LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 10-17-2018, 12:17 PM   #31
lazydog
Senior Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194

OK, please forgive me for not reading all the post thus far. I have a few questions for you.
  1. Where is this firewall deployed?
  2. How many interfaces are connected to this device?
  3. Why are you doing all this excessive logging?
  4. What ports do you need to get through?
Once I have all this information I believe I can get you on the right track.
 
Old 10-17-2018, 12:23 PM   #32
PROBLEMCHYLD
Senior Member
 
Registered: Apr 2015
Posts: 1,201

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by lazydog View Post
OK, please forgive me for not reading all the post thus far. I have a few questions for you.
  1. Where is this firewall deployed?
  2. How many interfaces are connected to this device?
  3. Why are you doing all this excessive logging?
  4. What ports do you need to get through?
Once I have all this information I believe I can get you on the right track.
Thanks, but I got it figured out...
This is the full set of rules. Adding rule 20 allow connection to computers on the LAN. I didn't need to add the samba rules. Now I have hardware protection and software protection, just how I like it!!!!!!! Thanks again.

Code:
iptables -P OUTPUT  DROP
iptables -P INPUT   DROP
iptables -P FORWARD DROP
iptables -A INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
iptables -A OUTPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
iptables -N drop_invalid
iptables -A OUTPUT -m state --state INVALID -j drop_invalid 
iptables -A INPUT -m state --state INVALID -j drop_invalid 
iptables -A INPUT -p tcp -m tcp --sport 1:65535 --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j drop_invalid 
iptables -A drop_invalid -j LOG --log-level debug --log-prefix "INVALID state -- DENY"
iptables -A drop_invalid -j DROP
iptables -N In_RULE_0
iptables -A INPUT -i wlan0 -s darkstar -j In_RULE_0 
iptables -A In_RULE_0 -j LOG --log-level info --log-prefix "RULE 0 -- DENY"
iptables -A In_RULE_0 -j DROP
iptables -N In_RULE_1
iptables -A INPUT -p icmp -m icmp --icmp-type any -j In_RULE_1
iptables -A In_RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- DENY"
iptables -A In_RULE_1 -j DROP
iptables -N In_RULE_2
iptables -A INPUT -p tcp -m tcp --dport 43 -j In_RULE_2
iptables -A In_RULE_2 -j LOG --log-level info --log-prefix "RULE 2 -- DENY"
iptables -A In_RULE_2 -j DROP
iptables -N In_RULE_3
iptables -A INPUT -p tcp -m tcp --tcp-flags ALL URG,PSH,FIN -j In_RULE_3
iptables -A In_RULE_3 -j LOG --log-level info --log-prefix "RULE 3 -- DENY"
iptables -A In_RULE_3 -j DROP
iptables -N In_RULE_4
iptables -A INPUT -p tcp -m tcp --tcp-flags ALL URG,ACK,PSH,RST,SYN,FIN -j In_RULE_4
iptables -A In_RULE_4 -j LOG --log-level info --log-prefix "RULE 4 -- DENY"
iptables -A In_RULE_4 -j DROP
iptables -N In_RULE_5
iptables -A INPUT -p all -f -j In_RULE_5
iptables -A In_RULE_5 -j LOG --log-level info --log-prefix "RULE 5 -- DENY"
iptables -A In_RULE_5 -j DROP
iptables -N In_RULE_6
iptables -A INPUT -p udp -m udp --dport 513 -j In_RULE_6
iptables -A In_RULE_6 -j LOG --log-level info --log-prefix "RULE 6 -- DENY"
iptables -A In_RULE_6 -j DROP
iptables -N In_RULE_7
iptables -A INPUT -p udp -m udp --dport 33434:33524 -j In_RULE_7
iptables -A In_RULE_7 -j LOG --log-level info --log-prefix "RULE 7 -- DENY"
iptables -A In_RULE_7 -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 25 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 110 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 143 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 465 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 500 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 993 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 995 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 1701 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 1723 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 4500 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 6667 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 6697 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 6881 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 6881 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 7881 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 8881 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 8881 -m state --state NEW -j ACCEPT
iptables -N RULE_17
iptables -A OUTPUT -p tcp -m tcp --dport 21 -j RULE_17
iptables -A OUTPUT -p tcp -m tcp --sport 1024: --dport 1024: -j RULE_17
iptables -A RULE_17 -j LOG --log-level info --log-prefix "RULE 17 -- ACCEPT"
iptables -A RULE_17 -j ACCEPT
iptables -N RULE_18
iptables -A OUTPUT -p udp -m udp --sport 123 -j RULE_18
iptables -A INPUT -p udp -m udp --dport 123 -j RULE_18
iptables -A RULE_18 -j LOG --log-level info --log-prefix "RULE 18 -- ACCEPT"
iptables -A RULE_18 -j ACCEPT
iptables -N RULE_19
iptables -A OUTPUT -p tcp -m tcp --dport 3389 -j RULE_19
iptables -A OUTPUT -p udp -m udp --dport 3389 -j RULE_19
iptables -A RULE_19 -j LOG --log-level info --log-prefix "RULE 19 -- ACCEPT"
iptables -A RULE_19 -j ACCEPT
iptables -N RULE_20
iptables -A OUTPUT -s 192.168.0.0/24 -d 192.168.0.0/24 -j RULE_20
iptables -A INPUT -s 192.168.0.0/24 -d 192.168.0.0/24 -j RULE_20
iptables -A RULE_20 -j LOG --log-level info --log-prefix "RULE 20 -- ACCEPT"
iptables -A RULE_20 -j ACCEPT
iptables -N RULE_21
iptables -A OUTPUT -p udp -m udp -j RULE_21
iptables -A INPUT -p udp -m udp -j RULE_21
iptables -A RULE_21 -j LOG --log-level info --log-prefix "RULE 21 -- DENY"
iptables -A RULE_21 -j DROP
iptables -N RULE_22
iptables -A OUTPUT -p tcp -m tcp -j RULE_22
iptables -A INPUT -p tcp -m tcp -j RULE_22
iptables -A RULE_22 -j LOG --log-level info --log-prefix "RULE 22 -- DENY"
iptables -A RULE_22 -j DROP
iptables -N RULE_23
iptables -A OUTPUT -d darkstar -j RULE_23 
iptables -A INPUT -j RULE_23
iptables -A RULE_23 -j LOG --log-level info --log-prefix "RULE 23 -- DENY"
iptables -A RULE_23 -j DROP

Last edited by PROBLEMCHYLD; 10-18-2018 at 09:48 AM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
blocking ports of specified IP with iptables lol_lee_lol Linux - Newbie 6 11-19-2015 08:16 PM
Completly blocking ports with IPTables? Prosaca Linux - Networking 4 04-06-2011 11:03 AM
Blocking specific ports on IPTABLES stonereh Linux - Security 8 02-15-2006 10:49 AM
Blocking access to specific Websites and IP Ports fieldyweb Linux - Newbie 3 12-02-2005 05:32 AM
iptables blocking internal access? complus Linux - Networking 17 03-08-2004 11:14 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:25 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration