How To Install A Custom Iptables Firewall
. This guide is to show you how to edit your iptables if you're running on a server This guide info came from iptables rocks, but i edited a bunch of data to make it suitable for what i want it to do
Check to see if you already have iptables installed
rpm -q iptables
if iptables is installed you should see this outputted in console screen
iptables-1.3.0-2
If iptables is not installed run use this command
up2date -i iptables
Configuring System Files
This will log kernel (user) usage and activities to a log file so that the admin can look at it later
Open terminal and sign in as root (su-)
Then type mkdir /var/log/firewall. This creates the virual directory where all this information will be stored
gedit /etc/syslog.conf
Edit the log file so that it should look like this
#IPTables logging
#kernel messages.
kern.debug;kern.info /var/log/firewall
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
To activate these configurations type/etc/rc.d/init.d/syslog restart
This will make the kernel log activities
Then to make sure FTP sessions run correctly run this command
insmod ip_conntrack_ftp//Book page 1//
Further System Preparation
Well, I dont know about you but wouldnt you like a saftey in case something goes bad... I know that i would, because it wont be fun if you're locked out side of you're system with all that importent data inside... A friend of mine did that do his dad's PC once :)
Go into terminal and type su - and then enter password
Then enter this command (it creats the script(it resets you're settings if you screw up)
vi /root/firewall_reset
# Iptables firewall reset script
*filter
:INPUT ACCEPT [164:15203]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [147:63028]
COMMIT
*mangle
:PREROUTING ACCEPT [164:15203]
:INPUT ACCEPT [164:15203]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [147:63028]
:POSTROUTING ACCEPT [147:63028]
COMMIT
*nat
:PREROUTING ACCEPT [14:672]
:POSTROUTING ACCEPT [9:684]
:OUTPUT ACCEPT [9:684]
COMMIT
pressctrl+s
run this command if you lock you're self out from now on
iptables-restore < /root/firewall_reset
One of the 2 scripts needed
To create script rungedit /root/primary_firewall
#The NAT portion of the ruleset. Used for Network Address Transalation.
#Usually not needed on a typical web server, but it's there if you need it.
*nat
:PREROUTING ACCEPT [127173:7033011]
:POSTROUTING ACCEPT [31583:2332178]
:OUTPUT ACCEPT [32021:2375633]
COMMIT
#The Mangle portion of the ruleset. Here is where unwanted packet types get dropped.
#This helps in making port scans against your server a bit more time consuming and difficult, but not impossible.
*mangle
:PREROUTING ACCEPT [444:43563]
:INPUT ACCEPT [444:43563]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [402:144198]
:POSTROUTING ACCEPT [402:144198]
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
COMMIT
#The FILTER section of the ruleset is where we initially drop all packets and then selectively open certain ports.
#We will also enable logging of all dropped requests.
*filter
:INPUT DROP [1:242]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:LOG_DROP - [0:0]
:LOG_ACCEPT - [0:0]
:icmp_packets - [0:0]
#First, we cover the INPUT rules, or the rules for incoming requests.
#Note how at the end we log any incoming packets that are not accepted.
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j LOG_ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j LOG_ACCEPT
-A INPUT -p tcp -m tcp --dport 43 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
#uncomment the next line if you are running Spamassassin on your server
#-A INPUT -p tcp -m tcp --dport 783 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -s 127.0.0.1 -j ACCEPT
-A INPUT -p icmp -j icmp_packets
-A INPUT -j LOG_DROP
#Next, we cover the OUTPUT rules, or the rules for all outgoing traffic.
#Note how at the end we log any outbound packets that are not accepted.
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 23 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 43 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
#uncomment the next line if you are running Spamassassin on your server
#-A OUTPUT -p tcp -m tcp --dport 783 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A OUTPUT -d 127.0.0.1 -j ACCEPT
-A OUTPUT -p icmp -j icmp_packets
-A OUTPUT -j LOG_DROP
#Here we have 2 sets of logging rules. One for dropped packets to log all dropped requests and one for accepted packets, should we wish to log any accepted requesets.
-A LOG_DROP -j LOG --log-prefix "[IPTABLES DROP] : " --log-tcp-options --log-ip-options
-A LOG_DROP -j DROP
-A LOG_ACCEPT -j LOG --log-prefix "[IPTABLES ACCEPT] : " --log-tcp-options --log-ip-options
-A LOG_ACCEPT -j ACCEPT
#And finally, a rule to deal with ICMP requests. We drop all ping requests except from our own server.
# Make sure you replace 1.2.3.4 with the IP address of your server.
-A icmp_packets -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A icmp_packets -s 1.2.3.4 -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
COMMIT
Then enter iptables-restore < /root/primary_firewall
into the terminal (remeber to be root)
The second firewall script
This script is an advanced program that scans ports constantly for hackers/viruses and other undesireables...Together with the above script you will have a very formidable defense system indeed
Sign in as root
Make this directory
mkdir /var/lock/subsys
Edit this file(type in gedit first :)) /etc/init.d/firewall.iptables
Enter in this code
As root enter in this command
chown root:root /etc/init.d/firewall.iptables
chmod 700 /etc/init.d/firewall.iptables
Then enter cd /etc/init.d
And enter /sbin/chkconfig --level 345 firewall.iptables on
Then enter /etc/init.d/firewall.iptables start
#!/bin/sh
#
# firewall Firewall startup/shutdown script
#
# Version: @(#) /etc/rc.d/init.d/firewall.iptables 23-Dec-2005
#
#
# Translated to iptables format, with several additions and modifications,
# from Craig Zeller's ([email protected]) ipchains-based firewall script, by
# Bob Sully ([email protected])
#
# Thanks to Jeff Carlson ([email protected]) for his assistance re: and several other issues,
# Rohan Amin ([email protected]) and Erik Wasser ([email protected]) for help with the port-forwarding
# routine, and Nate Waddoups for his quick PPTP hack.
#
# Latest revision: 13-Mar-2006
#
# chkconfig: 345 11 91
#
# description: IP Firewall startup/shutdown script for iptables
#
# probe: true
#
#
# CONSTANTS - Do not edit
#
ANYWHERE="0.0.0.0/0" # Match any IP address
BROADCAST_SRC="0.0.0.0" # Broadcast Source Address
BROADCAST_DEST="255.255.255.255" # Broadcast Destination Address
CLASS_A="10.0.0.0/8" # Class-A Private (RFC-1918) Networks
CLASS_B="172.16.0.0/12" # Class-B Private (RFC-1918) Networks
CLASS_C="192.168.0.0/16" # Class-C Private (RFC-1918) Networks
CLASS_D_MULTICAST="224.0.0.0/4" # Class-D Multicast Addresses
CLASS_E_RESERVED_NET="240.0.0.0/5" # Class-E Reserved Addresses
PRIVPORTS="0:1023" # Well-Known, Privileged Port Range
UNPRIVPORTS="1024:65535" # Unprivileged Port Range
TRACEROUTE_SRC_PORTS="32769:65535" # Traceroute Source Ports
TRACEROUTE_DEST_PORTS="33434:33523" # Traceroute Destination Ports
#
# The Loopback interface defines should not be
# edited unless your Linux distribution defines
# these differently.
#
LOOPBACK_INTERFACE="lo" # The loopback interface
LOOPBACK_NETWORK="127.0.0.0/8" # Reserved Loopback Address Range
#
# See how we were called.
#
case "$1" in
start)
echo "Starting Firewall services"
echo "firewall: Configuring Firewall Rules using iptables"
# Remove any existing rules from all chains
iptables -F
iptables -F -t nat
iptables -F -t mangle
# Remove any pre-existing user-defined chains
iptables -X
iptables -X -t nat
iptables -X -t mangle
# Zero counts
iptables -Z
# Set the default policy to drop
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# Allow unlimited traffic on the loopback interface
iptables -A INPUT -i $LOOPBACK_INTERFACE -j ACCEPT
iptables -A OUTPUT -o $LOOPBACK_INTERFACE -j ACCEPT
# A bug that showed up as of the Red Hat 7.2 release results in
# the following 5 default policies breaking the firewall
# initialization:
# fgrep -q '7.2' /etc/redhat-release
# if [ $? -ne 0 ] ; then
# iptables -t nat -P PREROUTING DROP
# iptables -t nat -P OUTPUT DROP
# iptables -t nat -P POSTROUTING DROP
# iptables -t mangle -P PREROUTING DROP
# iptables -t mangle -P OUTPUT DROP
# fi
# Open the configuration file
if [ -f /etc/firewall/firewall.conf.iptables ]; then
. /etc/firewall/firewall.conf.iptables
else
# Turn off IP Forwarding & Masquerading
echo 0 >/proc/sys/net/ipv4/ip_forward
# Turn off dynamic IP hacking
echo "0" > /proc/sys/net/ipv4/ip_dynaddr
echo "firewall: No configuration file found at /etc/firewall/firewall.conf.iptables; "
echo "firewall: default policies set to DROP on INPUT/OUTPUT/FORWARD chains."
exit 1
fi
#
# If your IP address is dynamically assigned by a DHCP server,
# your DHCP server's IP address and this machine's IP address are
# obtained from /etc/dhcpc/hostinfo-$EXTERNAL_INTERFACE or
# /etc/dhcpc/dhcpcd-$EXTERNAL_INTERFACE.info.
#
if [ $DHCP -gt 0 ]; then
# Grab external IP address if already assigned
EXTERNAL_IP=$( ifconfig $EXTERNAL_INTERFACE | grep 'inet[^6]' | sed 's/[a-zA-Z:]//g' | awk '{print $1}' )
if [ -n $EXTERNAL_IP ]; then
EXT_NETMASK=$( ifconfig $EXTERNAL_INTERFACE | grep 'inet[^6]' | sed 's/[a-zA-Z:]//g' | awk '{print $3}' )
EXTERNAL_NETWORK=$( ipcalc -n $EXTERNAL_IP $EXT_NETMASK | grep Network | sed 's/\/[0-9].*//g' | awk '{print $2}' )
BROADCAST_NET=$( ifconfig $EXTERNAL_INTERFACE | grep 'inet[^6]' | sed 's/[a-zA-Z:]//g' | awk '{print $2}' )
fi
# Turn on dynamic IP hacking
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
# Incoming DHCPOFFER from available DHCP servers
iptables -A INPUT -i $EXTERNAL_INTERFACE -p udp \
-s 0.0.0.0 --sport 67 \
-d 255.255.255.255 --dport 68 -j ACCEPT
# Initialization of rebinding: No lease or Lease time expired.
iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp \
-s 0.0.0.0 --sport 68 \
-d 255.255.255.255 --dport 67 -j ACCEPT
# Fall back to initialization
# The client knows its server, but has either lost its
# lease, or else needs to reconfirm the IP address after
# rebooting.
iptables -A INPUT -i $EXTERNAL_INTERFACE -p udp \
-s $DHCP_SERVER_IP --sport 67 \
-d 255.255.255.255 --dport 68 -j ACCEPT
iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp \
-s 255.255.255.255 --sport 68 \
-d $DHCP_SERVER_IP --dport 67 -j ACCEPT
# As a result of the above, we're supposed to change our IP
# address with this message, which is addressed to our new
# address before the dhcp client has received the update.
# Depending on the server implementation, the destination
# address can be the new IP address, the subnet address, or
# the limited broadcast address.
# If the network subnet address is used as the destination,
# the next rule must allow incoming packets destined to the
# subnet address, and the rule must preceed any general rules
# that block such incoming broadcast packets.
iptables -A INPUT -i $EXTERNAL_INTERFACE -p udp \
-s $DHCP_SERVER_IP --sport 67 \
--dport 68 -j ACCEPT
# Lease renewal
iptables -A INPUT -i $EXTERNAL_INTERFACE -p udp \
-s $DHCP_SERVER_IP --sport 67 \
-d $EXTERNAL_IP --dport 68 -j ACCEPT
iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp \
-s $EXTERNAL_IP --sport 68 \
-d $DHCP_SERVER_IP --dport 67 -j ACCEPT
echo "firewall: DHCP Client configured"
else
# External IP assigned without DHCP (i.e. static); get netmask
EXT_NETMASK=$( ifconfig $EXTERNAL_INTERFACE | grep 'inet[^6]' | sed 's/[a-zA-Z:]//g' | awk '{print $3}' )
fi
#
# Refuse directed broadcasts; you may choose not to log these, as they can fill up your logs quickly
#
# iptables -A INPUT -i $EXTERNAL_INTERFACE -d $EXTERNAL_NETWORK \
# -m limit --limit 1/s \
# -j LOG --log-prefix "[Directed Broadcast] "
iptables -A INPUT -i $EXTERNAL_INTERFACE -d $EXTERNAL_NETWORK -j DROP
# iptables -A INPUT -i $EXTERNAL_INTERFACE -d $BROADCAST_NET \
# -m limit --limit 1/s \
# -j LOG --log-prefix "[Directed Broadcast] "
iptables -A INPUT -i $EXTERNAL_INTERFACE -d $BROADCAST_NET -j DROP
# Refuse limited broadcasts
# iptables -A INPUT -i $EXTERNAL_INTERFACE -d 255.255.255.255 \
# -m limit --limit 1/s \
# -j LOG --log-prefix "[Limited Broadcast] "
iptables -A INPUT -i $EXTERNAL_INTERFACE -d 255.255.255.255 -j DROP
#
# Edit these to match the number of servers or connections
# you support.
#
# X Window port allocation begins at 6000 and increments
# for each additional server running from 6000 to 6063.
XWINDOW_PORTS="6000:6063" # (TCP) X Window
