urgent (regarding iptables )

chill · 02-12-2004, 03:34 AM

hi ,

please let me know how to do this

i want to Drop all OUTPUT session and only allow two of my computer in network for InPUT SEssions.
using iptables.

mandy

dominant · 02-12-2004, 06:42 AM

It's better to do

iptables -F OUTPUT
iptables -P OUTPUT DROP

iptables -F INPUT
iptables -P INPUT DROP
iptables -A INPUT -s (remote ips) -j ACCEPT

The above is for all protocols (tcp, udp, icmp,..)

Correct me if i a am wrong

acid_kewpie · 02-12-2004, 07:18 AM

please do not use words like urgent in thread titles, it's just generally percieved as being rude. thanks

chrisfirestar · 02-13-2004, 02:20 AM

First of all plenty of other forums to search through :P

I have written up this script to do exactly what you are asking for so copy and paste the details in a file and then run the sh script.

sh filename

this will do everything you need.
for more information check out www.chrisliveonline.com/security/

Code:

#!/bin/sh
# Written by Chris Winfield-Blum
# more at www.chrisliveonline.com/security/

################################
#      Sys Net Settings        #
################################

# Allows IP Forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# Blocks External Ping requests
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

################################
#         Definitions          #
################################

IPTABLES="/sbin/iptables"
OUTSIDE=eth0
INSIDE=eth1

# Ethernet Definitions
EXT_IP="xxx.xxx.xxx.xxx"
INT_IP="192.168.1.1"

################################
#          House Work          #
################################

# Clear out any existing firewall rules, and any chains that might have
# been created.
$IPTABLES -F
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -F -t mangle
$IPTABLES -F -t nat
$IPTABLES -t nat -X
$IPTABLES -t mangle -X
$IPTABLES -X

################################
#        Default Rules         #
################################

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT

#### Begin setting up the rulesets ####

################################
#      Priviledge Users        #
################################

# This will allow only 192.168.1.2 and that MAC Address
# to access the internet

# 192.168.1.2
$IPTABLES -A INPUT -i $INSIDE -s 192.168.1.2 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
$IPTABLES -A INPUT -i $INSIDE -s 192.168.1.2 -j DROP
$IPTABLES -A FORWARD -i $INSIDE -s 192.168.1.2 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
$IPTABLES -A FORWARD -i $INSIDE -s 192.168.1.2 -j DROP


################################
#     Exception Conditions     #
################################

$IPTABLES -N silent
$IPTABLES -A silent -j DROP

$IPTABLES -N tcpflags
$IPTABLES -A tcpflags -m limit --limit 15/minute -j LOG --log-prefix TCPflags:
$IPTABLES -A tcpflags -j DROP

$IPTABLES -N firewalled
$IPTABLES -A firewalled -m limit --limit 15/minute -j LOG --log-prefix Firewalled:
$IPTABLES -A firewalled -j DROP

################################
#      Enable Masquerade       #
################################

$IPTABLES -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE

################################
#          TCP Flags           #
################################

# These are all TCP flag combinations that should never, ever, occur in the
# wild. All of these are illegal combinations that are used to attack a box
# in various ways.

$IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j tcpflags
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j tcpflags
$IPTABLES -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j tcpflags
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j tcpflags
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j tcpflags
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j tcpflags

# Allow selected ICMP types and drop the rest.
$IPTABLES -A INPUT -p icmp --icmp-type 0 -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type 3 -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type 11 -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
$IPTABLES -A INPUT -p icmp -j firewalled

################################
#        Allow Loopback        #
################################

$IPTABLES -A INPUT -i lo -j ACCEPT

################################
#     Drop Everything Else     #
################################

$IPTABLES -A INPUT -j DROP
$IPTABLES -A FORWARD -j DROP