LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 12-06-2004, 06:01 PM   #1
tarballed
Member
 
Registered: Jun 2002
Distribution: RH, FC, FreeBSD,OpenBSD
Posts: 326

Rep: Reputation: 30
IPTables on a RH3 box


Evening everyone.

Working on learning IPTables here. But I have a quick question.

I need to setup IPTables on a RH box that is inside our private network. It is a pretty important system, so security needs to be very tight.

With that in mind, what i wanted to do was setup IPTables on the box to only allow access to certain ports from certain IP addresses. Also, I do not need to do any sort of NAT our routing on the box. The only thing I need to do is allow access to the box on certain ports from a specific network range.

Should not be to terrible I am guessing. Im hoping at least.

My main question is on the outbound traffic. It will only need to leave outbound, via port 80 (does web checks on a vendors site) and im also guessing the port for RHN.

With that in mind, can I pretty much just setup some rules to just allow what I want, and deny everything else?

Never really worked with iPtables before. Have a lot of experience with PF and IPF/IPFW.

Anyway, just wanted to get some feedback from people with more experience.

Cheers,


Tarballed
 
Old 12-06-2004, 06:22 PM   #2
Butt-Ugly
Member
 
Registered: Nov 2004
Location: Brisbane, Australia
Distribution: Fedora Core 5
Posts: 89

Rep: Reputation: 15
tarballed,

You need something like this, where all packets a explicitly dropped, then only allow the selective packets that are needed.

Code:
#!/bin/sh
#
#       Firewall Script

### Remove all previous rules, and delete any user defined chains
iptables -F
iptables -X

### Set the default policies to drop
iptables -P INPUT   DROP
iptables -P OUTPUT  DROP
iptables -P FORWARD DROP

### Loopback device OK
iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

###############################################################
### OUTBOUND Rule: Allow ALL packets out the external device
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

### OUTBOUND Rule: Allow ONLY NEW packets on these ports.
# (After NEW connection is established, the above rule allows all following packets)
iptables -A OUTPUT -m state --state NEW -m tcp -p tcp --syn --dport 80 -j ACCEPT

###############################################################
### INBOUND Rule: Allow ALL packets if a connection already exists
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

### INBOUND Rule: Allow ONLY NEW packets on these ports.
# (After NEW connection is established, the above rule allows all following packets)
iptables -A INPUT -s 192.168.1.25 -m state --state NEW -m tcp -p tcp --syn --dport 80  -j ACCEPT
iptables -A INPUT -s 192.168.1.26 -m state --state NEW -m tcp -p tcp --syn --dport 80  -j ACCEPT
You will need to adjust the inbound and outbound rules to suit your requirements.

If you need more info on firewall concepts, I've drafted this: http://www.brennan.id.au/06-Firewall_Concepts.html

Hope it helps..

BU
 
Old 12-06-2004, 06:24 PM   #3
tarballed
Member
 
Registered: Jun 2002
Distribution: RH, FC, FreeBSD,OpenBSD
Posts: 326

Original Poster
Rep: Reputation: 30
Thanks bu!!

That's great. I really appreciate your help, script and the link!


Cheers,

tarballed
 
Old 12-06-2004, 06:27 PM   #4
Butt-Ugly
Member
 
Registered: Nov 2004
Location: Brisbane, Australia
Distribution: Fedora Core 5
Posts: 89

Rep: Reputation: 15
No probs,

You'll notice the script is similar to the one on the link, I just removed the different interfaces out to suit your needs.

Quick and easy, but you need to test it.

BU.
 
Old 12-06-2004, 07:11 PM   #5
tarballed
Member
 
Registered: Jun 2002
Distribution: RH, FC, FreeBSD,OpenBSD
Posts: 326

Original Poster
Rep: Reputation: 30
One last questoin:

Can I build these rules remotely? Or do I have to be at the terminal?

Playing around, I keep locking myself out.

I appreciate it.
 
Old 12-06-2004, 10:24 PM   #6
Butt-Ugly
Member
 
Registered: Nov 2004
Location: Brisbane, Australia
Distribution: Fedora Core 5
Posts: 89

Rep: Reputation: 15
Yes you can do all your rules remotely.

But if you put the wrong rule in you might get locked out, then you'll need to access the terminal

BU.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
RH3 memory leaking - kernel upgrade? christopherccv Linux - Enterprise 1 09-14-2005 07:07 PM
IBM T43 laptop and Linux RH3 trombi Linux - Laptop and Netbook 1 08-29-2005 07:41 AM
rh3 + 4gig memory saustin99 Red Hat 1 08-25-2005 04:52 PM
Write Access to W2k share on RH3 saustin99 Linux - Newbie 1 05-24-2005 04:27 AM
can't allow ping from my box to the outside world - iptables anorman Linux - Networking 1 09-23-2004 09:53 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 12:40 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration