LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 11-13-2005, 07:09 AM   #1
simcox1
Member
 
Registered: Mar 2005
Location: UK
Distribution: Slackware
Posts: 794
Blog Entries: 2

Rep: Reputation: 30
Firewall script


I'm just trying to get a simple firewall going. I'll probably add to it, but I want to check how to do it right. I've got a webpage and email service hosted here, so this is what I've done.

#!/bin/bash

iptables -F
iptables -Z
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 25,80,110,143 -i eth0 -j ACCEPT


Basically, I was trying to avoid needing to put a seperate line for each open incoming port, but I'm not sure if it's right. It does seem to work ok, but I don't know if I can shorten 'multiport' to 'mport', and wether it should be '--dports' or '--dport'. I've got a hardware firewall/modem as well.
 
Old 11-13-2005, 08:44 AM   #2
Riddick
Member
 
Registered: May 2004
Location: Rome, Italy
Distribution: slackware-current
Posts: 454

Rep: Reputation: 30
I found
http://www.aboutdebian.com/
has an excellent tutorial - have a look there!
Also look for an IPTables tutorial if you want to check
about your commands!

Riddick
 
Old 11-13-2005, 08:55 AM   #3
simcox1
Member
 
Registered: Mar 2005
Location: UK
Distribution: Slackware
Posts: 794

Original Poster
Blog Entries: 2

Rep: Reputation: 30
Thanks. I have looked at various how-tos on the netfilter website. I think what I've done is ok, I just wanted a bit of clarification. I assumed 'multiport' and 'mport' were the same thing, but 'mport' doesn't seem to work.
 
Old 11-13-2005, 09:01 AM   #4
Riddick
Member
 
Registered: May 2004
Location: Rome, Italy
Distribution: slackware-current
Posts: 454

Rep: Reputation: 30
It's all here!
http://iptables-tutorial.frozentux.n...-tutorial.html
there doesn't seem to be an "mport" but I do remember it!

Strange!

Riddick
 
Old 11-13-2005, 09:19 AM   #5
simcox1
Member
 
Registered: Mar 2005
Location: UK
Distribution: Slackware
Posts: 794

Original Poster
Blog Entries: 2

Rep: Reputation: 30
That's the tutorial I was following! Thanks.
 
Old 11-13-2005, 11:14 AM   #6
/bin/bash
Senior Member
 
Registered: Jul 2003
Location: Indiana
Distribution: Mandrake Slackware-current QNX4.25
Posts: 1,802

Rep: Reputation: 47
mport is obsolete
netfilter/iptables - Patch-o-Matic Listing - obsolete
Quote:
mport - iptables mport match
Author: Andreas Ferber <af@devcon.net>
Status: Deprecated by 'multiport' version1 in 2.6.11-rcX

This module is an enhanced multiport match. It has support for byte
ranges as well as for single ports.
Up to 15 ports are allowed. Note that a portrange uses up 2 port values.

Examples:
# iptables -A FORWARD -p tcp -m mport --ports 23:42,65
 
Old 11-13-2005, 11:27 AM   #7
Brian1
LQ Guru
 
Registered: Jan 2003
Location: Seymour, Indiana
Distribution: Distribution: RHEL 5 with Pieces of this and that. Kernel 2.6.23.1, KDE 3.5.8 and KDE 4.0 beta, Plu
Posts: 5,700

Rep: Reputation: 64
Check out http://www.linuxguruz.com/iptables/ . They have a section on scripts. I use them for a basic start and fine tune from there to fit per client.

Brian1
 
Old 11-13-2005, 01:08 PM   #8
Riddick
Member
 
Registered: May 2004
Location: Rome, Italy
Distribution: slackware-current
Posts: 454

Rep: Reputation: 30
good link -- that's one to keep!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Where should this firewall script be placed? wardialer Linux - Security 84 02-14-2005 08:06 PM
slackware's /etc/rc.d/rc.firewall equivalent ||| firewall script startup win32sux Debian 1 03-06-2004 10:15 PM
Firewall script help!!!! cirkut5732 Linux - Newbie 8 04-17-2003 07:09 PM
Could you look over my firewall script please... Grim Reaper Linux - Networking 8 03-26-2003 04:33 AM
Firewall script help jfall Linux - Networking 6 10-23-2002 04:46 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 01:43 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration