Hi Peter,
You have a long way to go to get your machine save.
I hope you have at least disabled uneeded services in the inet super server.
(see /etc/inetd.conf)
As to your ipchains question. With your rules the server is wide open. They
should not be able to get the other machines on your network unless they
hack the server, which the will !!! However the risk is somewhat deminished,
because you are not permanently online and maybe you have no fixed IP
address either. If that is the case you are no more exposed than an
unprotected Windows machine like most households use it.
Anyway, after having a look at inetd.conf, you should have a close look at
ipchains.
Following is a basic example, but I can only recommend to look further. This
is by no means safe, but is a good start to prevent the worst.
#!/bin/sh
# THIS FIREWALL IS BUILT TO LET THROUGH EVERYTHING UNLESS SPECIFICALLY
DENIED
# Some definitions for easy maintenance.
LOCALHOST="127.0.0.1"
LOCALNET="192.168.100.0/24"
LOCALNET2="192.168.90.0/24"
LOCALNET3="192.168.80.0/24"
IFINTERN1="192.168.100.7"
IFINTERN4="xxxxxxxxxxxxxxxx"
MARK="xxxxxxxxxxxxx"
ANYWHERE="0.0.0.0/0"
UNPRIVPORTS="1024:65535"
PRIVPORTS="0:1023"
# Flush all old unused rules
/sbin/ipchains -F input
/sbin/ipchains -F output
/sbin/ipchains -F forward
# Default policies
/sbin/ipchains -P input ACCEPT
/sbin/ipchains -P output ACCEPT
/sbin/ipchains -P forward DENY
# Protect from IP spoofing (and log any breaches)
/sbin/ipchains -A input -j DENY -i ppp+ -s $LOCALNET -d $ANYWHERE -l
/sbin/ipchains -A input -j DENY -i ppp+ -s $LOCALNET2 -d $ANYWHERE -l
/sbin/ipchains -A input -j DENY -i ppp+ -s $LOCALNET3 -d $ANYWHERE -l
/sbin/ipchains -A input -j DENY -i ppp+ -s $MARK -d $ANYWHERE -l
# Masquerade
/sbin/ipchains -A forward -j MASQ -s $LOCALNET -d $ANYWHERE -i ppp+
/sbin/ipchains -A forward -j MASQ -s $LOCALNET2 -d $ANYWHERE -i ppp+
/sbin/ipchains -A forward -j MASQ -s $LOCALNET3 -d $ANYWHERE -i ppp+
# Accept returning connections
/sbin/ipchains -A input -j ACCEPT ! -y -p tcp -s $ANYWHERE -d $ANYWHERE
# Accept connections to safe ports on server
/sbin/ipchains -A input -j ACCEPT -p tcp -s $ANYWHERE -d $ANYWHERE
$UNPRIVPORTS
/sbin/ipchains -A input -j ACCEPT -p udp -s $ANYWHERE -d $ANYWHERE
$UNPRIVPORTS
# Accept ICMP
/sbin/ipchains -A input -j ACCEPT -p icmp -s $ANYWHERE -d $ANYWHERE
# Accept connections to specific ports on server
/sbin/ipchains -A input -j ACCEPT -p tcp -s $ANYWHERE -d $ANYWHERE 20 -l
/sbin/ipchains -A input -j ACCEPT -p tcp -s $ANYWHERE -d $ANYWHERE 21 -l
/sbin/ipchains -A input -j ACCEPT -p udp -s $ANYWHERE -d $ANYWHERE 20 -l
/sbin/ipchains -A input -j ACCEPT -p udp -s $ANYWHERE -d $ANYWHERE 21 -l
/sbin/ipchains -A input -j ACCEPT -p tcp -s $ANYWHERE -d $ANYWHERE 25
/sbin/ipchains -A input -j ACCEPT -p tcp -s $ANYWHERE -d $ANYWHERE 53
/sbin/ipchains -A input -j ACCEPT -p tcp -s $ANYWHERE -d $ANYWHERE 80
/sbin/ipchains -A input -j ACCEPT -p tcp -s $ANYWHERE -d $ANYWHERE 110 -l
/sbin/ipchains -A input -j ACCEPT -p tcp -s $ANYWHERE -d $ANYWHERE 113
/sbin/ipchains -A input -j ACCEPT -p tcp -s $ANYWHERE -d $ANYWHERE 123
/sbin/ipchains -A input -j ACCEPT -p tcp -s $ANYWHERE -d $ANYWHERE 8080
/sbin/ipchains -A input -j ACCEPT -p udp -s $ANYWHERE -d $ANYWHERE 53
/sbin/ipchains -A input -j ACCEPT -p udp -s $ANYWHERE -d $ANYWHERE 123
/sbin/ipchains -A input -j ACCEPT -p udp -s $ANYWHERE -d $ANYWHERE 3130
# Accept more from LOCALNET
#/sbin/ipchains -A input -j ACCEPT -p tcp -s $LOCALNET -d $ANYWHERE 20
#/sbin/ipchains -A input -j ACCEPT -p tcp -s $LOCALNET -d $ANYWHERE 21
/sbin/ipchains -A input -j ACCEPT -p tcp -s $LOCALNET -d $ANYWHERE 110
/sbin/ipchains -A input -j ACCEPT -p tcp -s $LOCALNET -d $ANYWHERE 25
#/sbin/ipchains -A input -j ACCEPT -p udp -s $LOCALNET -d $ANYWHERE 20
#/sbin/ipchains -A input -j ACCEPT -p udp -s $LOCALNET -d $ANYWHERE 21
/sbin/ipchains -A input -j ACCEPT -p tcp -s $LOCALNET -d $ANYWHERE 139
/sbin/ipchains -A input -j ACCEPT -p tcp -s 192.168.100.7 -d $ANYWHERE
$PRIVPORTS
/sbin/ipchains -A input -j ACCEPT -p udp -s 192.168.100.7 -d $ANYWHERE
$PRIVPORTS
/sbin/ipchains -A input -j ACCEPT -p tcp -s 192.168.100.3 -d 192.168.100.7
$PRIVPORTS
/sbin/ipchains -A input -j ACCEPT -p udp -s 192.168.100.3 -d 192.168.100.7
$PRIVPORTS
/sbin/ipchains -A input -j ACCEPT -p tcp -s 192.168.100.4 -d 192.168.100.7
$PRIVPORTS
/sbin/ipchains -A input -j ACCEPT -p udp -s 192.168.100.4 -d 192.168.100.7
$PRIVPORTS
# Accept specific hosts to specific ports on server (and to anywhere)
# SSH
/sbin/ipchains -A input -j ACCEPT -p tcp -s 192.168.100.101 -d $ANYWHERE 22
/sbin/ipchains -A input -j ACCEPT -p tcp -s 192.168.100.103 -d $ANYWHERE 22
# linuxconf
/sbin/ipchains -A input -j ACCEPT -p tcp -s 192.168.100.101 -d $ANYWHERE 98
/sbin/ipchains -A input -j ACCEPT -p tcp -s 192.168.100.103 -d $ANYWHERE 98
# SMB
/sbin/ipchains -A input -j ACCEPT -p tcp -s 192.168.100.101 -d $ANYWHERE 139
/sbin/ipchains -A input -j ACCEPT -p tcp -s 192.168.100.103 -d $ANYWHERE 139
# Time Server
/sbin/ipchains -A input -j ACCEPT -p tcp -s 203.2.75.2 -d $ANYWHERE 123
/sbin/ipchains -A input -j ACCEPT -p udp -s 203.2.75.2 -d $ANYWHERE 123
# Deny all other requests directly to server (and log any breaches)
/sbin/ipchains -A input -j DENY -s $ANYWHERE -d $IFINTERN1 -l
/sbin/ipchains -A input -j DENY -s $ANYWHERE -d $IFINTERN4 -l
When you write a rule set you have to remember, that when an IP packet tries
to pass the firewall it will be tested against the rules in order from top
to bottom. One of 2 things will happen:
1. A rule applies
The rule is actioned accordingly (in this example either DENY or ACCEPT or
forward MASQ). The packet has passed the firewall or has been denied or
masq'd.
OR
2. A rule does not apply
It goes to the next rule, then to the next.... until all rules have been
tried. Then the default policy is actioned.
(
/sbin/ipchains -P input ACCEPT
/sbin/ipchains -P output ACCEPT
/sbin/ipchains -P forward DENY
)
Hope this helps
Bernhard
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Peter Rundle
Sent: Wednesday, 10 May 2000 18:32
To: [EMAIL PROTECTED]
Subject: [SLUG] Simple IPChains setup example required.
Hi sluggers,
Well in doing my bit to help the world domination cause ;-)
I've been asked to set up a linux server to act as the
gateway to the internet modem on a small 98 office network.
I've got ipmasq and dial-on-demand working fine, and if a
user on a lose98 box tries to read their mail or hit a web
site the modem dials and 15secs latter bingo, it's a beautiful
thing.
However the ipchains command that the Linux book i've used
suggested is;
ipchains -P forward DENY
ipchains -A forward -s 192.168.1.0/24 -j MASQ
I got confused trying to figure out the difference between
input, output and forward chains. So my question is how secure
is the above? Basically I want it so that only the users of
the network can start a tcp/ip session through the linux box
and any session initiated from the outside will be denied.
(also for the linux box itself, don't want the gateway box
hacked down!)
Any suggested ipchain rules for above environment?
Thanks
Pete
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
