LinuxQuestions.org - all in one centos machine

I want to have a router, a dhcp, ftp, DNS, Proxy, Gateway, Samba, and mail server in my same machine. Budget issue.

With iptables default policy Drop.

Attachment 15914

Attachment 15915

Code:

//

// named.conf

//

// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS

// server as a caching only nameserver (as a localhost DNS resolver only).

//

// See /usr/share/doc/bind*/sample/ for example named configuration files.

//



options {

        listen-on port 53 { 115.127.27.59; 192.168.100.1; };

        listen-on-v6 port 53 { ::1; };

        directory        "/var/named";

        dump-file        "/var/named/data/cache_dump.db";

        statistics-file "/var/named/data/named_stats.txt";

        memstatistics-file "/var/named/data/named_mem_stats.txt";

        allow-query    { localhost; 192.168.100.0/24; };

        recursion yes;



        dnssec-enable yes;

        dnssec-validation yes;

        dnssec-lookaside auto;



        /* Path to ISC DLV key */

        bindkeys-file "/etc/named.iscdlv.key";



        managed-keys-directory "/var/named/dynamic";

};



logging {

        channel default_debug {

                file "data/named.run";

                severity dynamic;

        };

};



zone "." IN {

        type hint;

        file "named.ca";

};



include "/etc/named.rfc1912.zones";

include "/etc/named.root.key";

Code:

#!/bin/bash



#Declare interfaces, ip-address, and other things

wan="p4p1"

lan="p4p2"

wanip="115.127.27.59"

lanip="192.168.100.1"



#Cleaning previous chains, rules

iptables -t filter -F                        # -t for table to go here 'filter' -F is to flash all rules

iptables -t filter -X                        # -X is to delete rules 

iptables -t filter -Z                        # -Z is to zero counters



iptables -t nat -F                        # for NAT table

iptables -t nat -X

iptables -t nat -Z



iptables -t mangle -F                        # for mangle table

iptables -t mangle -X

iptables -t mangle -Z



#Basic policy set to drop in filter

iptables -P INPUT DROP

iptables -P FORWARD DROP

iptables -P OUTPUT DROP



#Basic policy set to drop in mangle

iptables -t mangle -P PREROUTING ACCEPT

iptables -t mangle -P INPUT ACCEPT

iptables -t mangle -P OUTPUT ACCEPT

iptables -t mangle -P FORWARD ACCEPT

iptables -t mangle -P POSTROUTING ACCEPT





#SSH

# Allow incoming ssh only for wan 

iptables -A INPUT -i $wan -p tcp -d $wanip --sport 513:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o $wan -p tcp -s $wanip --sport 22 --dport 513:65535 -m state --state ESTABLISHED -j ACCEPT



# Allow incoming ssh only for lan 

iptables -A INPUT -i $lan -p tcp -d $lanip --sport 513:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o $lan -p tcp -s $lanip --sport 22 --dport 513:65535 -m state --state ESTABLISHED -j ACCEPT

##############################################################################################################

# Allow outgoing ssh only for wan 

iptables -A OUTPUT -o $wan -p tcp -s $wanip --sport 22 --dport 513:65535  -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A INPUT -i $wan -p tcp -d $wanip --sport 513:65535 --dport 22  -m state --state ESTABLISHED -j ACCEPT



# Allow outgoing ssh only for lan 

iptables -A OUTPUT -o $lan -p tcp -s $lanip --sport 513:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A INPUT -i $lan -p tcp -s $lanip --sport 22 --dport 513:65535 -m state --state ESTABLISHED -j ACCEPT

##############################################################################################################

#rDesktop

# Allow outgoing rDesktop only for lan 

iptables -A OUTPUT -o $lan -p tcp -s $lanip --sport 513:65535 --dport 3389 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A INPUT -i $lan -p tcp -d $lanip --sport 3389 --dport 513:65535 -m state --state ESTABLISHED -j ACCEPT

##############################################################################################################

## WWW

# Allow www outbound to 80.

iptables -A OUTPUT -o $wan -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A INPUT  -i $wan -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

# Allow www outbound to 443.

iptables -A OUTPUT -o $wan -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A INPUT  -i $wan -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

##############################################################################################################

#DNS

# Allow incoming DNS only

iptables -A INPUT -p udp --dport 53 -m state --state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -p udp --sport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A INPUT -p udp --dport 53 -m state --state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -p udp --sport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

##############################################################################################################



service iptables save

service iptables restart

service iptables status

Sombody please help