Hi, A typical ipchains rule set to allow outgoing telnet sessions looks like this: ipchains -A input -p tcp -s $ETH0_NET -d $ALL telnet -j ACCEPT ipchains -A input -p tcp -d $ETH0_NET -s $ALL telnet -j ACCEPT According to the ipchains guides, and various HOWTOs, I'd set up the second rule to allow incoming packets from the various telnet servers I'd connected to to reach my network. It's basically the reverse of the first rule. If I want to create a rule in my ipchains ruleset that allows outgoing connections on any TCP or UDP port from my local network ($ETH0_NET) to the internet (defined as ALL=0/0), I'd set up a rule like this: ipchains -A input -s $ETH0_NET -d $ALL -j ACCEPT That would allow me to create an outgoing socket connection, or sendto() an outgoing UDP port. To allow the incoming packets the reverse rule is: ipchains -A input -d $ETH0_NET -s $ALL -j ACCEPT This rule is nasty. It allows all incoming connections to my network from anywhere. Not what I really want. A lot of the ipchains scripts I've seen do things like this: ipchains -A input -s $ETH0_NET 1024:65535 -d $ALL -j ACCEPT ipchains -A input -d $ETH0_NET 1024:65535 -s $ALL -j ACCEPT ... this only allows connections on the unpriveleged ports that are likely to be used for outgoing connections. This is starting to become unsuitable since many programs now bind to these ports for incoming connections (eg: most databases), and also these ports are often used for hacks (eg: NetBus, BackOrifice). Even with the fairly restrictive rule pair at the top, there's nothing to stop a malicious user who has root access on their system on the internet creating a socket on the telnet port and using it to bash away at the high ports on my server. Does anyone have a good solution to this problem? Can I somehow allow connections inward only to those ports that are used for outgoing connections and not in use by services such as MySQL which I want to protect from the internet? ----+------------------------+-------------------------- Del | mailto:[EMAIL PROTECTED] | Christchurch, New Zealand ----+------------------------+-------------------------- -- SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au To unsubscribe send email to [EMAIL PROTECTED] with unsubscribe in the text
