Problem installing firewall

phantom_cyph · 12-01-2008, 09:09 AM

Outbound: http, https, ftp, 5050, 5190, 6667, 22.

If you could comment out a line containing what is needed for a bittorrent client, with like "xxxxx" in place of the port number so I when I know what my client uses I can put that in. I used to use qtorrent, but I don't have qt. Probably going with a text-based client this time.

Thanks for the help!

win32sux · 12-01-2008, 10:24 AM

Quote:

Originally Posted by phantom_cyph

Outbound: http, https, ftp, 5050, 5190, 6667, 22.

If you could comment out a line containing what is needed for a bittorrent client, with like "xxxxx" in place of the port number so I when I know what my client uses I can put that in. I used to use qtorrent, but I don't have qt. Probably going with a text-based client this time.

Thanks for the help!

This rc.firewall script should be enough to get you started (you can always tighten it down further):

Code:

#!/bin/sh

IPT="/usr/sbin/iptables"

$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP

$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P INPUT ACCEPT
$IPT -t mangle -P FORWARD ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
$IPT -t mangle -P POSTROUTING ACCEPT

$IPT -t raw -P PREROUTING ACCEPT
$IPT -t raw -P OUTPUT ACCEPT

$IPT -F
$IPT -F -t nat
$IPT -F -t mangle
$IPT -F -t raw

$IPT -X
$IPT -X -t nat
$IPT -X -t mangle
$IPT -X -t raw

$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p TCP -i eth0 --dport 6881 --syn -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -o lo -j ACCEPT
$IPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p UDP -o eth0 --dport 53 -m state --state NEW -j ACCEPT
$IPT -A OUTPUT -p TCP -o eth0 -m multiport --dports 21,22,80,443,5050,5190,6667 \
-m state --state NEW -j ACCEPT

A couple things to think about: It's a good idea to specify the IPs of the DNS server(s) instead of just allowing all outbound UDP packets with destination port 53. To do that, just replace the UDP/53 rule with a couple rules like (for example):

Code:

$IPT -A OUTPUT -p UDP -o eth0 --dport 53 -d 208.67.222.222 \
-m state --state NEW -j ACCEPT
$IPT -A OUTPUT -p UDP -o eth0 --dport 53 -d 208.67.220.220 \
-m state --state NEW -j ACCEPT

Also, keep in mind that restricting the outbound connections to the set of ports you posted would likely hinder BitTorrent. BTW, as you can see this doesn't use the "start|stop" thing but if you need that it can be easily added.

phantom_cyph · 12-01-2008, 11:27 AM

Okay...I took what you gave me and added the start/stop feature. Everything can be seen here:

Code:

#!/bin/sh
IPT="/usr/sbin/iptables"
start() {
echo "Now starting your firewall..."

$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP

$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P INPUT ACCEPT
$IPT -t mangle -P FORWARD ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
$IPT -t mangle -P POSTROUTING ACCEPT

$IPT -t raw -P PREROUTING ACCEPT
$IPT -t raw -P OUTPUT ACCEPT

$IPT -F
$IPT -F -t nat
$IPT -F -t mangle
$IPT -F -t raw

$IPT -X
$IPT -X -t nat
$IPT -X -t mangle
$IPT -X -t raw

$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p TCP -i eth0 --dport 6881 --syn -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -o lo -j ACCEPT
$IPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p UDP -o eth0 --dport 53 -m state --state NEW -j ACCEPT
$IPT -A OUTPUT -p TCP -o eth0 -m multiport --dports 21,22,80,443,5050,5190,6667 \
-m state --state NEW -j ACCEPT
}
stop() {
    echo "Stopping firewall"
    $IPT -F
    $IPT -P INPUT ACCEPT
    $IPT -P FORWARD ACCEPT
    $IPT -P OUTPUT ACCEPT
    echo
}
case "$1" in
    start)
    start
    ;;
    stop)
    stop
    ;;
    restart)
    stop
    start
    ;;
esac

internetSurfer · 12-01-2008, 08:43 PM

Quote:

Originally Posted by win32sux

(you can always tighten it down further):

Extra Info:

Fwbuilder 3.0.2
http://www.slacky.eu/index.php?optio...9190&Itemid=65

_

baig · 12-04-2008, 03:00 AM

I just tired to run the above script sh script.sh, nothing!! not even any complain, or any thing.. being a user I should know what is wrong:-). I added some guide lines to a bigger like me..

Are these settings useful for me?

I don't want any connection form out side world on eth0 and want to share everything with eth1(I have two LAN Cards ) please help me out.

Code:

#! /bin/bash

clear

if [ $# -ne 1 ];then
echo
echo "Usage is(e.g): sh script.sh start or stop. "
exit 1
else
echo
echo "Type in your iptables path: e.g: /usr/sbin/iptables or /sbin/iptables"
read IPT
fi

start() {
echo "Now starting your firewall..."

$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP

$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P INPUT ACCEPT
$IPT -t mangle -P FORWARD ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
$IPT -t mangle -P POSTROUTING ACCEPT

$IPT -t raw -P PREROUTING ACCEPT
$IPT -t raw -P OUTPUT ACCEPT

$IPT -F
$IPT -F -t nat
$IPT -F -t mangle
$IPT -F -t raw

$IPT -X
$IPT -X -t nat
$IPT -X -t mangle
$IPT -X -t raw

$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p TCP -i eth1 --dport 6881 --syn -m state --state NEW -j ACCEPT

$IPT -A OUTPUT -o lo -j ACCEPT
$IPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p UDP -o eth0 --dport 53 -m state --state NEW -j ACCEPT
$IPT -A OUTPUT -p TCP -o eth0 -m multiport --dports 21,22,80,443,5050,5190,6667 -m state --state NEW -j ACCEPT
echo
$IPT -L
echo
echo
echo "Firewall Started Successfully"

}
stop() {
    echo "Stopping firewall"
    $IPT -F
    $IPT -P INPUT ACCEPT
    $IPT -P FORWARD ACCEPT
    $IPT -P OUTPUT ACCEPT
    $IPT -L
    echo "Firewall stoped."
    echo 
    
}
case "$1" in
    start)
    start
    ;;
    stop)
    stop
    ;;
    restart)
    stop
    start
    ;;
esac

And in my case /user/sbin/iptables not found.. /sbin/iptables found.

Drpeter · 12-04-2008, 03:12 AM

I am trying to block USB port so that it may not detect the driver in Linux Ubuntu but I am not in a position so help me on how to go about it.
http://myspace.com/peterguni
or http://peterguni.faithweb.com

Thank you hope you will respond on this thank you guys

win32sux · 12-04-2008, 09:34 AM

Quote:

Originally Posted by Drpeter

I am trying to block USB port so that it may not detect the driver in Linux Ubuntu but I am not in a position so help me on how to go about it.
http://myspace.com/peterguni
or http://peterguni.faithweb.com

Thank you hope you will respond on this thank you guys

Drpeter, don't ever hijack a fellow member's thread like this again. It's insanely rude and completely unacceptable. You already had a thread asking this when you posted, which makes it even worse. If you have any questions or comments regarding this matter, you are welcome to contact me via email - do NOT use this thread. @Everyone: Please don't let this throw you off-topic.

dguitar · 12-04-2008, 06:02 PM

I'm surprised no one mentioned alienBob's firewall script maker. Which can be found here. The best firewall 'option' for Slackware (imo) without having to learn ALL about IPtables.

baig · 12-04-2008, 07:50 PM

@ Above

Thanks for this fantastic piece of link.

A very helpful and easy firewall config script..

Being a Fedora user I had to replace /usr/sbin/iptables

to /sbin/iptables..

all worked fine..

Cheers!!

ProtoformX · 12-04-2008, 08:22 PM

I'm surprised that none of the rules in this entire thread use ESTABLISHED,RELATED flags for ports you don't need open all the time, I know it's not the best method but it works. Here s an example of mean.

Quake 3 needs certain ports open to talk to the master server, if you make first contact then the ports open, if you don't make any attempt to contact the master server then the ports are closed until you make first contact.

Also for a more secure setup you could setup a port knocking system for "hot" ports such as 22, 23..etc

You could reduce the tcp timeouts, enable syn flooding to slow down DoSing just make sure that you don't touch anything to do ACK, if you are running a desktop and don't care about server daemons then you can change the ACK settings as well.

You can fine tune the tcp/ip settings a lot more, but these are just some basic examples.

win32sux · 12-04-2008, 08:31 PM

Quote:

Originally Posted by ProtoformX

I'm surprised that none of the rules in this entire thread use ESTABLISHED,RELATED flags for ports you don't need open all the time, I know it's not the best method but it works. Here s an example of mean.

Quake 3 needs certain ports open to talk to the master server, if you make first contact then the ports open, if you don't make any attempt to contact the master server then the ports are closed until you make first contact.

Not sure what you mean, the script I posted used RELATED and ESTABLISHED matches for both inbound and outbound packets. Could you elaborate?

Quote:

enable syn flooding to slow down DoSing

I think what you meant was "enable SYN cookies to prevent SYN flooding".

Code:

echo 1 > /proc/sys/net/ipv4/tcp_syncookies

ProtoformX · 12-04-2008, 10:50 PM

Quote:

Originally Posted by win32sux

Not sure what you mean, the script I posted used RELATED and ESTABLISHED matches for both inbound and outbound packets. Could you elaborate?

I think what you meant was "enable SYN cookies to prevent SYN flooding".

Code:

echo 1 > /proc/sys/net/ipv4/tcp_syncookies

No if you reduce the TCP timeouts you can reduce DoSing, if you see that there is a comma and not a period you realize you are only to referring to one option I suggested.

echo "Kill timestamps"
echo 0 > /proc/sys/net/ipv4/tcp_timestamps

echo "Reducing DoS'ing ability by reducing timeouts"
echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
echo 2400 > /proc/sys/net/ipv4/tcp_keepalive_time
echo 0 > /proc/sys/net/ipv4/tcp_window_scaling
echo 0 > /proc/sys/net/ipv4/tcp_sack
echo "Done..."

win32sux · 12-04-2008, 11:29 PM

Quote:

Originally Posted by ProtoformX

if you see that there is a comma and not a period you realize you are only to referring to one option I suggested.

Right, because that suggestion was to "enable SYN flooding", which doesn't make sense.