Hi guys!

Got a webserver (Cobablt Raq 4). I've recompiled the kernel with the firewall options that ipchains needs and installed ipchains.

Now I need help making a rules file with the apprropriate things in. Any ideas? And I heard I need an FTP module to open the correct ports e.t.c

Someone here must have done this more times than I've had roast dinners and can tell me?

Spode

ok here's an example:
The internet interface is "eth1"
The internal interface is "eth0"
The internal subnet is 192.168.10.0/24
The external IP address is "45.255.18.171"

I've added some comments to each rule so you can see what it does.

--------------------------
clear
sysctl -w net.ipv4.tcp_max_syn_backlog=256
# sysctl -w net.ipv4.vs.timeout_established=9600
sysctl -w net.ipv4.tcp_syn_retries=5
# sysctl -w net.ipv4.vs.timeout_synack=60
sysctl -w net.ipv4.route.mtu_expires=512
sysctl -w net.ipv4.tcp_keepalive_time=7600
sysctl -w net.ipv4.icmp_echoreply_rate=10
sysctl -w net.ipv4.tcp_fin_timeout=360
sysctl -w net.ipv4.tcp_rfc1337=1
echo 0 > /proc/sys/net/ipv4/ip_no_pmtu_disc
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
# echo 1 > /proc/sys/net/ipv4/ip_always_defrag
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 61 > /proc/sys/net/ipv4/ip_default_ttl
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
echo 262144 > /proc/sys/net/core/rmem_default
echo 262144 > /proc/sys/net/core/rmem_max
echo 262144 > /proc/sys/net/core/wmem_default
echo 262144 > /proc/sys/net/core/wmem_max

# load FTP nat module for stupid connection back tracking to NAT source.
if [ -e /lib/modules/$(uname -r)/ipv4/ip_masq_ftp.o ]; then
if [ -x /sbin/insmod ]; then
if ! $(grep -s ip_masq_ftp /proc/modules >/dev/null); then
/sbin/insmod -p -s ip_masq_ftp
fi
fi
fi
# Pull the chain flush the firewall
ipchains -F
ipchains -X

# Reject all packets and use rules instead
ipchains -P input REJECT
ipchains -P output REJECT
ipchains -P forward REJECT
# change timeouts on k2.2 only
# ipchains -M -S 6800 15 200

# allow inbound back from web server with SYN's off so adverts come in and don't crash Java scripts.
ipchains -A input -i eth1 -p tcp -s 0/0 --sport 80 -d 45.255.18.171 --dport 1024:65535 -j ACCEPT
ipchains -A input -i eth1 -p tcp -s 0/0 --sport 443 -d 45.255.18.171 --dport 1024:65535 -j ACCEPT
ipchains -A input -i eth1 -p tcp -s 0/0 --sport 8080 -d 45.255.18.171 --dport 1024:65535 -j ACCEPT


# Allow access out to all ports but only into 1023:65535 on firewall
# Only allow connection in bound if server requested outbound in first place.
# Change all outgoing packets TOS to priority level 1 for priority router access
ipchains -A output -p tcp -s 0/0 -d 0/0 -t 0x01 0x10 -j ACCEPT
ipchains -A input -p tcp ! -y -s 0/0 --sport 1:65535 -d 45.255.18.171 1024:65535 -j ACCEPT
ipchains -A input -p tcp -s 0/0 --sport 1:65535 -d 45.255.18.171 1:1023 -j REJECT -l

# Do magic NAT for internal IPs
ipchains -A forward -s 192.168.10.0/24 -j MASQ

# allows access to server from IPN
ipchains -A input -i lo -j ACCEPT
ipchains -A output -i lo -j ACCEPT

# allow access from all ips on eth0 internal NIC
ipchains -A input -i eth0 -s 192.168.10.0/24 -j ACCEPT
ipchains -A output -i eth0 -d 192.168.10.0/24 -j ACCEPT

# Netbios windows connections rejected from internet to eth1
ipchains -A input -i eth1 -p tcp -s 0/0 --dport 137:139 -j REJECT -l

# Reject 10, 192, 172 and 127 non internet addresses from spoofing network card eth1
ipchains -A input -i eth1 -s 10.0.0.0/8 -d 0/0 -j REJECT
ipchains -A input -i eth1 -s 172.16.0.0/12 -d 0/0 -j REJECT
ipchains -A input -i eth1 -s 192.168.0.0/16 -d 0/0 -j REJECT
ipchains -A input -i eth1 -s 127.0.0.0/8 -d 0/0 -j REJECT -l
ipchains -A input -i eth1 -s 255.255.255.255 -j REJECT -l
ipchains -A input -i eth1 -d 0.0.0.0 -j REJECT -l

# People cant traceroute the server now with UDP packets
ipchains -A input -p udp -d 45.255.18.171 -s 0/0 33434:33600 -j REJECT -l

# DNS lookup allowed from any dns PROVIDED internal network requested it.
ipchains -A output -p tcp -s 45.255.18.171 1023:65535 --dport 53 -j ACCEPT
ipchains -A input -p tcp ! -y -s 0/0 --sport 53 -d 45.255.18.171 1023:65535 -j ACCEPT

