predatorwall v0.1

predator.hawk · 10-14-2004, 11:18 PM

I'v recently built a iptables firewall script, witch will work with slackwares startup system. My friend r3d5pik3 (Security Expert and Coder) says i did a pretty good job making this. So i'm telling the Linux Questions Commutity. Note: the files will work on most all distros.

Link to Download: www.dcaf-security.org/predwall.html

Edit: I'd like some feedback on how this works on other connections if possible, like dail up and cable

.

Edit 2: Predatorwall v0.2 released, updated the post.

Edit 3: Predatorwall v0.2.1 released, Bug fix. Seems i forgot to add the --log-prefix option.....

win32sux · 10-15-2004, 11:48 AM

i'm posting the script you made so as to make it easier for people to contribute on this thread...

the three main files are flush.sh, rc.firewall, and start.sh...

flush.sh

Code:

#!/bin/sh

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F
iptables -X

rc.firewall

Code:

#!/bin/sh

start() {
    echo "predatorwall: Applying Iptables rules now"
     /etc/firewall/start.sh
    if [ $? -eq 0 ]; then
        touch /var/lock/subsys/firewall
    fi
}

stop() {
    echo "predatorwall: Flushing Iptables rules now"
     /etc/firewall/flush.sh
    if [ $? -eq 0 ]; then
        rm -f /var/lock/subsys/firewall
    fi
}

case $1 in
    start)
    start
    ;;
    stop)
    stop
    ;;
    restart)
    stop
    start
    ;;
    status)
    /usr/sbin/iptables -L
    ;;
    *)
    echo "Usage: start|stop|restart|status"
esac
exit

start.sh

Code:

#!/bin/sh
#
# predatorwall, writen by predatorfreak. Basic, secure iptables configuration
# Starts Logging, logs: /var/log/messages
iptables -A OUTPUT -j LOG
iptables -A INPUT -j LOG
iptables -A FORWARD -j LOG
# Check for incorrect TCP State flags
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
# Check for incorrect TCP State flags
iptables -A OUTPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A OUTPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -A OUTPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -A OUTPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A OUTPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A OUTPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
# drops incoming packets, the next section allows us to connect
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
# Allows accsess to the loopback interface
iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
# allows SSH connections to come in, if you run a web server/shell server this is usefull, otherwise leave it commented out
# iptables -A INPUT --dport 22 -j ACCEPT
# below is stuff for web servers/shell servers, normal people can leave it commented out
# iptables -A INPUT -p tcp --dport 80 -j ACCEPT
# iptables -A INPUT -p tcp --dport 53 -j ACCEPT
# iptables -A INPUT -p tcp --dport 21 -j ACCEPT
# iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# iptables -A INPUT -p tcp --dport 110 -j ACCEPT
# iptables -A INPUT -p tcp --dport 25 -j ACCEPT
# iptables -A INPUT -p tcp --dport 443 -j ACCEPT
# The Above entrys are for web server things, like smtp and pop3 (25 and 110)
# Script End

tangle · 10-15-2004, 02:49 PM

This is what I have been looking for. Thanks

predator.hawk · 10-15-2004, 02:51 PM

Anyone tested predatorwall on connections like Cable or Dail Up? i'd like some feedback on how it works on other configurations and other connections. So i can better improve it

.

predator.hawk aka predatorfreak

Edit: to tangle: np just doing my job

, also just so ya know. flush.sh and start.sh go in /etc/firewall (you may have to make this directory).

Cedrik · 10-15-2004, 02:59 PM

You did choose to log all connections ? For my part I prefer log all dropped connections.

Cedrik · 10-15-2004, 03:14 PM

Also here are my rules to allows access to the loopback interface :

iptables -A INPUT -i lo -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT
iptables -A OUTPUT -o lo -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT

I suspect your line :
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

may accept connection that not come from localhost

And enable rule for passive ftp is not too much :
iptables -A INPUT -i eth0 -p tcp --sport 1024: --dport 1024: \
-m state --state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o eth0 -p tcp --sport 1024: --dport 1024: \
-m state --state ESTABLISHED,RELATED -j ACCEPT

This ftp rule works with the ip_conntrack_ftp kernel option so it need to be loaded before if compiled as module

if ! grep ip_conntrack_ftp /proc/modules 1> /dev/null ; then
/sbin/modprobe ip_conntrack_ftp
fi

predator.hawk · 10-15-2004, 03:41 PM

Getting Ready To Release Predatorwall v0.2 right now, i added the Suggested commands and added Basic /proc security. Also I prefer to log all connections, thus if something slips by i know it does and i can fix it

. Proble around v0.4 i'l just be logging droped connections. But in early development its more of a debugging feature

.

Cedrik · 10-15-2004, 03:44 PM

at least don't poweroff the computer at 4:40 am so crontab do the logrotate job
or better change the hour with crontab -e as root

Also you can personalize your log like :

iptables -A INPUT -j LOG --log-prefix '[predatorwall input] : '

predator.hawk · 10-15-2004, 03:59 PM

So, How do i change the crontab time? i'v never done it before so.....

Cedrik · 10-15-2004, 04:05 PM

Normally, it use vi syntax, shortly :

crontab -e

position your cursor on the hour field, then type 'a', enter your new hour no matter
where the old hour is at this time. Once new hour entered press <esc> key
and position the cursor on the char you want to delete, then type 'x' to
delete the char

save and quit : press <esc> then type ':' then type 'wq', then press enter
That is

Or just do 'logrotate' as root at the command line to rotate log by hand

predator.hawk · 10-15-2004, 04:11 PM

my file shows up as blank o.O

Cedrik · 10-15-2004, 04:14 PM

Yes if you did 'crontab -e' as your user it is normal, do this as root to see crontab for system,
but do logrotate as root may be better for your use

predator.hawk · 10-15-2004, 04:19 PM

Ok, Vi is pissing me off. Is there a way to just make it use pico instead?

Cedrik · 10-15-2004, 04:29 PM

crontab is just a text file after all

edit :
/var/spool/cron/crontabs/root

(as root naturally)

predator.hawk · 10-15-2004, 04:31 PM

thanks, finishing up some last few things on v0.2, i'l upload it soon.