to add
#

#$ipt -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
#$ipt -A INPUT  -p icmp --icmp-type echo-reply   -j ACCEPT

$ipt -A INPUT -j DROP
$ipt -A FORWARD -j DROP
$ipt -A OUTPUT -j DROP

$ipt -A INPUT -j LOG --log-level info --log-prefix "INPUT: "
$ipt -A OUTPUT -j LOG --log-level info --log-prefix "OUTPUT: "
 
Old 12-25-2007, 12:03 AM   #2
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Quote:
Originally Posted by DBabo View Post
hello,
it seems that i'm missing smth simple here.
The objective is to let the traffic from and to router and local machine ( static ip ).
The log seems not to work and all connections are blocked.

Any tips will be appreciated:
Code:
#!/bin/sh

ipt="/sbin/iptables"

ssh_port=22
www_port=80
wws_port=443


local_net="192.168.0.0/24"
win_host="192.168.1.205"
_host="192.168.1.204"
router="192.168.1.1"
self_host="127.0.0.1"
any="0.0.0.0/0"

$ipt -F
$ipt -Z
$ipt -X

$ipt -A INPUT -i lo -s $self_host -j ACCEPT
$ipt -A OUTPUT -o lo -d $self_host -j ACCEPT

# 
#	WWW amd SSH only 
#

$ipt -A INPUT -i eth0 -s $router -d $_host -p tcp --dport 80 --sport 1024:65535  -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$ipt -A INPUT -i eth0 -s $router -d $_host -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$ipt -A INPUT -i eth0 -s $win_host -d $_host -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$ipt -A INPUT -i eth0 -s $win_host -d $_host -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$ipt -A INPUT -i eth0 -p tcp -s $win_host --dport $ssh_port --sport 1024:65535 -d $_host -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$ipt -A OUTPUT -o eth0 -d $local_net -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

#	DNS, YUM and NTP to add
#

#$ipt -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
#$ipt -A INPUT  -p icmp --icmp-type echo-reply   -j ACCEPT

$ipt -A INPUT -j DROP
$ipt -A FORWARD -j DROP
$ipt -A OUTPUT -j DROP

$ipt -A INPUT -j LOG --log-level info --log-prefix "INPUT: "
$ipt -A OUTPUT -j LOG --log-level info --log-prefix "OUTPUT: "
Your OUTPUT rule for ESTABLISHED and RELATED packets wouldn't apply to packets coming from $win_host or $router, since those aren't on the 192.168.0.0/24 subnet ($local_net). You probably just need to change 192.168.0.0/24 to 192.168.1.0/24 at the top, where you set the variable. That is, assuming 192.168.1.0/24 is the correct subnet.

Last edited by win32sux; 12-25-2007 at 12:09 AM.
 
Old 12-25-2007, 12:25 AM   #3
DBabo
Member
 
Registered: Feb 2003
Distribution: Scientific Linux 6
Posts: 384

Original Poster
Rep: Reputation: 33
Quote:
Originally Posted by win32sux View Post
Your OUTPUT rule for ESTABLISHED and RELATED packets wouldn't apply to packets coming from $win_host or $router, since those aren't on the 192.168.0.0/24 subnet ($local_net). You probably just need to change 192.168.0.0/24 to 192.168.1.0/24 at the top, where you set the variable. That is, assuming 192.168.1.0/24 is the correct subnet.
right, i missed that one.
Thank you!

but seems that there is smth else :
Code:
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  127.0.0.1            0.0.0.0/0           
2    ACCEPT     tcp  --  192.168.1.1          192.168.1.204       tcp spts:1024:65535 dpt:80 state NEW,RELATED,ESTABLISHED 
3    ACCEPT     tcp  --  192.168.1.1          192.168.1.204       tcp spts:1024:65535 dpt:443 state NEW,RELATED,ESTABLISHED 
4    ACCEPT     tcp  --  192.168.1.205        192.168.1.204       tcp spts:1024:65535 dpt:80 state NEW,RELATED,ESTABLISHED 
5    ACCEPT     tcp  --  192.168.1.205        192.168.1.204       tcp spts:1024:65535 dpt:443 state NEW,RELATED,ESTABLISHED 
6    ACCEPT     tcp  --  192.168.1.205        192.168.1.204       tcp spts:1024:65535 dpt:22 state NEW,RELATED,ESTABLISHED 
7    DROP       all  --  0.0.0.0/0            0.0.0.0/0           
8    LOG        all  --  0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 6 prefix `INPUT: ' 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
1    DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            127.0.0.1           
2    ACCEPT     all  --  0.0.0.0/0            192.168.0.0/24      state NEW,RELATED,ESTABLISHED 
3    DROP       all  --  0.0.0.0/0            0.0.0.0/0           
4    LOG        all  --  0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 6 prefix `OUTPUT: '
hmmm.
 
Old 12-25-2007, 12:41 AM   #4
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Quote:
Originally Posted by DBabo View Post
right, i missed that one.
Thank you!

but seems that there is smth else :
Code:
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  127.0.0.1            0.0.0.0/0           
2    ACCEPT     tcp  --  192.168.1.1          192.168.1.204       tcp spts:1024:65535 dpt:80 state NEW,RELATED,ESTABLISHED 
3    ACCEPT     tcp  --  192.168.1.1          192.168.1.204       tcp spts:1024:65535 dpt:443 state NEW,RELATED,ESTABLISHED 
4    ACCEPT     tcp  --  192.168.1.205        192.168.1.204       tcp spts:1024:65535 dpt:80 state NEW,RELATED,ESTABLISHED 
5    ACCEPT     tcp  --  192.168.1.205        192.168.1.204       tcp spts:1024:65535 dpt:443 state NEW,RELATED,ESTABLISHED 
6    ACCEPT     tcp  --  192.168.1.205        192.168.1.204       tcp spts:1024:65535 dpt:22 state NEW,RELATED,ESTABLISHED 
7    DROP       all  --  0.0.0.0/0            0.0.0.0/0           
8    LOG        all  --  0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 6 prefix `INPUT: ' 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
1    DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            127.0.0.1           
2    ACCEPT     all  --  0.0.0.0/0            192.168.0.0/24      state NEW,RELATED,ESTABLISHED 
3    DROP       all  --  0.0.0.0/0            0.0.0.0/0          
4    LOG        all  --  0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 6 prefix `OUTPUT: '
hmmm.
You need to get rid of the DROP rules before your LOG rules in order to see what is happening. That said, there are some discrepancies between your config and your script. For starters, your policies are set to ACCEPT in your active config, while in the script they are supposed to get set to DROP. You also didn't correct the subnet in your OUTPUT chain, so the packets run smack into the DROP rule.

Last edited by win32sux; 12-25-2007 at 12:48 AM.
 
Old 12-25-2007, 10:44 AM   #5
DBabo
Member
 
Registered: Feb 2003
Distribution: Scientific Linux 6
Posts: 384

Original Poster
Rep: Reputation: 33
Quote:
Originally Posted by win32sux View Post
You need to get rid of the DROP rules before your LOG rules in order to see what is happening. That said, there are some discrepancies between your config and your script. For starters, your policies are set to ACCEPT in your active config, while in the script they are supposed to get set to DROP. You also didn't correct the subnet in your OUTPUT chain, so the packets run smack into the DROP rule.
There we go - one of the reasons why i have a rule not to work after 9pm - spend too much time on simple mistakes.

Thank you.
The discrepancies were because of the silly error in the script, causing the rules not to apply to the firewall.
here is the new script and new status output:
Code:
#!/bin/sh -x

ipt="/sbin/iptables"

ssh_port="22"
www_port="80"
wws_port="443"
ora_port="1521"

local_net="192.168.1.0/24"
win_host="192.168.1.205"
_host="192.168.1.204"
router="192.168.1.1"
self_host="127.0.0.1"
any="0.0.0.0/0"

$ipt -F
$ipt -Z
$ipt -X
$ipt -F INPUT
$ipt -F OUTPUT
$ipt -F FORWARD

$ipt -A INPUT -i eth0 -s $local_net -d $_host -p tcp --dport $www_port --sport 1024:65535  -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$ipt -A OUTPUT -o eth0 -d $local_net -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$ipt -A INPUT -j LOG --log-level info --log-prefix "INPUT: "
$ipt -A OUTPUT -j LOG --log-level info --log-prefix "OUTPUT: "

$ipt -A INPUT -j DROP
$ipt -A FORWARD -j DROP
$ipt -A OUTPUT -j DROP
Code:
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     tcp  --  192.168.1.0/24       192.168.1.204       tcp spts:1024:65535 dpt:80 state NEW,RELATED,ESTABLISHED 
2    LOG        all  --  0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 6 prefix `INPUT: ' 
3    DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
1    DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            192.168.1.0/24      state NEW,RELATED,ESTABLISHED 
2    LOG        all  --  0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 6 prefix `OUTPUT: ' 
3    DROP       all  --  0.0.0.0/0            0.0.0.0/0
still no loging. I'm curios is the "0.0.0.0/0" different from "192.xxx/24" causing the log to ignore the action ?

Last edited by DBabo; 12-25-2007 at 10:46 AM.
 
Old 12-25-2007, 04:15 PM   #6
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
I had read your ending DROP rules as policy settings for some reason. My bad. I have the flu. I'm not sure why it's not working. I can't see any reason why it wouldn't. Are you sure you are looking at the right log file? Are you sure 192.168.1.204 is the LAN IP of the box these rules are running on? The 0.0.0.0/0 should catch anything.

This should work:
Code:
#!/bin/sh

ipt="/sbin/iptables"

ssh_port="22"
www_port="80"
wws_port="443"
ora_port="1521"

local_net="192.168.1.0/24"
win_host="192.168.1.205"
_host="192.168.1.204"
router="192.168.1.1"
self_host="127.0.0.1"
any="0.0.0.0/0"

$ipt -F
$ipt -X
$ipt -Z

$ipt -P INPUT DROP
$ipt -P OUTPUT DROP
$ipt -P FORWARD DROP

$ipt -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

$ipt -A INPUT -i lo -j ACCEPT

$ipt -A INPUT -p TCP -i eth0 -s $local_net --dport $www_port \
--sport 1024:65535 -m state --state NEW -j ACCEPT

$ipt -A INPUT -j LOG --log-prefix "INPUT DROP: "

$ipt -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

$ipt -A OUTPUT -o lo -j ACCEPT

# If you need the box to be able to start connections to the LAN on its own:
#$ipt -A OUTPUT -o eth0 -d $local_net -m state --state NEW -j ACCEPT

$ipt -A OUTPUT -j LOG --log-prefix "OUTPUT DROP: "

Last edited by win32sux; 12-25-2007 at 06:50 PM.
 
Old 12-26-2007, 10:53 PM   #7
DBabo
Member
 
Registered: Feb 2003
Distribution: Scientific Linux 6
Posts: 384

Original Poster
Rep: Reputation: 33
Quote:
Originally Posted by win32sux View Post
I had read your ending DROP rules as policy settings for some reason. My bad. I have the flu. I'm not sure why it's not working. I can't see any reason why it wouldn't. Are you sure you are looking at the right log file? Are you sure 192.168.1.204 is the LAN IP of the box these rules are running on? The 0.0.0.0/0 should catch anything.
Get better - i had a cold a week ago , really nasty one.
i did checked that IP is the right one, same with the network mask and the other ( win_host) IP.

what if i have a traffic from router and 204 machine goes to the router to the external machine to get the info


Here is the new rules and status from the "Status" command. I'm a bit confused with that allow on 0.0 ( see highlighted in bold):

Code:
Table: filter
Chain INPUT (policy DROP)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
2    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:53 state NEW,RELATED,ESTABLISHED 
3    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:123 state NEW,RELATED,ESTABLISHED 
4    ACCEPT     tcp  --  192.168.1.0/24       0.0.0.0/0           tcp dpt:22 state NEW,RELATED,ESTABLISHED 
5    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 state NEW,RELATED,ESTABLISHED 
6    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:443 state NEW,RELATED,ESTABLISHED 
7    ACCEPT     tcp  --  192.168.1.0/24       0.0.0.0/0           tcp dpt:1521 state NEW,RELATED,ESTABLISHED 
8    LOG        all  --  0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 prefix `INPUT DROP: ' 

Chain FORWARD (policy DROP)
num  target     prot opt source               destination         

Chain OUTPUT (policy DROP)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
2    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:53 state NEW,RELATED,ESTABLISHED 
3    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:123 state NEW,RELATED,ESTABLISHED 
4    ACCEPT     tcp  --  0.0.0.0/0            192.168.1.0/24      tcp dpt:22 state NEW,RELATED,ESTABLISHED 
5    ACCEPT     tcp  --  0.0.0.0/0            192.168.1.0/24      tcp spt:22 state NEW,RELATED,ESTABLISHED 
6    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:80 state NEW,RELATED,ESTABLISHED 
7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 state NEW,RELATED,ESTABLISHED 
8    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:443 state NEW,RELATED,ESTABLISHED 
9    ACCEPT     tcp  --  0.0.0.0/0            192.168.1.0/24      tcp spt:1521 state NEW,RELATED,ESTABLISHED 
10   LOG        all  --  0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 prefix `OUTPUT DROP: '
and the script is :
Code:
#!/bin/sh -x

ipt="/sbin/iptables"

ssh_port="22"
dns_port="53"
www_port="80"
ntp_port="123"
wws_port="443"
ora_port="1521"

local_net="192.168.1.0/24"
win_host="192.168.1.205"
_host="192.168.1.204"
router="192.168.1.1"
self_host="127.0.0.1"
any="0.0.0.0/0"

$ipt -F
$ipt -X
$ipt -Z

$ipt -P INPUT DROP
$ipt -P OUTPUT DROP
$ipt -P FORWARD DROP


# All traffic on lo
$ipt -A INPUT -i lo -j ACCEPT
$ipt -A OUTPUT -o lo -j ACCEPT

#ALL DNS
$ipt -A INPUT -p UDP -i eth0 -s $any --sport $dns_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p UDP -d $any --dport $dns_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

# 138 port?

# what's with igmp and 1.1 host

# NTP
$ipt -A INPUT -p UDP -i eth0 -s $any --dport $ntp_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p UDP -d $any --dport $ntp_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

# All SSH

$ipt -A INPUT -p TCP -i eth0 -s $local_net --dport $ssh_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p TCP -d $local_net --dport $ssh_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p TCP -d $local_net --sport $ssh_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

# All WEB traffic and YUM

$ipt -A INPUT -p TCP -i eth0 -s $any --dport $www_port \
 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A INPUT -p TCP -i eth0 -s $any --dport 443 \
 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p TCP -d $any --sport $www_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p TCP -d $any --dport $www_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p TCP -d $any --sport 443 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

# Local only traffic on Oracle port(s)
$ipt -A INPUT -p TCP -i eth0 -s $local_net --dport $ora_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p TCP -d $local_net --sport $ora_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

# Everything that is not under rules get's logged and dropped:

$ipt -A INPUT -j LOG --log-prefix "INPUT DROP: "
$ipt -A OUTPUT -j LOG --log-prefix "OUTPUT DROP: "
Please note multiple lines for port 80 and 443 ...i'm not sure if i need them. Confused with dport an sport.

I really appreciate your help.
A few questions :

What's with this right below:
Quote:
Dec 26 23:24:17 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXX SRC=192.168.1.205 DST=192.168.1.204 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=39997 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=512
Dec 26 23:24:22 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXX SRC=192.168.1.205 DST=192.168.1.204 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=40180 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=768

what is with the port 138? - 138 and notice it's "moving " to 137 ?
http://www.auditmypc.com/port/udp-port-138.asp
Quote:
Dec 26 23:24:26 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXX SRC=192.168.1.205 DST=192.168.1.255 LEN=229 TOS=0x00 PREC=0x00 TTL=64 ID=40342 PROTO=UDP SPT=138 DPT=138 LEN=209
Dec 26 23:25:10 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXX SRC=192.168.1.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2
Dec 26 23:27:16 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXX SRC=192.168.1.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2
Dec 26 23:28:19 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXX SRC=192.168.1.205 DST=192.168.1.255 LEN=202 TOS=0x00 PREC=0x00 TTL=64 ID=47054 PROTO=UDP SPT=138 DPT=138 LEN=182
....
Dec 26 23:28:31 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXX SRC=192.168.1.205 DST=192.168.1.255 LEN=78 TOS=0x00 PREC=0x00 TTL=64 ID=47069 PROTO=UDP SPT=137 DPT=137 LEN=58
Dec 26 23:28:32 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXX SRC=192.168.1.205 DST=192.168.1.255 LEN=78 TOS=0x00 PREC=0x00 TTL=64 ID=47072 PROTO=UDP SPT=137 DPT=137 LEN=58
Dec 26 23:28:33 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXXX SRC=192.168.1.205 DST=192.168.1.255 LEN=78 TOS=0x00 PREC=0x00 TTL=64 ID=47073 PROTO=UDP SPT=137 DPT=137 LEN=58
What is this PROTO=2 and 224 address ?
Quote:
Dec 26 23:35:41 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXXX SRC=192.168.1.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2
Also i'm not sure how to add YUM support. i found heremthat it should work on 80 and 443, but doesn't seem so:
Quote:
Dec 27 00:45:41 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXX SRC=193.1.193.67 DST=192.168.1.204 LEN=52 TOS=0x00 PREC=0x00 TTL=51 ID=0 DF PROTO=TCP SPT=80 DPT=36251 WINDOW=17920 RES=0x00 ACK SYN URGP=0
Dec 27 00:46:04 server last message repeated 6 times
Dec 27 00:46:26 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXXX SRC=193.1.193.67 DST=192.168.1.204 LEN=52 TOS=0x00 PREC=0x80 TTL=51 ID=0 DF PROTO=TCP SPT=80 DPT=36251 WINDOW=17920 RES=0x00 ACK SYN URGP=0
Dec 27 00:47:14 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXX SRC=192.168.1.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2
Dec 27 00:48:23 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXXX SRC=192.168.1.205 DST=192.168.1.255 LEN=229 TOS=0x00 PREC=0x00 TTL=64 ID=55863 PROTO=UDP SPT=138 DPT=138 LEN=209
Thank you.

Last edited by DBabo; 12-26-2007 at 11:51 PM.
 
Old 12-26-2007, 11:45 PM   #8
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Quote:
Originally Posted by DBabo View Post
Get better
Thanks.

Quote:
i did checked that IP is the right one, same with the network mask and the other ( win_host) IP.
Cool.

Quote:
Here is the new rules and status from the "Status" command. I'm a bit confused with that allow on 0.0 ( see highlighted in bold):
My guess is its the loopback interface rule. You can check by doing a:
Code:
iptables -nvL
Quote:
Dec 26 23:24:17 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXX SRC=192.168.1.205 DST=192.168.1.204 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=39997 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=512
Dec 26 23:24:22 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXX SRC=192.168.1.205 DST=192.168.1.204 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=40180 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=768
This just says that box 192.168.1.205 sent you an echo request (ping).

Quote:
Dec 26 23:24:26 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXX SRC=192.168.1.205 DST=192.168.1.255 LEN=229 TOS=0x00 PREC=0x00 TTL=64 ID=40342 PROTO=UDP SPT=138 DPT=138 LEN=209
Dec 26 23:25:10 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXX SRC=192.168.1.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2
Dec 26 23:27:16 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXX SRC=192.168.1.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2
Dec 26 23:28:19 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXX SRC=192.168.1.205 DST=192.168.1.255 LEN=202 TOS=0x00 PREC=0x00 TTL=64 ID=47054 PROTO=UDP SPT=138 DPT=138 LEN=182
....
Dec 26 23:28:31 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXX SRC=192.168.1.205 DST=192.168.1.255 LEN=78 TOS=0x00 PREC=0x00 TTL=64 ID=47069 PROTO=UDP SPT=137 DPT=137 LEN=58
Dec 26 23:28:32 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXX SRC=192.168.1.205 DST=192.168.1.255 LEN=78 TOS=0x00 PREC=0x00 TTL=64 ID=47072 PROTO=UDP SPT=137 DPT=137 LEN=58
Dec 26 23:28:33 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXXX SRC=192.168.1.205 DST=192.168.1.255 LEN=78 TOS=0x00 PREC=0x00 TTL=64 ID=47073 PROTO=UDP SPT=137 DPT=137 LEN=58
This is just NetBIOS packets generated by the Windows box.

Quote:
Dec 26 23:35:41 server kernel: INPUT DROP: IN=eth0 OUT= MAC=XXXXX SRC=192.168.1.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2
This is your router doing a multicast. IIRC the "2" is IGMP (I am not sure about this). Perhaps it's misconfigured? In any case, if you don't care about multicast then you don't have anything to worry about. You could add a DROP rule for this if you don't want to have your log file cluttered, though.


Quote:
what if i have a traffic from router and 204 machine goes to the router to the external machine to get the info
Hmmm. Not sure I understand. This might be the perfect time to ask you if you could provide a brief description of just what exactly this box is and what you need it to do. So far I just know it's a server on a LAN. Is it only supposed to be available to LAN clients? Is it allowed to start connections to the LAN? To the WAN? What services are running on it? I've noticed that you seem to "pair up" your INPUT and OUTPUT rules for some reason. This isn't necessary with iptables, and it makes the rules harder to read. You don't need to make an OUTPUT rule for every INPUT rule, or vice versa.

Last edited by win32sux; 12-26-2007 at 11:47 PM.
 
Old 12-27-2007, 10:33 AM   #9
DBabo
Member
 
Registered: Feb 2003
Distribution: Scientific Linux 6
Posts: 384

Original Poster
Rep: Reputation: 33
Quote:
Originally Posted by win32sux View Post
<skip>
Hmmm. Not sure I understand. This might be the perfect time to ask you if you could provide a brief description of just what exactly this box is and what you need it to do. So far I just know it's a server on a LAN. Is it only supposed to be available to LAN clients? Is it allowed to start connections to the LAN? To the WAN? What services are running on it? I've noticed that you seem to "pair up" your INPUT and OUTPUT rules for some reason. This isn't necessary with iptables, and it makes the rules harder to read. You don't need to make an OUTPUT rule for every INPUT rule, or vice versa.
that's simple : one server that has httpd server and should be available to internal and external connections. I prefer to have ssh available only from within internal net. That's it. Nothing really fancy or complicated as you can see.
the reason of that question was - the app on the web server is not coded properly - so when i access it from withing the local net it has references to the "external" name.

The "pairing": i just thought to group them ( rules ) by the protocol/port, which is not the best idea, but it helps me to understand how each protocol works. i never got through this task in such a detailed way, just used shorewall to do the background work.
 
Old 12-27-2007, 06:21 PM   #10
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Quote:
Originally Posted by DBabo View Post
that's simple : one server that has httpd server and should be available to internal and external connections. I prefer to have ssh available only from within internal net. That's it. Nothing really fancy or complicated as you can see.
Great.

Quote:
the reason of that question was - the app on the web server is not coded properly - so when i access it from withing the local net it has references to the "external" name.
I see. Well, this is dependant on the router, not the server.

Quote:
The "pairing": i just thought to group them ( rules ) by the protocol/port, which is not the best idea, but it helps me to understand how each protocol works. i never got through this task in such a detailed way, just used shorewall to do the background work.
I understand. But my concern isn't for the grouping itself - it's for the fact that you are creating unnecessary rules in the first place. For example:
Quote:
Code:
$ipt -A INPUT -p TCP -i eth0 -s $local_net --dport $ssh_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p TCP -d $local_net --dport $ssh_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p TCP -d $local_net --sport $ssh_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
In this case, both of those OUTPUT should be unnecessary, because you sould already have a separate rule to deal with packets in states RELATED or ESTABLISHED. You could use a rule allowing them for this service only (some people do this), but that still leaves us with bogus state NEW matches in the OUTPUT. That NEW is basically punching a hole in the firewall, allowing the SSH daemon to start connections with the LAN - something which doesn't fit the description you've given above (HTTP/S service for everyone, SSH service only for LAN).

Here's a script I've written for you from scratch based on the description you've given above - notice how no --sport rules were necessary, and only one rule for RELATED and ESTABLISHED packets was used per-chain. Also note that the OUTPUT chain contains no matches for packets in state NEW, as your description did not include the server needing to initiate any connections on its own.
Code:
#!/bin/sh


IPT="/sbin/iptables"


$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP

$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P INPUT ACCEPT
$IPT -t mangle -P FORWARD ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
$IPT -t mangle -P POSTROUTING ACCEPT

$IPT -t raw -P PREROUTING ACCEPT
$IPT -t raw -P OUTPUT ACCEPT


$IPT -F
$IPT -F -t nat
$IPT -F -t mangle
$IPT -F -t raw

$IPT -X
$IPT -X -t nat
$IPT -X -t mangle
$IPT -X -t raw

$IPT -Z
$IPT -Z -t nat
$IPT -Z -t mangle
$IPT -Z -t raw


$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

$IPT -A INPUT -i lo -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 --dport 443 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 --dport 80 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 -s 192.168.1.0/24 --dport 22 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -j LOG --log-prefix "INPUT DROP: "


$IPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

$IPT -A OUTPUT -o lo -j ACCEPT

$IPT -A OUTPUT -j LOG --log-prefix "OUTPUT DROP: "

Last edited by win32sux; 12-27-2007 at 07:21 PM.
 
Old 12-27-2007, 09:29 PM   #11
DBabo
Member
 
Registered: Feb 2003
Distribution: Scientific Linux 6
Posts: 384

Original Poster
Rep: Reputation: 33
Quote:
<skip>
I understand. But my concern isn't for the grouping itself - it's for the fact that you are creating unnecessary rules in the first place. For example:In this case, both of those OUTPUT should be unnecessary, because you sould already have a separate rule to deal with packets in states RELATED or ESTABLISHED. You could use a rule allowing them for this service only (some people do this), but that still leaves us with bogus state NEW matches in the OUTPUT. That NEW is basically punching a hole in the firewall, allowing the SSH daemon to start connections with the LAN - something which doesn't fit the description you've given above (HTTP/S service for everyone, SSH service only for LAN).
not trying to be a hard here, but I was thinking about exactly that - allow outbound by SSH, but only for local net... Or i wrote it incorrectly ?
Code:
$ipt -A INPUT -p TCP -i eth0 -s $local_net --dport $ssh_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p TCP -d $local_net --dport $ssh_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p TCP -d $local_net --sport $ssh_port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
Appreciate you writing a script. And a few questions:
all discussed rules explicitly covered www/s and ssh, but i have to allow the dns, ntp and yum to be able to communicate too. I know i didn't mentioned that explicitly - that is the reason to add "NEW" state in the ourbound connections.
thus combining 2 scripts:
Code:
#!/bin/sh

IPT="/sbin/iptables"

ssh_port="22"
dns_port="53"
www_port="80"
ntp_port="123"
wws_port="443"
ora_port="1521"

local_net="192.168.1.0/24"
win_host="192.168.1.205"
_host="192.168.1.204"
router="192.168.1.1"
self_host="127.0.0.1"
any="0.0.0.0/0"

$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP

$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P INPUT ACCEPT
$IPT -t mangle -P FORWARD ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
$IPT -t mangle -P POSTROUTING ACCEPT

$IPT -t raw -P PREROUTING ACCEPT
$IPT -t raw -P OUTPUT ACCEPT


$IPT -F
$IPT -F -t nat
$IPT -F -t mangle
$IPT -F -t raw

$IPT -X
$IPT -X -t nat
$IPT -X -t mangle
$IPT -X -t raw

$IPT -Z
$IPT -Z -t nat
$IPT -Z -t mangle
$IPT -Z -t raw


$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

$IPT -A INPUT -i lo -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 --dport 443 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 --dport 80 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 -s 192.168.1.0/24 --dport 22 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 --dport $ntp_port \
-m state --state NEW -j ACCEPT
$IPT -A INPUT -p TCP -i eth0 --dport $dns_port \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -j LOG --log-prefix "INPUT DROP: "


$IPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

$IPT -A OUTPUT -o lo -j ACCEPT

$IPT -A OUTPUT -o eth0 -dport $www_port -m state --state NEW -j ACCEPT
$IPT -A OUTPUT -o eth0 -dport $ntp_port -m state --state NEW -j ACCEPT
$IPT -A OUTPUT -o eth0 -dport $dns_port -m state --state NEW -j ACCEPT


$IPT -A OUTPUT -j LOG --log-prefix "OUTPUT DROP: "
allowing to establish only new connections on only selected ports...

Does this make sense ?
Thank you

Last edited by DBabo; 12-27-2007 at 09:33 PM.
 
Old 12-27-2007, 10:07 PM   #12
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Quote:
Originally Posted by DBabo View Post
not trying to be a hard here, but I was thinking about exactly that - allow outbound by SSH, but only for local net... Or i wrote it incorrectly ?
Quote:
all discussed rules explicitly covered www/s and ssh, but i have to allow the dns, ntp and yum to be able to communicate too.
Don't worry, I figured you left-out stuff like this in your description.

So basically you'd need to add rules for outgoing SSH connections to your LAN, outgoing HTTP/FTP connections to your WAN, and NTP connections to your WAN. Right? Well, here's an example of how that would look when added to the script:
Code:
#!/bin/sh


IPT="/sbin/iptables"


$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP

$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P INPUT ACCEPT
$IPT -t mangle -P FORWARD ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
$IPT -t mangle -P POSTROUTING ACCEPT

$IPT -t raw -P PREROUTING ACCEPT
$IPT -t raw -P OUTPUT ACCEPT


$IPT -F
$IPT -F -t nat
$IPT -F -t mangle
$IPT -F -t raw

$IPT -X
$IPT -X -t nat
$IPT -X -t mangle
$IPT -X -t raw

$IPT -Z
$IPT -Z -t nat
$IPT -Z -t mangle
$IPT -Z -t raw


$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

$IPT -A INPUT -i lo -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 --dport 443 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 --dport 80 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 -s 192.168.1.0/24 --dport 22 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -j LOG --log-prefix "INPUT DROP: "


$IPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

$IPT -A OUTPUT -o lo -j ACCEPT

$IPT -A OUTPUT -p TCP -o eth0 -d 192.168.1.0/24 --dport 22 \
-m owner --uid-owner dbabo -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -p TCP -o eth0 --dport 80 \
-m owner --uid-owner root -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -p TCP -o eth0 --dport 21 \
-m owner --uid-owner root -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -p UDP -o eth0 --dport 53 \
-m owner --uid-owner root -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -j LOG --log-prefix "OUTPUT DROP: "
There's four rules added - they appear in bold. The first one allows user "dbabo" on the server to start SSH connections to the LAN. If you want him to be able to start SSH connections to the WAN too then remove the "-d 192.168.1.0/24" match. The second, third, and fourth rules allow user "root" (I'm assuming Yum runs as root) to access HTTP, FTP, and DNS servers (respectively) on the WAN and LAN.

What about NTP? Well, that depends on how you've got NTP set up. Is this box the NTP server for clients on the LAN? Or does it just synchronize for itself and nobody else? What user does your NTP daemon run as? Does it synchronize to a server on the WAN or LAN?

Last edited by win32sux; 12-27-2007 at 10:16 PM.
 
Old 12-27-2007, 10:17 PM   #13
DBabo
Member
 
Registered: Feb 2003
Distribution: Scientific Linux 6
Posts: 384

Original Poster
Rep: Reputation: 33
Quote:
<skip>
What about NTP? Well, that depends on how you've got NTP set up. Is this box the NTP server for clients on the LAN? Or does it just synchronize for itself and nobody else? What user does your NTP daemon run as?
just a simple synchronization with whatever i'm getting from pool.ntp.whatever.the.address.is.org

and : the output on 80/22:
it will/might have more then just one user-id: i can try to wget or/and ssh to as regular user, might do yum as root and run apache as "apache" user... not sure how that would work..

Last edited by DBabo; 12-27-2007 at 10:21 PM.
 
Old 12-27-2007, 10:55 PM   #14
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Quote:
Originally Posted by DBabo View Post
just a simple synchronization with whatever i'm getting from pool.ntp.whatever.the.address.is.org
Okay, well, then a rule something like this would be in order:
Code:
iptables -A OUTPUT -p UDP -o eth0 --dport 123 \
-m owner --uid-owner ntp -m state --state NEW -j ACCEPT
This assumes your NTP daemon runs as user "ntp". Also, notice that the rule does NOT allow it to connect to the LAN. Oh, and I think you'd need a rule allowing incoming connections to your NTP daemon also, right? Then:
Code:
iptables -A INPUT -p UDP -i eth0 --dport 123 \
-m state --state NEW -j ACCEPT
I do think the incoming connection in these situations should always come from port 123. If that's the case, then you should definitely make the rule more specific, like:
Code:
iptables -A INPUT -p UDP -i eth0 --dport 123 --sport 123 \
-m state --state NEW -j ACCEPT

Quote:
and : the output on 80/22:
it will/might have more then just one user-id: i can try to wget or/and ssh to as regular user
No problem at all, just copy/paste the relevant rules and edit the username. Remember, you'll only need to use OUTPUT rules for this - no edits or additions need to be made to the INPUT chain for this.

Quote:
might do yum as root
I don't think there's much of a choice there.

Quote:
and run apache as "apache" user... not sure how that would work..
Yeah, Apache should definitely be running as "apache". But there is no need for any OUTPUT rules for it unless you need it to start outgoing connections. Do you? Because if you don't, I'd suggest leaving the rules as they are. That way if your Apache install gets exploited, the attacker won't be able to use it to attack your LAN/WAN (unless he rooted the box).


EDIT: On second thought, having specific rules for root might now be the best approach. I mean, if an attacker gets root you're pretty much screwed anyway (barring mandatory access controls). So I'd probably just replace these rules:
Code:
$IPT -A OUTPUT -p TCP -o eth0 --dport 80 \
-m owner --uid-owner root -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -p TCP -o eth0 --dport 21 \
-m owner --uid-owner root -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -p UDP -o eth0 --dport 53 \
-m owner --uid-owner root -m state --state NEW -j ACCEPT
With this one rule:
Code:
$IPT -A OUTPUT -m owner --uid-owner root \
-m state --state NEW -j ACCEPT
Now root can connect to anything he/she pleases, and you don't need to worry about adding any more rules for root.

For clarity's sake, here's an example script with all this incorporated:
Code:
#!/bin/sh


IPT="/sbin/iptables"
LAN="192.168.1.0/24"


$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP

$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P INPUT ACCEPT
$IPT -t mangle -P FORWARD ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
$IPT -t mangle -P POSTROUTING ACCEPT

$IPT -t raw -P PREROUTING ACCEPT
$IPT -t raw -P OUTPUT ACCEPT


$IPT -F
$IPT -F -t nat
$IPT -F -t mangle
$IPT -F -t raw

$IPT -X
$IPT -X -t nat
$IPT -X -t mangle
$IPT -X -t raw

$IPT -Z
$IPT -Z -t nat
$IPT -Z -t mangle
$IPT -Z -t raw


$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

$IPT -A INPUT -i lo -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 --dport 443 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 --dport 80 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 -s $LAN --dport 22 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -p UDP -i eth0 --dport 123 --sport 123 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -p ICMP -i eth0 -s $LAN --icmp-type 8 ! --fragment \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -j LOG --log-prefix "INPUT DROP: "


$IPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

$IPT -A OUTPUT -o lo -j ACCEPT

$IPT -A OUTPUT -p TCP -o eth0 -m multiport --dports 21,22,80 \
-m owner --uid-owner dbabo -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -p UDP -o eth0 --dport 53 \
-m owner --uid-owner dbabo -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -p TCP -o eth0 -d $LAN --dport 22 \
-m owner --uid-owner foobar -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -p UDP -o eth0 --dport 123 \
-m owner --uid-owner ntp -m state --state NEW -j ACCEPT

# If NTP needs to do DNS lookups then uncomment this:
#$IPT -A OUTPUT -p UDP -o eth0 --dport 53 \
#-m owner --uid-owner ntp -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -m owner --uid-owner root \
-m state --state NEW -j ACCEPT

$IPT -A OUTPUT -j LOG --log-prefix "OUTPUT DROP: "
Note that in this example I added a rule allowing your server to be pinged by hosts on the LAN, as that is usually a good idea. I also gave user "dbabo" full access (WAN/LAN) to ports 21 (FTP), 22 (SSH), and 80 (HTTP), while user "foobar" only has access to SSH services on the LAN.

Last edited by win32sux; 12-28-2007 at 12:51 AM.
 
Old 12-28-2007, 01:16 AM   #15
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
I do realize that these type of rules can be kinda tedious to implement when you aren't used to them. So here's a somewhat simpler example. In theory, this script should "just work" for you. Although this example is a lot less tighter than the one above, it still tries to minimize the impact which a user-level server compromise (Apache, for example) would have on the LAN.
Code:
#!/bin/sh


IPT="/sbin/iptables"
LAN="192.168.1.0/24"


$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP

$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P INPUT ACCEPT
$IPT -t mangle -P FORWARD ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
$IPT -t mangle -P POSTROUTING ACCEPT

$IPT -t raw -P PREROUTING ACCEPT
$IPT -t raw -P OUTPUT ACCEPT


$IPT -F
$IPT -F -t nat
$IPT -F -t mangle
$IPT -F -t raw

$IPT -X
$IPT -X -t nat
$IPT -X -t mangle
$IPT -X -t raw

$IPT -Z
$IPT -Z -t nat
$IPT -Z -t mangle
$IPT -Z -t raw


$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

$IPT -A INPUT -i lo -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 -m multiport --dports 80,443 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -p TCP -i eth0 -s $LAN --dport 22 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -p UDP -i eth0 --dport 123 --sport 123 \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -p ICMP -i eth0 -s $LAN --icmp-type 8 ! --fragment \
-m state --state NEW -j ACCEPT

$IPT -A INPUT -d 224.0.0.1 -j DROP

$IPT -A INPUT -j LOG --log-prefix "INPUT DROP: "


$IPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

$IPT -A OUTPUT -o lo -j ACCEPT

$IPT -A OUTPUT -p TCP -o eth0 -m multiport --dports 21,80,443 \
-d ! $LAN -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -p UDP -o eth0 -m multiport --dports 53,123 \
-d ! $LAN -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -m owner --uid-owner dbabo \
-m state --state NEW -j ACCEPT

$IPT -A OUTPUT -m owner --uid-owner root \
-m state --state NEW -j ACCEPT

$IPT -A OUTPUT -j LOG --log-prefix "OUTPUT DROP: "
Keep in mind that starting SSH connections from a public server such as this is probably not a good idea. If the server has been compromised before you SSH into it, then whatever SSH connections you start from it could be easily compromised as well.

Last edited by win32sux; 12-28-2007 at 09:53 PM. Reason: Added multicast DROP rule to reduce log clutter.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables seem to only sort of work... MrSako Linux - Security 24 08-29-2006 07:41 PM
Don't work iptables -j ScanD... NightSoul Linux - Software 2 04-28-2006 01:10 PM
iptables doesn't work with me Agent007 Linux - Networking 4 01-23-2004 07:14 AM
IPTABLES doesn't work!!! help... saruman666 Linux - Networking 11 08-16-2003 04:15 PM
IPTables doesn't seem to work X11 Linux - Software 7 07-08-2002 12:39 AM


All times are GMT -5. The time now is 06:16 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration