Hi, On Tue, 22 Dec 2015 22:45:12 +0100 siefke_lis...@web.de wrote: > i try to run iptables, block bad ips and close the system. > > I want run firewall which block all INPUT, only ALLOW services i defined. > Ipset want to use to block spam ips, make it sure awesome as ever set rules > manuell. > > Im not so sure is okay, i has try and read but at end often i kick me out > from rootserver. So better ask what say profis of Gentoo. > > The Firewall Script > http://pastebin.com/b3305i41
I recommend you to read a good tutorial first, e.g. this one: https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html It is a bit old and isn't an ultimate description of all iptables features (you have manuals for that), but will give you a good understanding of how packet flow works and how they should be processed. I see three main problems with your current rules: 1. ESTABLISHED,RELATED packets are not accepted in the INPUT. You will have legitimate traffic blocked because of that. 2. Rules are vulnerable to SYN/ACK attack (see manual above on how to fix this). FORWARDed traffic is not protected at all (are tun+ interfaces completely trusted?). 3. Rules are far from being optimal, e.g. instead of having many enrtries for each accepted port, you can write just two rules using multiport target: one for tcp and another one for udp. These way your rules will be much faster. Also you should consider proper ordering of rules: those with higher hit rate should go first if this doesn't impact security scheme. There are minor issues of course, like blacklist check late on the rules (it should come one of the first, otherwise blacklisted hosts will be allowed to connect your open services). For remote debugging I recommend a small script like: ./iptables-current; sleep 1m; iptables-good where iptables-current is the script with your current rules you want to test and iptables-good are tested rules which work for you. This way if you'll screw up with current rules and remote control well be lost, in a minute good old rules will be applied. Of course, you should terminate this command with ^C if new rules are good, so that old ones will not be fired in a minute. Best regards, Andrew Savchenko
pgpZWFGV4tF5F.pgp
Description: PGP signature
