Re: [gentoo-user] iptables on gentoo

[A. Khattri]

On Thu, 27 Oct 2005, James wrote:

> Question 1:
> I'm planning on using nmap and nessus  to test from the outside(internet)
> inward). On the inside I plan on using snort, an monitoring the various
> log files. Any further suggestions on testing?

Plain ole telnet works for testing protocols too ;-)

> /etc/init.d/firewall  is the default file where where you put your rules you
> have written or grabbed elsewhere and modified to meet your specific needs.

Not sure where this script came from - it doesn't come with iptables.

> /var/lib/iptables/rules-save is the file that will save out from kernel memory
> the actual rulesets being used. This file is also reloaded as necessary. Avoid
> direct modifications to this.
>
> Is this explanation correct? Did I miss something or get something confused.
> I could not really find any documentation on this, so much was inference
> from various linux sites, some very old, and a few gentoo specific sites.

Not much to it. Make your rules and use "/etc/init.d/iptables save" to
save 'em. When you restart iptables it will automatically load them from
/var/lib/iptables/rules-save if it finds that file.

> Assuming this is correct, I have seen many command line options and
> differing recommendations on how to modify the rules and when to save
> them out and to what file. Any details one can provide, that are gentoo
> specific, are most welcome.

None of these are Gentoo specific (there aren't any Gentoo specifics in
iptables AFAIK).

Some notes:

I wrote all the rules out "by hand" and tested them. Any tweaks I did
directly on the command line. Bear in mind that the order of the rules is
pretty important (I use the --line-numbers option so you know what line
numbers to insert/delete after when changing the ordering of rules, i.e.
iptables -L -n --line-numbers).

Obviously you'll be doing this from the console directly.

I broke rules down into various groups that I separated out into chains.

So the first chain (called SCRUB) gets rid of obvious bogus packets (like
packets from 192.168.x.x etc etc). Another chain is called BANNED (for
obvious reasons). And so on.

When working with chains its easier to make the chain and rules first and
then "activate" them by adding a rule to the INPUT chain to send
all packets through it, e.g.

iptables -A INPUT -j SCRUB

Dont forget to set default policies for your chains.

Often its better to start with a completely locked down machine and add
rules for those ports you want to open.

Make use of of the state module if you can (it understands FTP, IRC and a
few other protocols) which makes it trivial to write state tracking rules.

If you iptables extensions are built as modules (not recommended - if one
fails to load you might compromise security) then make sure they are
loaded - some rules do NOT load the corresponding modules automatically so
beware.

If you need any help, post on this list.


-- 

-- 
gentoo-user@g.o mailing list