LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
LinkBack Search this Thread
Old 08-26-2003, 04:57 PM   #1
1jamie
LQ Newbie
 
Registered: Aug 2003
Location: NZ
Distribution: redhat 9
Posts: 15

Rep: Reputation: 0
Question Testing IPTABLES Firewall


Hello I have a query I'd appreciate if you guys could help me with. I want to thoroughly TEST A FIREWALL I've built.

I've blocked off all incoming ports (INPUT) except 22 and 80 (the firewall's running apache) and it will only FORWARD port 80, 22, 25, 443. All output is accepted.

I've done some port scanning using nmap both from the outside and from within. Looks good.

Is there any other way I can test the firewall coz I've got 3 or 4 windows clients behind it and I want to make sure they aren't drawing unwanted traffic back inside. I'm only allowing incoming packets to be forwarded that are part of an established connection over ports 80, 25, 443 and 22.

Cheers

jamie (NZ)
 
Old 08-26-2003, 09:38 PM   #2
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
Check out nessus:

www.nessus.org
 
Old 08-26-2003, 09:41 PM   #3
tarballedtux
Member
 
Registered: Aug 2001
Location: Off the coast of Madadascar
Posts: 498

Rep: Reputation: 30
So are you saying form the internal perspective. Only connections going to ports 22, 25, 80, 443. Get out onto the internet? Thats a start as that prevents some potentionly bad stuff from going on. Like IRC trojans trying to phone home, or spyware and/or legit software phoning home to some arbitrary port. Only allowing 22 and 80 into your server is good as long as you further secure those services. Maybe only allow SSH connections from specific IPs and certain users. Think about possibly chrooting that apache daemon. Someone on here can help you with that or look it up.


--tarballedtux
 
Old 08-27-2003, 04:09 PM   #4
1jamie
LQ Newbie
 
Registered: Aug 2003
Location: NZ
Distribution: redhat 9
Posts: 15

Original Poster
Rep: Reputation: 0
Hey thanks guys for your input, it's going be really useful. I was going to use firewall tester and I'll check out that nessus stuff too.

I remotely connect to this network to administer it. I have a dial up connection so my IP address changes every time. So I can't restrict access to ssh to certain IP addresses, right?

Once again thanks for your input,

Jamie (NZ)
 
Old 08-27-2003, 06:29 PM   #5
tarballedtux
Member
 
Registered: Aug 2001
Location: Off the coast of Madadascar
Posts: 498

Rep: Reputation: 30
If the IP you connect from to adminster it never changes then you can restrict access.

Just make a rule like so:

IPTABLES -A INPUT -s <ip of where you're administering your network from> -p tcp --dport 22 -j ACCEPT
IPTABLES -A INPUT -p tcp --dport 22 -j DENY #Or just let your final DENY ALL rule handle it.


--tarballedtux
 
Old 08-28-2003, 07:23 AM   #6
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,769
Blog Entries: 1

Rep: Reputation: 410Reputation: 410Reputation: 410Reputation: 410Reputation: 410
Quote:
So I can't restrict access to ssh to certain IP addresses, right?
You might not be able to restrict ssh by IP address, but you CAN restrict ssh by user. In the sshd_conf file there is an AllowUsers line. Just list the users you want to have ssh access and it won't matter what IP address they are coming from.
 
Old 08-28-2003, 08:17 AM   #7
ppuru
Senior Member
 
Registered: Mar 2003
Location: Beautiful BC
Distribution: RedHat & clones, Slackware, SuSE, OpenBSD
Posts: 1,791

Rep: Reputation: 46
Adding to HangDog42's post

You can use tcpwrappers to restrict access to sshd by ipaddress

e.g. in /etc/hosts.allow

sshd: 172.16.254.100 192.168.21.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Iptables with iptables-firewall.conf arno's matt3333 Slackware 16 06-28-2007 07:20 AM
iptables testing program metallica1973 Linux - Security 7 04-29-2005 09:50 PM
iptables vs. rc.firewall FiveFlat Linux - Security 2 08-13-2004 03:39 PM
IPTABLES firewall Vs rc firewall netguy2000 Linux - Security 7 02-28-2004 04:31 AM
Need Help with Firewall, iptables!!!! jamesws Linux - Networking 2 02-11-2002 05:56 PM


All times are GMT -5. The time now is 08:49 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration