Re: [gentoo-user] IPTables - Going Stateless

[Alan McKinnon]

On 21/05/2013 17:07, Nick Khamis wrote:
> Hello Everyone,
>
> We recently moved our stateful firewall inside, and would like to
> strip down the firewall at our router connected to the outside world.
> The problem I am experiencing is getting things to work properly
> without connection tracking.

Now why, oh why, do you want to do that? A world of pain awaits you.

Stateless firewalls are a colossal mindfuck that will drive you crazy.
So unless you have a very very good reason for doing this I recommedn
you seriously revisit your choice. iptables really does not consume that
much resources (and if you truly are low on resources then you need to
get a bigger router, because after all it is a router and I assume in
production)


I hope I am not in breach of mailing list
> rules however, a stripped down configuration is as follows:
>
> #!/bin/bash
> IPTABLES='/sbin/iptables'
>
> #Set interface values
> INTIF1='eth0'
>
> #flush rules and delete chains
> $IPTABLES -F
> $IPTABLES -X
>
> #echo -e "       - Accepting input lo traffic"
> $IPTABLES -A INPUT -i lo -j ACCEPT
>
> #echo -e "       - Accepting output lo traffic"
> $IPTABLES -A OUTPUT -o lo -j ACCEPT
>
> #echo -e "       - Defined Chains"
> $IPTABLES -N TCP
> $IPTABLES -N UDP
>
> #echo -e "       - Accepting SSH Traffic"
> $IPTABLES -A TCP -p tcp -m tcp -s 192.168.2.0/24 -d 192.168.2.5
> --dport 22 -j ACCEPT
> $IPTABLES -A TCP -p tcp -m tcp -s 0.0.0.0/0 -d 192.168.2.5 --dport 22 -j DROP
>
> #echo -e "       - Accepting input TCP and UDP traffic to open ports"
> $IPTABLES -A INPUT -i $INTIF1 -p tcp --syn -j TCP
> $IPTABLES -A INPUT -i $INTIF1 -p udp -j UDP
>
> #echo -e "       - Accepting output TCP and UDP traffic to open ports"
> $IPTABLES -A OUTPUT -o $INTIF1 -p tcp --syn -j TCP
> $IPTABLES -A OUTPUT -o $INTIF1 -p udp -j UDP
>
> #echo -e "       - Dropping input TCP and UDP traffic to closed ports"
> # $IPTABLES -A INPUT -i $INTIF1 -p tcp -j REJECT --reject-with tcp-rst
> # $IPTABLES -A INPUT -i $INTIF1 -p udp -j REJECT --reject-with
> icmp-port-unreachable
>
> #echo -e "       - Dropping output TCP and UDP traffic to closed ports"
> # $IPTABLES -A OUTPUT -o $INTIF1 -p tcp -j REJECT --reject-with tcp-rst
> # $IPTABLES -A OUTPUT -o $INTIF1 -p udp -j REJECT --reject-with
> icmp-port-unreachable
>
> #echo -e "       - Dropping input traffic to remaining protocols sent
> to closed ports"
> # $IPTABLES -A INPUT -i $INTIF1 -j REJECT --reject-with icmp-proto-unreachable
>
> #echo -e "       - Dropping output traffic to remaining protocols sent
> to closed ports"
> # $IPTABLES -A OUTPUT -o $INTIF1 -j REJECT --reject-with icmp-proto-unreachable
>
>
> Everything works fine with the REJECT rules commented out, but when
> included SSH access is blocked out. Not sure why, isn't the sequence
> correct (i.e., the ACCPET entries before the DROP and REJECT)?
>
> Also, any pointers or heads up when going stateless would be greatly
> appreciated.
>
> Kind Regards,
>
> Nick
>


-- 
Alan McKinnon
alan.mckinnon@×××××.com