Enterprise Firewall

Capt_Caveman · 11-19-2004, 12:19 AM

Code:

# (1) Policies
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# (1A) ALLOW ESTABLISHED CONNECTIONS EARLY SO THEY DON"T GO THROUGH RULES AGAIN
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#(1B) DROP BAD TRAFFIC
iptables -A INPUT -s x.x.x.x2 -i eth1 -j LOG --log-prefix "WARN: SPOOFED TRAFFIC"
iptables -A INPUT -s x.x.x.x2 -i eth1 -j DROP 
iptables -A INPUT -p ALL -i eth1 -s 10.0.0.0/255.0.0.0 -j LOG --log-prefix "WARN: SPOOFED TRAFFIC"
iptables -A INPUT -p ALL -i eth1 -s 10.0.0.0/255.0.0.0 -j DROP
iptables -A INPUT -p ALL -i eth1 -s 127.0.0.1 -j LOG --log-prefix "WARN: SPOOFED TRAFFIC"
iptables -A INPUT -p ALL -i eth1 -s 127.0.0.1 -j DROP
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "WARN: NEW NOT SYN"
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -p tcp -m --tcp-flags SYN,FIN SYN,FIN -j LOG --log-prefix "WARN: SYN-FIN SCAN"
iptables -A INPUT -p tcp -m --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp -m --tcp-flags ALL ALL -j LOG --log-prefix "WARN: ALL-ALL SCAN"
iptables -A INPUT -p tcp -m --tcp-flags ALL ALL -j DROP

# (3) INPUT CHAIN RULES
iptables -A INPUT -p ALL -i eth0 -s 10.0.0.0/255.0.0.0 -j ACCEPT
iptables -A INPUT -p ALL -i lo -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p ALL -i lo -s 10.1.2.96 -j ACCEPT
iptables -A INPUT -p ALL -i lo -s x.x.x.x2 -j ACCEPT
iptables -A INPUT -p ALL -i eth0 -s 10.0.0.255 -j ACCEPT

# TCP Rules
iptables -A INPUT -p TCP -i eth1 -s x.x.x.x1 --destination-port 20 -j ACCEPT
iptables -A INPUT -p TCP -i eth1 -s x.x.x.x1 --destination-port 21 -j ACCEPT
iptables -A INPUT -p TCP -i eth1 -s x.x.x.x1 --destination-port 22 -j ACCEPT

# UDP Rules 
iptables -A INPUT -p UDP -i eth1 -s x.x.x.x1 --destination-port 20 -j ACCEPT
iptables -A INPUT -p UDP -i eth1 -s x.x.x.x1 --destination-port 21 -j ACCEPT
iptables -A INPUT -p UDP -i eth1 -s x.x.x.x1 --destination-port 22 -j ACCEPT
iptables -A INPUT -p UDP -i eth1 -s 0/0 --destination-port 53 -j ACCEPT
iptables -A INPUT -p UDP -i eth1 -s 0/0 --destination-port 2074 -j ACCEPT
iptables -A INPUT -p UDP -i eth1 -s 0/0 --destination-port 4000 -j ACCEPT

# (4)FORWARD RULES
# accept the packets we want to forward
iptables -A FORWARD -i eth0 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# (5) OUTPUT RULES
# ONLU OUT PACKETS WITH LOCAL ADDRESSESS ARE FORWARDED
iptables -A OUTPUT -p ALL -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -p ALL -s 10.1.2.96 -j ACCEPT
iptables -A OUTPUT -p ALL -s x.x.x.x2  -j ACCEPT 
#^--Basically same as having a default OUTPUT policy of ACCEPT (not real secure) 

# (6) POST ROUTING RULES
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source x.x.x.x2

lastly, I have some open ports in my server which i want to close, how to do that?
What linux distribution and version are you using?

RatanSA · 11-19-2004, 12:52 AM

Dear Sir,

Thanks for the help
we are using redhat linux enterprise server 3

Ratan

Capt_Caveman · 11-19-2004, 12:59 AM

To see what services are turned on at boot:
chkconfig --list | grep on

To keep a service off at boot:
chkconfig service_name off

To turn a currently running service off:
service service_name stop

Wrt you firewall, what are you using port 53 for? Are you actually hosting a DNS server on-site or was that meant to allow communication with a remote DNS server (like at your ISP)?

RatanSA · 11-19-2004, 01:26 AM

Dear Sir,

Good to hear from you instantly.

I have some doubts about the text written by you.

**Wrt you firewall, what are you using port 53 for? Are you actually hosting a DNS server on-site or was that meant to allow communication with a remote DNS server (like at your ISP)?

Yes we have dns at isp site, tro be used.

**#^--Basically same as having a default OUTPUT policy of ACCEPT (not real secure)

How i can make it real secure?

Thanks again

Ratan

InEeDhElPlInUx · 11-19-2004, 02:44 PM

First of all you need to NOT get your firewall rules from a Red Hat Linux 9 Bible. Second of all you need to read the man pages on iptables. I'm sitting here and reading the exact same thing from the book you have written. I know it's some place to start but honestly read the man pages and do some google searches on it.

Capt_Caveman · 11-19-2004, 07:59 PM

**Wrt you firewall, what are you using port 53 for? Are you actually hosting a DNS server on-site or was that meant to allow communication with a remote DNS server (like at your ISP)?
Yes we have dns at isp site, tro be used.
Ok. Since you are a DNS client, you don't want to allow completely open access to DNS (port 53). Limit the source address on incoming packets to your ISP or ideally to your ISPs name servers. Also because incoming traffic to port 53 should only be in response to DNS lookups, it will be using a source port of 53 not the destination port (if you were were running a DNS nameserver it would be the reverse. So the rule you need is:

iptables -A INPUT -p UDP -i eth1 -s <Your_ISP> --source-port 53 -j ACCEPT

**#^--Basically same as having a default OUTPUT policy of ACCEPT (not real secure)
How i can make it real secure?
By limiting outgoing traffic to only those protocols that are necessary. This can be very difficult though. You'll need a list of all the types of traffic that will be leaving the server and write indivdual rules for each one instead of allowing all outgoing packets. I'd highly recommend getting your firewall working properly first and then try locking down outgoing traffic. Based on your current rules you'll need at least:
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 20 -d x.x.x.x1 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 21 -d x.x.x.x1 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -d x.x.x.x1 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 53 -d <Your_ISP> -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 2074 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 4000 -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT

*Usually this list can beome much larger depending on your requirements

RatanSA · 11-19-2004, 10:53 PM

Lot of thanks to you, Sir Capt_Caveman.
I think I have got the right inputs from you, Mr. InEeDhElPlInUx
and all others who contributed to this thread of mine.
Speciaql Thanks are due to chort of transferred my orignal thread from other forum.
I will come again in case of doubt.

Thanks again to all of you.

Ratan