iptables am i on the right way ?

prixone · 03-28-2008, 09:53 AM

hi,

I am making a file with rules to secure what i have here and i would like to know if you guys could spot my mistakes and also help me out to make this file on what i am still learning.

i have 2 network cards eth0 that holds the local network and eth1 that holds the internet and the real ips.

eth0 = 192.168.0.0/24
eth1 = 200.xxx.xxx.253/255.255.255.240
eth1:1 = 200.xxx.xxx.252/255.255.255.240
eth1:2 = 200.xxx.xxx.251/255.255.255.240

This machine is called firewall and it has the follow services:
DNS, MAIL, MYSQL(local network), SSH(external access)

From the local network i have some softwares that need access to the internet, they use the ports tcp 2136, tcp 2631, udp 2631, tcp 3007, tcp 137, tcp 10000, tcp 3057. i am not quiet sure on how to create this rules because the software is installed into a machine from the internal network and i am not sure if the program will reply back so what rules i would need in this case to allow any machine within the internal network to talk with this program tru the internet.

Besides those i need to redirect the ports 80 and 8080 to an internal ip that holds the websever on the ip 192.168.0.4 and also redirect the port 4000 to the MTSC access to this server.

I would appreciate if you guys could help me out on this.

Here is the firewall i have so far:

Code:

#!/bin/bash

# IPTables
IPT=`which iptables`;

# modprobe
MODP=`which modprobe`;

# Internal interface
IF_INT="eth0";

# External interface
IF_EXT="eth1";

# External ip
IP_EXT="200.xxx.xxx.253" # eth1 itself
IP_ALIAS="200.xxx.xxx.252" # Alias of eth1:2
IP_ALIAS2="200.xxx.xxx.251" # Alias of eth1:1

# External Network
EX_NETWORK="200.xxx.xxx.0/255.255.255.240";

# Internal Network
INT_NETWORK="192.168.0.0/24"

# Internal IP (Firewall)
IP_INT="192.168.0.24";

fw_start()
{
  # -----------------------------------------------------------------
  # Default rules
  # -----------------------------------------------------------------
  $IPT -P INPUT   DROP 
  $IPT -P OUTPUT  DROP
  $IPT -P FORWARD DROP

  # -----------------------------------------------------------------
  # Load modules
  # -----------------------------------------------------------------
  $MODP ip_nat_ftp
  $MODP ip_conntrack
  $MODP ip_conntrack_ftp
  $MODP ipt_REJECT
  $MODP ipt_LOG
  $MODP ipt_MASQUERADE
  $MODP ipt_state
  $MODP ipt_mac
  $MODP ipt_mark
  $MODP ipt_MARK
  $MODP iptable_nat
  $MODP ipt_multiport
  $MODP ipt_owner
  $MODP ipt_state
  $MODP ipt_tos
  $MODP iptable_mangle
  $MODP ipt_limit
  $MODP ip_tables

  echo 1 > /proc/sys/net/ipv4/ip_forward
  echo "5 4 1 7" > /proc/sys/kernel/printk

  # -----------------------------------------------------------------
  # Enable loopback traffic
  # -----------------------------------------------------------------
  $IPT -A INPUT   -i lo -j ACCEPT
  $IPT -A OUTPUT  -o lo -j ACCEPT

  # -----------------------------------------------------------------
  # Spoofing
  # -----------------------------------------------------------------
  echo 1 > /proc/sys/net/ipv4/conf/lo/rp_filter
  echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter
  echo 1 > /proc/sys/net/ipv4/conf/eth1/rp_filter

  # ---------------------------------------------------------------------------------------
  # SYN flood
  # ---------------------------------------------------------------------------------------
  echo 1 > /proc/sys/net/ipv4/tcp_syncookies
  echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses 

  # -----------------------------------------------------------------
  # Enable internal network traffic
  # -----------------------------------------------------------------

  $IPT -t filter -A INPUT   -i lo -j ACCEPT
  $IPT -t filter -A INPUT   -i $IF_INT -j ACCEPT
  $IPT -t filter -A FORWARD -i $IF_INT -j ACCEPT
  $IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  $IPT -t nat -A POSTROUTING -o $IF_INT -j MASQUERADE
  $IPT -t nat -A PREROUTING -i $IF_EXT -d $INT_NETWORK -j ACCEPT

  # ---------------------------------------------------------------------------------------
  # Proxy Squid
  # ---------------------------------------------------------------------------------------
  $IPT -t nat -A PREROUTING -i $IF_EXT -p tcp --dport 80 -j REDIRECT --to-port 3128

  # ---------------------------------------------------------------------------------------
  # Restrict squid to the local network only
  # ---------------------------------------------------------------------------------------
  $IPT -A INPUT -i $IF_EXT -p tcp -s 0/0 --sport 1024:65535 -d $IP_EXT --dport 3128 -j DROP

  # ---------------------------------------------------------------------------------------
  # Enable total access to the network from ip X 
  # ---------------------------------------------------------------------------------------
  # $IPT -A INPUT  -i $IF_INT -s X -j ACCEPT
  # $IPT -A OUTPUT -o $IF_INT -d X -j ACCEPT

  # ---------------------------------------------------------------------------------------
  # Enable icmp to and from our local network
  # ---------------------------------------------------------------------------------------
  $IPT -A INPUT -p icmp --icmp-type 8 -s 0/0 -d $INT_NETWORK -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
  $IPT -A OUTPUT -p icmp --icmp-type 0 -s $INT_NETWORK -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
  $IPT -A OUTPUT -p icmp --icmp-type 8 -s $INT_NETWORK -d 0/0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
  $IPT -A INPUT -p icmp --icmp-type 0 -s 0/0 -d $INT_NETWORK -m state --state ESTABLISHED,RELATED -j ACCEPT

  # ---------------------------------------------------------------------------------------
  # DoS, NetBus, Ping, Port Scaner, Back Orifice
  # ---------------------------------------------------------------------------------------
  # Back Orifice
  $IPT -A INPUT -p tcp --dport 31337 -j DROP
  $IPT -A INPUT -p udp --dport 31337 -j DROP
  $IPT -A INPUT -p tcp --dport 33435 -j LOG --log-prefix "BackOrifice"

  # NetBus
  $IPT -A INPUT -p tcp --dport 12345:12346 -j DROP
  $IPT -A INPUT -p udp --dport 12345:12346 -j DROP
  $IPT -A INPUT -p tcp --dport 12345 -j LOG --log-prefix "Netbus"
  $IPT -A INPUT -p tcp --dport 12346 -j LOG --log-prefix "NetBus"   

  # Ping
  $IPT -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT 
  
  # Port Scanners
  $IPT -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

  # ---------------------------------------------------------------------------------------
  # Internet access
  # ---------------------------------------------------------------------------------------
  $IPT -A INPUT -m state --state ESTABLISHED,RELATED -i $IF_EXT -j ACCEPT
  $IPT -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -o $IF_EXT -j ACCEPT

  # -----------------------------------------------------------------
  # Packet flood
  # -----------------------------------------------------------------
  $IPT -A INPUT   -j BLOCK
  $IPT -A FORWARD -j BLOCK
}

fw_stop()
{
  $IPT -t filter -P INPUT       ACCEPT
  $IPT -t filter -P FORWARD     ACCEPT
  $IPT -t filter -P OUTPUT      ACCEPT
  $IPT -t nat    -P PREROUTING  ACCEPT
  $IPT -t nat    -P POSTROUTING ACCEPT
  $IPT -t nat    -P OUTPUT      ACCEPT
  $IPT -t mangle -P PREROUTING  ACCEPT
  $IPT -t mangle -P POSTROUTING ACCEPT
  $IPT -t mangle -P OUTPUT      ACCEPT
  $IPT -t mangle -P INPUT       ACCEPT
  $IPT -t mangle -P FORWARD     ACCEPT
  $IPT -t filter -F
  $IPT -t nat    -F
  $IPT -t mangle -F
  $IPT -t filter -X
  $IPT -t nat    -X
  $IPT -t mangle -X
  $IPT -t filter -Z
  $IPT -t nat    -Z
  $IPT -t mangle -Z
}

fw_usage()
{
  echo
  echo "$0 (start | stop | restart | clear)"
  echo
  echo "start   - Start the firewall"
  echo "stop    - Stop the firewall"
  echo "restart - Restart the firewall"
  echo "clear   - Clean the counters"
}

fw_clear()
{
  $IPT -t filter -Z
  $IPT -t nat    -Z
  $IPT -t mangle -Z
}

case $1 in

  start)
     fw_start;
  ;;

  stop)
     fw_stop;
  ;;

  restart)
    fw_stop;
    fw_start;
  ;;

  clear)
     fw_clear;
  ;;
  *)
     fw_usage;
     exit;

  ;;

esac

adam_blackice · 03-30-2008, 09:01 PM

hmm the script in general looks good , if you want your application that located at the inside network to be active to the internet you should have a look at the NAT table from documents here .. http://www.netfilter.org/documentati...entation-howto
Good Luck . .

zmanea · 03-30-2008, 10:18 PM

Start it up and see if it works. I would suggest adding some echos before each group of commands, that way if you have a problem you know approximately where the problem is, IE:

Echo "PROXY SQUID RULES"

mlp68 · 03-31-2008, 01:03 AM

Let me add something that tends to save me when I think a connection should go through but doesn't. Instead of just "DROP", I create a new chain "LOG_AND_DROP". All "DROP" targets get replaced with "LOG_AND_DROP". That chain then gets

-A LOG_AND_DROP -j LOG --log-level info --log-prefix dropped-packet:
-A LOG_AND_DROP -j DROP

and I usually have the first line commented out. As shown above, it will add an entry to the syslog for each packet that get gets dropped, and you will be able to see what's going on. In a busy network with a high drop rate this can lead to a lot of messages in the syslog, that's why I have it switched off mostly and activate the line only when I need to debug my firewall settings.

Having it sitting there ready to be activated by removing the comment is also nice if you have to activate in a hurry, when you think that you are getting scanned or attacked and need to log the activity.

Hope it helps a bit,

mlp

prixone · 04-03-2008, 06:01 PM

Quote:

#!/bin/bash

# IPTables
IPT=`which iptables`;

# modprobe
MODP=`which modprobe`;

# insmod
INSMOD=`which insmod`;

# depmod
DEPMOD=`which depmod`;

# lsmod
LSMOD=`which lsmod`;

# grep
GREP=`which grep`;

# awk
AWK=`which awk`;

# Internal interface
IF_INT="eth0";

# External interface
IF_EXT="eth1";

# External ip
IP_EXT="200.xxx.xxx.253" # eth1 itself
IP_ALIAS="200.xxx.xxx.252" # Alias of eth1:2
IP_ALIAS2="200.xxx.xxx.254" # Alias of eth1:1

# External Network
EX_NETWORK="200.xxx.xxx.0/255.255.255.240";

# Internal Network
INT_NETWORK="192.168.0.0/24"

# Internal IP (Firewall)
IP_INT="192.168.0.24"

# Internal IIS
IP_WEB="192.168.0.4"

# Internal DB
IP_DB="192.168.0.96"

ALL="0.0.0.0/0"

echo " ---"

fw_start()
{
echo " ---"
echo " External network card: $IF_EXT"
echo " Internal network card: $IF_INT"
echo " ---"
echo " IP: $IP_EXT"
echo " IP ALIAS: $IP_ALIAS"
echo " IP ALIAS2: $IP_ALIAS2"
echo " ---"
echo " External Network: $EX_NETWORK"
echo " Internal Network: $INT_NETWORK"
echo " ---"
echo " Firewall ip: $IP_INT"
echo " Intenal web: $IP_WEB"
echo " Internal db: $IP_DB"
echo " ---"
echo " - Verify if all the kernel modules are ok"
$DEPMOD -a

echo -en " Loading kernel modules: "

echo -en "ipt_REJECT, "
if [ -z "` $LSMOD | $GREP ipt_REJECT | $AWK {'print $1'} `" ]; then
$INSMOD ipt_REJECT
fi

echo -e "ipt_LOG, "
if [ -z "` $LSMOD | $GREP ipt_LOG | $AWK {'print $1'} `" ]; then
$INSMOD ipt_LOG
fi

echo -e "ipt_MASQUERADE, "
if [ -z "` $LSMOD | $GREP ipt_MASQUERADE | $AWK {'print $1'} `" ]; then
$INSMOD ipt_MASQUERADE
fi

echo -e "ipt_state, "
if [ -z "` $LSMOD | $GREP ipt_state | $AWK {'print $1'} `" ]; then
$INSMOD ipt_state
fi

echo -e "ipt_mac, "
if [ -z "` $LSMOD | $GREP ipt_mac | $AWK {'print $1'} `" ]; then
$INSMOD ipt_mac
fi

echo -e "ipt_mark, "
if [ -z "` $LSMOD | $GREP ipt_mark | $AWK {'print $1'} `" ]; then
$INSMOD ipt_mark
fi

echo -e "ipt_MARK, "
if [ -z "` $LSMOD | $GREP ipt_MARK | $AWK {'print $1'} `" ]; then
$INSMOD ipt_MARK
fi

echo -e "ipt_multiport, "
if [ -z "` $LSMOD | $GREP ipt_multiport | $AWK {'print $1'} `" ]; then
$INSMOD ipt_multiport
fi

echo -e "ipt_owner, "
if [ -z "` $LSMOD | $GREP ipt_owner | $AWK {'print $1'} `" ]; then
$INSMOD ipt_owner
fi

echo -e "ipt_state, "
if [ -z "` $LSMOD | $GREP ipt_state | $AWK {'print $1'} `" ]; then
$INSMOD ipt_state
fi

echo -e "ipt_tos, "
if [ -z "` $LSMOD | $GREP ipt_tos | $AWK {'print $1'} `" ]; then
$INSMOD ipt_tos
fi

echo -e "ipt_limit, "
if [ -z "` $LSMOD | $GREP ipt_limit | $AWK {'print $1'} `" ]; then
$INSMOD ipt_limit
fi

echo -en "ip_conntrack, "
if [ -z "` $LSMOD | $GREP ip_conntrack | $AWK {'print $1'} `" ]; then
$INSMOD ip_conntrack
fi

echo -e "ip_conntrack_ftp, "
if [ -z "` $LSMOD | $GREP ip_conntrack_ftp | $AWK {'print $1'} `" ]; then
$INSMOD ip_conntrack_ftp
fi

echo -e "ip_conntrack_irc, "
if [ -z "` $LSMOD | $GREP ip_conntrack_irc | $AWK {'print $1'} `" ]; then
$INSMOD ip_conntrack_irc
fi

echo -e "ip_nat_ftp "
if [ -z "` $LSMOD | $GREP ip_nat_ftp | $AWK {'print $1'} `" ]; then
$INSMOD ip_nat_ftp
fi

echo -en "ip_tables, "
if [ -z "` $LSMOD | $GREP ip_tables | $AWK {'print $1'} `" ]; then
$INSMOD ip_tables
fi

echo -e "iptable_nat, "
if [ -z "` $LSMOD | $GREP iptable_nat | $AWK {'print $1'} `" ]; then
$INSMOD iptable_nat
fi

echo -e "iptable_mangle "
if [ -z "` $LSMOD | $GREP iptable_mangle | $AWK {'print $1'} `" ]; then
$INSMOD iptable_mangle
fi

echo " ---"

echo -e "\nLoading firewall...\n"

echo " Clearing any existing rules and setting default policy to DROP.."
$IPT -P INPUT DROP
$IPT -F INPUT
$IPT -P OUTPUT DROP
$IPT -F OUTPUT
$IPT -P FORWARD DROP
$IPT -F FORWARD
$IPT -F -t nat
$IPT -F -t mangle

echo " Delete all User-specified chains..."
$IPT -X

echo " Reset all IPTABLES counters..."
$IPT -Z

echo " Enabling forwarding..."
echo 1 > /proc/sys/net/ipv4/ip_forward

echo -e "\n - Loading (INPUT) ruleset"
echo "5 4 1 7" > /proc/sys/kernel/printk

echo " loopback interfaces are valid..."
$IPT -A INPUT -i lo -s $ALL -d $ALL -j ACCEPT

echo " local interface, local machines, going anywhere is valid..."
$IPT -A INPUT -i $IF_INT -s $IF_EXT -d $ALL -j ACCEPT

echo " remote interface, claiming to be local machines, IP spoofing, get lost..."
$IPT -A INPUT -i $IF_EXT -s $IF_INT -d $ALL -j DROP

echo " Protection against SYN flood..."
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

echo " Accept ping..."
$IPT -A INPUT -i $IF_EXT -p ICMP -s $ALL -d $IP_EXT -j ACCEPT

echo " Allow SMTP..."
$IPT -A INPUT -p tcp --dport 25 -j ACCEPT

echo " Allow internal POP3/POP3s"
$IPT -A INPUT -i $IF_INT -p tcp --dport 110 -j ACCEPT
$IPT -A INPUT -i $IF_INT -p tcp --dport 995 -j ACCEPT

echo " Allow internal IMAP/IMAPs"
$IPT -A INPUT -i $IF_INT -p tcp --dport 993 -j ACCEPT
$IPT -A INPUT -i $IF_INT -p tcp --dport 143 -j ACCEPT

echo " Allow internal SSH..."
$IPT -A INPUT -i $IF_EXT -p tcp --dport 2093 -j ACCEPT
$IPT -A INPUT -i $IF_INT -p tcp --dport 2093 -j ACCEPT

echo " Allow WEB..."
$IPT -A INPUT -i $IF_EXT -p tcp --dport 80 -j ACCEPT

echo " Allow DNS..."
$IPT -A INPUT -i $IF_INT -p tcp --dport 53 -j ACCEPT
$IPT -A INPUT -i $IF_EXT -p tcp --dport 53 -j ACCEPT
$IPT -A INPUT -i $IF_INT -p udp --dport 53 -j ACCEPT
$IPT -A INPUT -i $IF_EXT -p udp --dport 53 -j ACCEPT

echo " Allow PPTP..."
$IPT -A INPUT -i $IF_EXT -p tcp --dport 1723 -j ACCEPT

echo " Allow Postgrey..."
$IPT -I INPUT -p tcp -m state --state NEW -s 127.0.0.1 --dport 10023 -j ACCEPT

acho " Allow Openfire..."
OPENFIRE="5222 5223 5229 5262 5269 7777 8080 8483 9090 9091 10015"
for PORT in $OPENFIRE
do
$IPT -A INPUT -i $IF_INT -p tcp --dport $PORT -j ACCEPT
done

echo " Restrict SQUID to local network..."
$IPT -A INPUT -i $IF_EXT -p tcp -s 0/0 --sport 1024:65535 -d $IP_EXT --dport 3128 -j DROP

echo " Catch all rule, all other incoming is denied and logged..."
$IPTABLES -A INPUT -s $ALL -d $ALL -j DROP

echo -e " - Loading (OUTPUT) ruleset"

echo " loopback interface is valid..."
$IPT -A OUTPUT -o lo -s $ALL -d $ALL -j ACCEPT

echo " local interfaces, any source going to local net is valid..."
$IPT -A OUTPUT -o $IF_INT -s $IP_EXT -d $INT_NETWORK -j ACCEPT

echo " local interface, any source going to local net is valid..."
$IPT -A OUTPUT -o $IF_INT -s $IP_INT -d $INT_NETWORK -j ACCEPT

echo " outgoing to local net on remote interface, stuffed routing, deny..."
$IPT -A OUTPUT -o $IF_EXT -s $ALL -d $INT_NETWORK -j DROP

echo " anything else outgoing on remote interface is valid..."
$IPT -A OUTPUT -o $IF_EXT -s $IP_EXT -d $ALL -j ACCEPT

echo " Catch all rule, all other outgoing is denied and logged..."
$IPT -A OUTPUT -s $ALL -d $ALL -j DROP

echo -e " - Loading (FORWARD) ruleset"

echo " - NAT: Enabling SNAT (MASQUERADE) functionality on $IF_EXT..."
$IPT -t nat -A POSTROUTING -o $IF_EXT -j SNAT --to $IP_EXT
#$IPT -t nat -A POSTROUTING -o $IF_EXT -j MASQUERADE

echo " WEB..."
$IPT -t nat -A PREROUTING -d $IP_EXT -p tcp --dport 80 -j DNAT --to-destination $IP_WEB
$IPT -t nat -A PREROUTING -d $IP_EXT -p tcp --dport 443 -j DNAT --to-destination $IP_WEB
$IPT -t nat -A PREROUTING -d $IP_ALIAS -p tcp --dport 80 -j DNAT --to-destination $IP_WEB
$IPT -t nat -A PREROUTING -d $IP_ALIAS -p tcp --dport 443 -j DNAT --to-destination $IP_WEB
echo " Terminal Service..."
$IPT -t nat -A PREROUTING -d $IP_EXT -p tcp --dport 3389 -j DNAT --to-destination $IP_DB
$IPT -t nat -A PREROUTING -d $IP_EXT -p tcp --dport 4000 -j DNAT --to-destination $IP_WEB:3389

echo " Proxy Squid..."
$IPT -t nat -A PREROUTING -i $IF_INT -p tcp --dport 80 -j REDIRECT --to-port 3128
#$IPT -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3128

echo -e "\nLoading firewall completed...\n"

}

fw_stop()
{
$IPT -t filter -P INPUT ACCEPT
$IPT -t filter -P FORWARD ACCEPT
$IPT -t filter -P OUTPUT ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P POSTROUTING ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
$IPT -t mangle -P INPUT ACCEPT
$IPT -t mangle -P FORWARD ACCEPT
$IPT -t filter -F
$IPT -t nat -F
$IPT -t mangle -F
$IPT -t filter -X
$IPT -t nat -X
$IPT -t mangle -X
$IPT -t filter -Z
$IPT -t nat -Z
$IPT -t mangle -Z
}

fw_usage()
{
echo
echo "$0 (start | stop | restart | clear)"
echo
{
echo
echo "$0 (start | stop | restart | clear)"
echo
echo "start - Start the firewall"
echo "stop - Stop the firewall"
echo "restart - Restart the firewall"
echo "clear - Clean the counters"
}

fw_clear()
{
$IPT -t filter -Z
$IPT -t nat -Z
$IPT -t mangle -Z
}

case $1 in

start)
fw_start;
;;

stop)
fw_stop;
;;

restart)
fw_stop;
fw_start;
;;

clear)
fw_clear;
;;
*)
fw_usage;
exit;

;;

esac

Well i have learned a lot and changed a lot of my firewall since last post, thanks for the recommendations.

mlp68 it looks like a very good idea and i might not leave it active like you said because we have a huge traffic but it would be awesome for debug when a problem comes up.

how would i implement the LOG_AND_DROP ?

Quote:

echo " Create a chain that will LOG and DROP..."
$IPT -N LOG_AND_DROP

Then how do i apply it to a rule ?

Quote:

echo " LOG AND DROP TEST"
$IPT -A LOG_AND_DROP -i $IF_INT -p tcp --dport 110 -j DROP
$IPT -A LOG_AND_DROP -i $IF_INT -p tcp --dport 995 -j DROP

would it work like that ?

Also i would like to ask everyone to check out my rules and spot me what i did wrong or could change or implement to make it better.

THANKS.

mlp68 · 04-06-2008, 08:06 PM

Quote:

Then how do i apply it to a rule ?

Quote:
echo " LOG AND DROP TEST"
$IPT -A LOG_AND_DROP -i $IF_INT -p tcp --dport 110 -j DROP
$IPT -A LOG_AND_DROP -i $IF_INT -p tcp --dport 995 -j DROP
would it work like that ?

Hm, no. Your command to make the new chain with that name, in your script's nomenclature, is right:

Code:

$IPT -N LOG_AND_DROP

Then you add a log and the drop target to it:

Code:

$IPT -A LOG_AND_DROP -j LOG --log-level info --log-prefix dropped-packet:
$IPT -A LOG_AND_DROP -j DROP

Whatever ends up in that chain gets logged and then dropped.

Now in the existing lines of your script, you replace what reads "-j DROP" with "-j LOG_AND_DROP", for example the current line

Code:

$IPTABLES -A INPUT -s $ALL -d $ALL -j DROP

becomes

Code:

$IPTABLES -A INPUT -s $ALL -d $ALL -j LOG_AND_DROP

and so on.

You are asking if other could help debug your script. My opinion, you make it pretty much unreadable with all those definitions and substitutions that make you jump back and forth... what was that $ALL again? And why is it "$IPT" mostly, but once (in the DROP line that I quoted above) the command is called "$IPTABLES"? All those variables which one needs to look up make it very hard to understand what's going on.

The way you define $IPT, $MODP, $INSMOD, etc doesn't even help you fending off an attacker who manages to tweak your PATH variable (one of the classic attacks - sneak in a same-name executable ahead of the system one in root's PATH), which is the reason why in scripts the commands are normally given with the full path. You define IPT=`which iptables`, which leaves you vulnerable to that attack.

Also, I don't think you have to explicitly insmod all those target-modules, do you? If you specify a target, it gets loaded automatically. At least in most systems it is.

Hope it helps somewhat, good luck,
mlp

prixone · 04-06-2008, 08:19 PM

Thanks for point that out for me and for being present at my topic it is helping me a lot also thanks for taking the time

I am trying to make it the best way and like you said indeed i dont need to use which because i do know the full path of it and do agree that using which it could be malicious used against me.

Thanks for explainning about the LOG_AND_DROP i am making a different approch of my code now to fit those in for when i need to use it.

Another thing i was trying to separete the logs of iptables from /var/log/messages at the syslog.conf but even after i make a new like for warning or info or whatever set the log-level to it and restart syslog it wasnt redirecting the messages any ideas ?

I see, i will change the nameing-scheme again i was just trying to reduce it is usage since i hold it into a variable i dont think i need to use $IPTABLES to make it readable to everyone i belive that $IPT as a resume would work good but i guess not :P

My problem now is that with this code i don't have internet access, squid redirection look like working fine since it timeouts, since i can ping but can't download something i belive it did be something direct to the dns or www access could anyone help me out on what i have missed in my rules ?

About the $ALL it is meant for everything like anywhere 0/0 or 0.0.0.0/0 UNIVERSE ? would it be better named as UNIVERSE or just use 0/0 or 0.0.0.0/0 ? what do you think ?