1 |
Вторник, 21 мая 2013, 11:07 -04:00 от Nick Khamis <symack@×××××.com>: |
2 |
> Hello Everyone, |
3 |
> |
4 |
> We recently moved our stateful firewall inside, and would like to |
5 |
> strip down the firewall at our router connected to the outside world. |
6 |
> The problem I am experiencing is getting things to work properly |
7 |
> without connection tracking. I hope I am not in breach of mailing list |
8 |
> rules however, a stripped down configuration is as follows: |
9 |
> |
10 |
> #!/bin/bash |
11 |
> IPTABLES='/sbin/iptables' |
12 |
> |
13 |
> #Set interface values |
14 |
> INTIF1='eth0' |
15 |
> |
16 |
> #flush rules and delete chains |
17 |
> $IPTABLES -F |
18 |
> $IPTABLES -X |
19 |
> |
20 |
> #echo -e " - Accepting input lo traffic" |
21 |
> $IPTABLES -A INPUT -i lo -j ACCEPT |
22 |
> |
23 |
> #echo -e " - Accepting output lo traffic" |
24 |
> $IPTABLES -A OUTPUT -o lo -j ACCEPT |
25 |
> |
26 |
> #echo -e " - Defined Chains" |
27 |
> $IPTABLES -N TCP |
28 |
> $IPTABLES -N UDP |
29 |
> |
30 |
> #echo -e " - Accepting SSH Traffic" |
31 |
> $IPTABLES -A TCP -p tcp -m tcp -s 192.168.2.0/24 -d 192.168.2.5 |
32 |
> --dport 22 -j ACCEPT |
33 |
> $IPTABLES -A TCP -p tcp -m tcp -s 0.0.0.0/0 -d 192.168.2.5 --dport 22 -j DROP |
34 |
> |
35 |
> #echo -e " - Accepting input TCP and UDP traffic to open ports" |
36 |
> $IPTABLES -A INPUT -i $INTIF1 -p tcp --syn -j TCP |
37 |
> $IPTABLES -A INPUT -i $INTIF1 -p udp -j UDP |
38 |
> |
39 |
> #echo -e " - Accepting output TCP and UDP traffic to open ports" |
40 |
> $IPTABLES -A OUTPUT -o $INTIF1 -p tcp --syn -j TCP |
41 |
> $IPTABLES -A OUTPUT -o $INTIF1 -p udp -j UDP |
42 |
> |
43 |
> #echo -e " - Dropping input TCP and UDP traffic to closed ports" |
44 |
> # $IPTABLES -A INPUT -i $INTIF1 -p tcp -j REJECT --reject-with tcp-rst |
45 |
> # $IPTABLES -A INPUT -i $INTIF1 -p udp -j REJECT --reject-with |
46 |
> icmp-port-unreachable |
47 |
> |
48 |
> #echo -e " - Dropping output TCP and UDP traffic to closed ports" |
49 |
> # $IPTABLES -A OUTPUT -o $INTIF1 -p tcp -j REJECT --reject-with tcp-rst |
50 |
> # $IPTABLES -A OUTPUT -o $INTIF1 -p udp -j REJECT --reject-with |
51 |
> icmp-port-unreachable |
52 |
> |
53 |
> #echo -e " - Dropping input traffic to remaining protocols sent |
54 |
> to closed ports" |
55 |
> # $IPTABLES -A INPUT -i $INTIF1 -j REJECT --reject-with icmp-proto-unreachable |
56 |
> |
57 |
> #echo -e " - Dropping output traffic to remaining protocols sent |
58 |
> to closed ports" |
59 |
> # $IPTABLES -A OUTPUT -o $INTIF1 -j REJECT --reject-with icmp-proto-unreachable |
60 |
> |
61 |
> |
62 |
> Everything works fine with the REJECT rules commented out, but when |
63 |
> included SSH access is blocked out. Not sure why, isn't the sequence |
64 |
> correct (i.e., the ACCPET entries before the DROP and REJECT)? |
65 |
> |
66 |
> Also, any pointers or heads up when going stateless would be greatly |
67 |
> appreciated. |
68 |
> |
69 |
> Kind Regards, |
70 |
> |
71 |
> Nick |
72 |
|
73 |
Looks like the packet never gets to the tcp chain. what is --syn? |