Re: [gentoo-user] Re: workstation iptables

[Mick]

On Wednesday 07 Oct 2015 14:23:39 James wrote:
> Mick <michaelkintzios <at> gmail.com> writes:
> > > http://gentoo-en.vfose.ru
> > > /wiki/IptablesIptables_and_stateful_firewalls#State_basics
> >
> > Start iptables, run the script, stop iptables with '/etc/init.d/iptables
> > >
>
> stop' which will save your rules to /var/lib/iptables/rules-save,
>
>
> after starting  iptables, I ran /etc/firewall.sh (the previously published
> script) and the stop with the syntax above::
>
> cat /var/lib/iptables/rules-save
> # Generated by iptables-save v1.4.21 on Wed Oct  7 09:13:59 2015
> *mangle
>
> :PREROUTING ACCEPT [16022765:14170972269]
> :INPUT ACCEPT [16022479:14170935323]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [19311825:1508198446]
> :POSTROUTING ACCEPT [19311825:1508198446]
>
> COMMIT
> # Completed on Wed Oct  7 09:13:59 2015
> # Generated by iptables-save v1.4.21 on Wed Oct  7 09:13:59 2015
> *filter
>
> :INPUT DROP [471:17192]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [722751:44404539]
>
> [740388:740719942] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
> COMMIT
> # Completed on Wed Oct  7 09:13:59 2015
>
>
> was the ouput.

Are you sure that restarting iptables did not produce errors on the CLI?  The 
script you are using is somewhat old and the iptables syntax has changed since 
then.  

Have a look here:

 https://wiki.gentoo.org/wiki/Iptables


Your single rule line above should therefore look like this:

 -A INPUT -i eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

but before this rule you should specify a default policy for your INPUT and 
other chains - ideally one to DROP all packets coming in and allow all going 
out; e.g.

 -P INPUT DROP
 -P FORWARD DROP
 -P OUTPUT ACCEPT

Also, to accept any INPUT packets on interfaces other than eth0, you would 
precede these lines with:

 -A INPUT ! -i eth0 -j ACCEPT


More details on syntax can be found in 'man iptables-extensions'.  You will 
need to modify your script accordingly for this new syntax.  To see if you are 
getting syntax errors run each rule on the CLI first, e.g.

 /sbin/iptables -A INPUT -i eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j 
ACCEPT

and check that it takes with:

 /sbin/iptables -L -v -n

NOTE: The order in which you add iptables rules on the CLI is the order in 
which they will end up listed in /var/lib/iptables/rules-save.


BTW, I recall a thread posted for a firewall script within the last couple of 
years, but can't recall exactly who was the contributor.  Have a quick search 
in Gmane to see if you can find it.


> sysctl is not set up. I did find this page on that::
> https://wiki.gentoo.org/wiki/Procfs
>
> Any suggestions on setting up sysctl for iptables and other future
> usage?

According to the URL you posted above you should use /etc/sysctl.d/local.conf, 
rather than the legacy /etc/sysctl.conf which I suggested.  Apologies for a 
bum steer.  Use your previous URL for stateful firewalls to see what sysctl 
settings you need to add here.


> > nmap -A -T4 -P0 -vvv -p1-65535 XXX.XX.XXX.XX
>
> Worked flawlessly. Very precise syntax (thanks). Here are the highlights::
>
> Not shown: 65534 closed ports

Not good.  Unless you have set up a default policy to REJECT packets, this 
shows ports that are not firewalled, but happen to be closed (no service is 
running there).  If you had a DROP policy/rule for INPUT packets it should say 
"65534 filtered ports".


> PORT   STATE SERVICE VERSION
> 22/tcp open  ssh     OpenSSH 5.9p1-hpn13v11lpk (protocol 2.0)

Not good.  Unless you have also defined a rule for allowing connections to 
port 22, this shows an open port, to which a service (ssh) is currently 
listening for incoming connections.

If you want to only allow ssh connections from some local address 
192.168.1.27, you can try adding a rule for it like this:

-A INPUT -s 192.168.1.27/32 -i eth0 -p tcp -m conntrack --ctstate NEW -m mac 
--mac-source 67:35:AC:34:89:48 -m conntrack --ctorigdstport 22 -j ACCEPT


> Not bad for a quick workstation firewall(s). After I get sysctl setup,
> I'll test a few other verssions and post again. Then wikify these
> for community consumption.

Your script needs more work.  Look first at the iptables URL I posted above, 
which has the modern syntax.  Also, either define a default INPUT chain policy 
to DROP or REJECT packets, or end your script with rules to drop all other 
packets, not already accepted by previous rules:

-A INPUT -i eth0 -j DROP

PS.  Instead of running some script, you can always specify your rules in your 
/var/lib/iptables/rules-save and also back it up.  Then use this file to 
change settings as you see fit and reload/start the firewall for the settings 
to take.

-- 
Regards,
Mick