# DNS lookup allowed from any dns, need stateful firewall to connection track this.
ipchains -A output -p udp -s 45.255.18.171 1023:65535 --dport 53 -d 0/0 -j ACCEPT
ipchains -A input -p udp -s 0/0 --sport 53 -d 45.255.18.171 1023:65535 -j ACCEPT

# log scans on firewall and block port 6000
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 2 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 3 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 4 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 5 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 6 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 7 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 8 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 20 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 21 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 22 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 23 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 25 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 53 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 79 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 80 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 110 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 111 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 113 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 113 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 443 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 8080 -j REJECT -l
ipchains -A input -p tcp -s 0/0 -d 45.255.18.171 --dport 6000 -j REJECT -l

# Allow icmp messages inbound so network works smoothly.
ipchains -A output -p icmp -s 0/0 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 0 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 3 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 4 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 9 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 12 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 14 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 18 -d 0/0 -j ACCEPT

# Stop inbound type 8, 11 and 10 messages i.e ping etc etc
ipchains -A input -p icmp -s 0/0 --icmp-type 8 -d 0/0 -j DENY -l
ipchains -A input -p icmp -s 0/0 --icmp-type 11 -d 0/0 -j DENY
ipchains -A input -p icmp -s 0/0 --icmp-type 10 -d 0/0 -j DENY -l

# eof

------------------------
You must shutdown any services that you don't need.
he above example will only allow outgoing connections to websites ftp servers etc etc ect.

for a inbound connection you'll need rules that are similar to this example:

ipchains -A input -p tcp -s 0/0 --sport 1023:65535 -d 45.255.18.171 --dport 80 -j ACCEPT -l
ipchains -A output -p tcp -s 45.255.18.171 --sport 80 -d 0/0 -j ACCEPT


/Raz

<newbie to linux>

So where does this go. in the ipchains.rules file?

and how do I make it load it at boot up e.t.c ? help...

oh, and ingoing connections - is that like someone connecting via SSH for insteance?

Sorry for the delay in answering.

Depending on how your system is configured I find the best way to start a firewall is by adding a script line in the /etc/rc.d/rc.local file.
like
/etc/rc.d/firewall1.sh
"then it's the last process to be executed after the run level processes and doesn't mess anything up, in theory"

Then create a /etc/rc.d/firewall1.sh file with "chmod 700" rights.

Yes Inbound connections are any connections going into your systems services and are controlled with the INPUT rule in ipchains and the PREROUTING & INPUT rule in iptables.

/Raz

Someone mentioned to me about it';s good to have a scruipt installed on the server that will turn off the firewall after 5 minutes. (Just while I'm settting it up) that way if I accidently block all the ports or something, Ican easily go in and correct it.

Any ideas?

so I add that script file. What do you put inside it,all the rules?

Maybe sounds hard, but I think you have to learn to evaluate the chains and learn/decide what's an acceptable accept/reject/deny policy before moving on. Familiarize yourself with the OS, networking and get your ipchains how-to's from linuxdoc.org, preferably trying out stuff on a staging server/testbox before deploying, if you can.

If you follow Raz' instructions you make the file /etc/rc.d/firewall1.sh, add the "bang" line:
"#!/bin/sh" (w/o quotes) as the first line, then add all the rules, save, close and make it executable by issuing "chmod 0750 /etc/rc.d/firewall1.sh" or "chmod 0700 /etc/rc.d/firewall1.sh".

Since RaQ's basically Red Hat, and if the filesystem still follows the standard, you can do 2 things: either leave it there, or move it to /etc/rc.d/init.d.
If you move it to init.d it will be easier to link the file to the runlevel you want it to run in, and even perform actions based on runlevel.

For example: if your default runlevel is 3 (multi-user, networking, no graphical login) then you do:
"ln -sf /etc/rc.d/init.d/firewall1.sh etc/rc.d/rc3.d/S99firewall1.sh".
Now when you reboot itll process the ipchains rules as the (almost last) process, because /etc/rc.d/rc.local comes after that.

Now for resetting the rules there are many ways.
W/o going into details about security issues too much, and hoping you won't expose vulnerable services, just let the script "sleep" for a few minutes.

Add the line "sleep 10m && ipchains -F && ipchains -X && ipchains -P (default policy rules here)"
to the bottom of the firewall.sh, and after 10 minutes of sleeping after processing the rules, itll flush.

Btw, I never worked with RaQ4's but I thought they where Red Hat based and came with the whole complete setup so any customer shouldnt have to deal with the OS?

yeah, it does have that funky OS.

BUT, It has no firewall which leaves it open to vulnerabilities and people are out there making loads of money getting paid jsut to set up ipchains on RAQ machines!

Now, I have 2 of these RAQ's so it would cost quite a bit. Secondly, I'm not an idiot else I wouldn't be in charge of it - I just don't have any linux experience before this.

But I'm learning :P

There is some usefull stuff here. I will compile it together and give it a shot. Then come back once I've run into a problem.