Gentoo Archives: gentoo-user

From: the guard <the.guard@××××.ru>
To: gentoo-user@l.g.o
Subject: [gentoo-user] Re: [gentoo-user] IPTables - Going Stateless
Date: Tue, 21 May 2013 15:30:42
Message-Id: 1369150221.166497859@f200.mail.ru
1 Вторник, 21 мая 2013, 11:07 -04:00 от Nick Khamis <symack@×××××.com>:
2 > Hello Everyone,
3 >
4 > We recently moved our stateful firewall inside, and would like to
5 > strip down the firewall at our router connected to the outside world.
6 > The problem I am experiencing is getting things to work properly
7 > without connection tracking. I hope I am not in breach of mailing list
8 > rules however, a stripped down configuration is as follows:
9 >
10 > #!/bin/bash
11 > IPTABLES='/sbin/iptables'
12 >
13 > #Set interface values
14 > INTIF1='eth0'
15 >
16 > #flush rules and delete chains
17 > $IPTABLES -F
18 > $IPTABLES -X
19 >
20 > #echo -e " - Accepting input lo traffic"
21 > $IPTABLES -A INPUT -i lo -j ACCEPT
22 >
23 > #echo -e " - Accepting output lo traffic"
24 > $IPTABLES -A OUTPUT -o lo -j ACCEPT
25 >
26 > #echo -e " - Defined Chains"
27 > $IPTABLES -N TCP
28 > $IPTABLES -N UDP
29 >
30 > #echo -e " - Accepting SSH Traffic"
31 > $IPTABLES -A TCP -p tcp -m tcp -s 192.168.2.0/24 -d 192.168.2.5
32 > --dport 22 -j ACCEPT
33 > $IPTABLES -A TCP -p tcp -m tcp -s 0.0.0.0/0 -d 192.168.2.5 --dport 22 -j DROP
34 >
35 > #echo -e " - Accepting input TCP and UDP traffic to open ports"
36 > $IPTABLES -A INPUT -i $INTIF1 -p tcp --syn -j TCP
37 > $IPTABLES -A INPUT -i $INTIF1 -p udp -j UDP
38 >
39 > #echo -e " - Accepting output TCP and UDP traffic to open ports"
40 > $IPTABLES -A OUTPUT -o $INTIF1 -p tcp --syn -j TCP
41 > $IPTABLES -A OUTPUT -o $INTIF1 -p udp -j UDP
42 >
43 > #echo -e " - Dropping input TCP and UDP traffic to closed ports"
44 > # $IPTABLES -A INPUT -i $INTIF1 -p tcp -j REJECT --reject-with tcp-rst
45 > # $IPTABLES -A INPUT -i $INTIF1 -p udp -j REJECT --reject-with
46 > icmp-port-unreachable
47 >
48 > #echo -e " - Dropping output TCP and UDP traffic to closed ports"
49 > # $IPTABLES -A OUTPUT -o $INTIF1 -p tcp -j REJECT --reject-with tcp-rst
50 > # $IPTABLES -A OUTPUT -o $INTIF1 -p udp -j REJECT --reject-with
51 > icmp-port-unreachable
52 >
53 > #echo -e " - Dropping input traffic to remaining protocols sent
54 > to closed ports"
55 > # $IPTABLES -A INPUT -i $INTIF1 -j REJECT --reject-with icmp-proto-unreachable
56 >
57 > #echo -e " - Dropping output traffic to remaining protocols sent
58 > to closed ports"
59 > # $IPTABLES -A OUTPUT -o $INTIF1 -j REJECT --reject-with icmp-proto-unreachable
60 >
61 >
62 > Everything works fine with the REJECT rules commented out, but when
63 > included SSH access is blocked out. Not sure why, isn't the sequence
64 > correct (i.e., the ACCPET entries before the DROP and REJECT)?
65 >
66 > Also, any pointers or heads up when going stateless would be greatly
67 > appreciated.
68 >
69 > Kind Regards,
70 >
71 > Nick
72
73 Looks like the packet never gets to the tcp chain. what is --syn?

Replies

Subject Author
Re: [gentoo-user] Re: [gentoo-user] IPTables - Going Stateless Nick Khamis <symack@×××××.com>