Last Revised:
05/15/2003
(Document is Still In Development/Beta Status)
The most recent revision of this document should always be available at our website, with the following direct URL:
http://www.lvwnet.com/vince/linux/Keepalived-LVS-NAT-Director-ProxyArp-Firewall-HOWTO.html
|
Networking Options <*> Packet socket [*] Packet socket: mmapped IO < > Netlink device emulation [*] Network packet filtering (replaces ipchains) [ ] Network packet filtering debugging [ ] Socket Filtering <*> Unix domain sockets [*] TCP/IP networking [*] IP: multicasting [*] IP: advanced router [*] IP: policy routing [*] IP: use netfilter MARK value as routing key [*] IP: fast network address translation [*] IP: equal cost multipath [ ] IP: use TOS value as routing key [*] IP: verbose route monitoring [ ] IP: large routing tables [ ] IP: kernel level autoconfiguration <*> IP: tunneling <*> IP: GRE tunnels over IP [ ] IP: broadcast GRE over IP [*] IP: multicast routing [*] IP: PIM-SM version 1 support [*] IP: PIM-SM version 2 support [ ] IP: ARP daemon support (EXPERIMENTAL) [ ] IP: TCP Explicit Congestion Notification support [*] IP: TCP syncookie support (disabled per default) IP: Netfilter Configuration ---> IP: Virtual Server Configuration ---> < > The IPv6 protocol (EXPERIMENTAL) < > Kernel httpd acceleration (EXPERIMENTAL) [ ] Asynchronous Transfer Mode (ATM) (EXPERIMENTAL) <M> 802.1Q VLAN Support --- < > The IPX protocol < > Appletalk protocol support Appletalk devices ---> < > DECnet Support < > 802.1d Ethernet Bridging < > CCITT X.25 Packet Layer (EXPERIMENTAL) < > LAPB Data Link Driver (EXPERIMENTAL) [ ] 802.2 LLC (EXPERIMENTAL) [ ] Frame Diverter (EXPERIMENTAL) < > Acorn Econet/AUN protocols (EXPERIMENTAL) < > WAN router [ ] Fast switching (read help!) [ ] Forwarding between high speed interfaces QoS and/or fair queueing ---> Network testing ---> |
|
IP: Netfilter Configuration <*> Connection tracking (required for masq/NAT) <*> FTP protocol support < > IRC protocol support < > Userspace queueing via NETLINK (EXPERIMENTAL) <*> IP tables support (required for filtering/masq/NAT) <*> limit match support <M> MAC address match support <*> Packet type match support (EXPERIMENTAL) <*> netfilter MARK match support <M> Multiple port match support <M> TOS match support <*> psd match support <*> AH/ESP match support <*> LENGTH match support <*> TTL match support <M> tcpmss match support <*> Connection state match support <*> Connections/IP limit match support <M> Unclean match support (EXPERIMENTAL) <M> Owner match support (EXPERIMENTAL) <*> Packet filtering <*> REJECT target support <*> MIRROR target support (EXPERIMENTAL) <*> Full NAT <*> MASQUERADE target support <*> REDIRECT target support [ ] NAT of local connections (READ HELP) < > Basic SNMP-ALG support (EXPERIMENTAL) <*> Packet mangling <*> TOS target support <*> MARK target support <*> LOG target support <*> TTL target support < > ULOG target support <M> TCPMSS target support <M> ARP tables support <M> ARP packet filtering |
|
IP: Virtual Server Configuration <*> virtual server support (EXPERIMENTAL) [*] IP virtual server debugging (14) IPVS connection hash table size (the Nth power of 2) <--- (NOTE: 16,384 connections) --- IPVS scheduler <M> round-robin scheduling <M> weighted round-robin scheduling <M> least-connection scheduling scheduling <M> weighted least-connection scheduling <M> locality-based least-connection scheduling <M> locality-based least-connection with replication scheduling <M> destination hashing scheduling <M> source hashing scheduling --- IPVS application helper <M> FTP protocol helper |
| global_defs { |
| lvs_id lvs1 |
| } |
| # VRRP Instances |
| vrrp_sync_group VG1 { |
| group { |
| EXT |
| INT |
| } |
| } |
| vrrp_instance EXT { |
| state MASTER |
| interface eth1 |
| lvs_sync_daemon_interface eth0 |
| mcast_src_ip 192.168.0.1 |
| debug 0 |
| virtual_router_id 51 |
| priority 150 |
| advert_int 5 |
| authentication { |
| auth_type PASS |
| auth_pass zoiks! |
| } |
| virtual_ipaddress { |
| 10.1.2.95/26 |
| 10.1.2.80 |
| 10.1.2.81 |
| 10.1.2.82 |
| } |
| virtual_routes { |
| src 10.1.2.95 to 10.1.2.65 dev eth1 |
| src 10.1.2.95 to 0.0.0.0/0 via 10.1.2.65 dev eth1 |
| } |
| # This script will come behind the master takeover |
| # process and take care of a few extra things for us |
| # (since we are running a Proxy Arp firewall). |
| # |
| notify_master "/etc/keepalived/proxyarpfix" |
| } |
| vrrp_instance INT { |
| state MASTER |
| interface eth0 |
| lvs_sync_daemon_interface eth0 |
| mcast_src_ip 192.168.0.1 |
| debug 0 |
| virtual_router_id 52 |
| priority 150 |
| advert_int 5 |
| authentication { |
| auth_type PASS |
| auth_pass scooby! |
| } |
| virtual_ipaddress { |
| 10.1.2.95/26 |
| 192.168.0.254/24 |
| } |
| virtual_routes { |
| src 10.1.2.95 to 10.1.2.80/28 dev eth0 |
| } |
| } |
| virtual_server 10.1.2.80 25 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.111 25 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 25 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.211 25 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 25 |
| connect_timeout 3 |
| } |
| } |
| } |
| # Optional SMTP High Port for remote users who have |
| # ISP's that try to stop spammers from using their |
| # service by blocking outbound destination port 25. |
| # We have to give those users another port to use |
| # to get around this, and they will need to configure |
| # their email client's SMTP server port number for your |
| # SMTP server to use the high port number instead. |
| # |
| virtual_server 10.1.2.80 20025 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.111 25 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 25 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.211 25 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 25 |
| connect_timeout 3 |
| } |
| } |
| } |
| virtual_server 10.1.2.80 53 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.111 53 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 53 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.211 53 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 53 |
| connect_timeout 3 |
| } |
| } |
| } |
| virtual_server 10.1.2.80 53 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol UDP |
| ha_suspend |
| real_server 192.168.0.111 53 { |
| weight 1 |
| } |
| real_server 192.168.0.211 53 { |
| weight 1 |
| } |
| } |
| virtual_server 10.1.2.81 53 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.111 53 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 53 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.211 53 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 53 |
| connect_timeout 3 |
| } |
| } |
| } |
| virtual_server 10.1.2.81 53 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol UDP |
| ha_suspend |
| real_server 192.168.0.111 53 { |
| weight 1 |
| } |
| real_server 192.168.0.211 53 { |
| weight 1 |
| } |
| } |
| virtual_server 10.1.2.80 80 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.111 80 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 80 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.211 80 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 80 |
| connect_timeout 3 |
| } |
| } |
| } |
| virtual_server 10.1.2.80 443 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| persistence_timeout 600 |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.111 443 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 443 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.211 443 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 443 |
| connect_timeout 3 |
| } |
| } |
| } |
| virtual_server 10.1.2.80 110 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.111 110 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 110 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.211 110 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 110 |
| connect_timeout 3 |
| } |
| } |
| } |
| # VIP for 2nd hosted domain's website |
| # We will direct traffic coming in on |
| # this VIP:80 to different IP's on the |
| # Real Servers, where Apache is |
| # listening for this IP-based VirtualHost. |
| virtual_server 10.1.2.82 80 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.112 80 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 80 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.212 80 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 80 |
| connect_timeout 3 |
| } |
| } |
| } |
| global_defs { |
| lvs_id lvs2 |
| } |
| # VRRP Instances |
| vrrp_sync_group VG1 { |
| group { |
| EXT |
| INT |
| } |
| } |
| vrrp_instance EXT { |
| state BACKUP |
| interface eth1 |
| lvs_sync_daemon_interface eth0 |
| mcast_src_ip 192.168.0.2 |
| debug 0 |
| virtual_router_id 51 |
| priority 100 |
| advert_int 5 |
| authentication { |
| auth_type PASS |
| auth_pass zoiks! |
| } |
| virtual_ipaddress { |
| 10.1.2.95/26 |
| 10.1.2.80 |
| 10.1.2.81 |
| 10.1.2.82 |
| } |
| virtual_routes { |
| src 10.1.2.95 to 10.1.2.65 dev eth1 |
| src 10.1.2.95 to 0.0.0.0/0 via 10.1.2.65 dev eth1 |
| } |
| # This script will come behind the master takeover |
| # process and take care of a few extra things for us |
| # (since we are running a Proxy Arp firewall). |
| # |
| notify_master "/etc/keepalived/proxyarpfix" |
| } |
| vrrp_instance INT { |
| state BACKUP |
| interface eth0 |
| lvs_sync_daemon_interface eth0 |
| mcast_src_ip 192.168.0.2 |
| debug 0 |
| virtual_router_id 52 |
| priority 100 |
| advert_int 5 |
| authentication { |
| auth_type PASS |
| auth_pass scooby! |
| } |
| virtual_ipaddress { |
| 10.1.2.95/26 |
| 192.168.0.254/24 |
| } |
| virtual_routes { |
| src 10.1.2.95 to 10.1.2.80/28 dev eth0 |
| } |
| } |
| virtual_server 10.1.2.80 25 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.111 25 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 25 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.211 25 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 25 |
| connect_timeout 3 |
| } |
| } |
| } |
| # Optional SMTP High Port for remote users who have |
| # ISP's that try to stop spammers from using their |
| # service by blocking outbound destination port 25. |
| # We have to give those users another port to use |
| # to get around this, and they will need to configure |
| # their email client's SMTP server port number for your |
| # SMTP server to use the high port number instead. |
| # |
| virtual_server 10.1.2.80 20025 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.111 25 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 25 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.211 25 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 25 |
| connect_timeout 3 |
| } |
| } |
| } |
| virtual_server 10.1.2.80 53 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.111 53 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 53 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.211 53 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 53 |
| connect_timeout 3 |
| } |
| } |
| } |
| virtual_server 10.1.2.80 53 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol UDP |
| ha_suspend |
| real_server 192.168.0.111 53 { |
| weight 1 |
| } |
| real_server 192.168.0.211 53 { |
| weight 1 |
| } |
| } |
| virtual_server 10.1.2.81 53 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.111 53 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 53 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.211 53 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 53 |
| connect_timeout 3 |
| } |
| } |
| } |
| virtual_server 10.1.2.81 53 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol UDP |
| ha_suspend |
| real_server 192.168.0.111 53 { |
| weight 1 |
| } |
| real_server 192.168.0.211 53 { |
| weight 1 |
| } |
| } |
| virtual_server 10.1.2.80 80 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.111 80 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 80 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.211 80 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 80 |
| connect_timeout 3 |
| } |
| } |
| } |
| virtual_server 10.1.2.80 443 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| persistence_timeout 600 |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.111 443 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 443 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.211 443 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 443 |
| connect_timeout 3 |
| } |
| } |
| } |
| virtual_server 10.1.2.80 110 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.111 110 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 110 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.211 110 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 110 |
| connect_timeout 3 |
| } |
| } |
| } |
| # VIP for 2nd hosted domain's website |
| # We will direct traffic coming in on |
| # this VIP:80 to different IP's on the |
| # Real Servers, where Apache is |
| # listening for this IP-based VirtualHost. |
| virtual_server 10.1.2.82 80 { |
| delay_loop 3 |
| lb_algo rr |
| lb_kind NAT |
| protocol TCP |
| ha_suspend |
| real_server 192.168.0.112 80 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 80 |
| connect_timeout 3 |
| } |
| } |
| real_server 192.168.0.212 80 { |
| weight 1 |
| TCP_CHECK { |
| connect_port 80 |
| connect_timeout 3 |
| } |
| } |
| } |
|
#!/bin/bash # # keepalived proxyarpfix notify_master script # # Drop the larger ISP subnet route on our DMZ interface - # The kernel adds this route since we defined an IP on # the DMZ interface with a /26 netmask (which is correct), # but only /28 of the ISP's subnet can really be reached # in our DMZ. The rest of them can only be reached on the # external interface through the ISP gateway. # /sbin/ip route del 10.1.2.80/26 dev eth0 # temporarily turn on the ability to arping an IP we don't have # on a local interface # echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind # ARPING # Note: The '&' symbol at the end of each of the arping # command lines in this script is important - we don't want # to wait for the first arping to finish executing before # we start the next one - this has to be done ASAP!!! # # Any additional hosts in the DMZ which get set up with # one of our routable static IP's will NEED to be added to # this script, in BOTH sections (ISP Gateway and DMZ)!!! # # # ISP Gateway Section # # 10.1.2.93 and 10.1.2.94 are DMZ hosts with routable IP's # in our /28 block. 10.1.2.65 is our ISP's gateway. Since # we're doing proxy arp, we have to update our ISP's arp # cache with the MAC addr of the new active Director's # external interface (posing as each DMZ host). # /sbin/arping -U -I eth1 -c 3 -s 10.1.2.93 10.1.2.65 & /sbin/arping -U -I eth1 -c 3 -s 10.1.2.94 10.1.2.65 & # DMZ Section # # Now we will update our DMZ hosts' arp cache with the MAC addr # of the new Director's internal interface (posing as ISP gateway): # /sbin/arping -U -I eth0 -c 3 -s 10.1.2.65 10.1.2.93 & /sbin/arping -U -I eth0 -c 3 -s 10.1.2.65 10.1.2.94 & # Give all of the arpings time to finish. 5 seconds should # be long enough, but if running this script manually on # your box yields ANY "bind: cannot assign requested address" # messages, you may need to increase this value. /bin/sleep 5 # OK turn the sysctl back off now # echo 0 > /proc/sys/net/ipv4/ip_nonlocal_bind exit 0 |
|
/sbin/iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT |
|
/sbin/iptables -A FORWARD -i eth1 -o eth0 -p tcp --syn -d $APACHE1 --dport 80 -m state --state NEW -j ACCEPT |
|
# Allow ESTABLISHED and RELATED traffic in from the external interface. This rule # covers IPVS traffic (connections in progress with Real Servers), as well as # non-IPVS connections that THIS server has in progress with the outside. # /sbin/iptables -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT # Let new SYN packets in on port 80, if the destination IP is the VIP of our # webserver, so IPVS can see them. ($APACHEVIP1 is a variable, assumed to be # previously defined in the script). # /sbin/iptables -A INPUT -i eth1 -p tcp --syn -d $APACHEVIP --dport 80 -m state --state NEW -j ACCEPT |
|
/sbin/iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT # (our FTP server is a standalone DMZ host with its own routable IP, # it is not an LVS virtual service, so unlike traffic headed for # IPVS-managed services, we have to have a rule to allow new # connection requests through): # /sbin/iptables -A FORWARD -i eth1 -o eth0 -p tcp --syn -d $FTPSERVER --dport 21 -m state --state NEW -j ACCEPT |
|
#!/bin/bash # # This script needs to be made executable to run (chmod 700 or 750). # # An example iptables stateful firewall script for IPVS LVS-NAT # Directors running with the Antefacto netfilter-conntrack patch. # ###################################################################### # VARIABLES # Here we will define some variables we will use throughout the script. ###################################################################### # # DEFAULT LOG LEVEL # By setting the default log level to 6, when we get a firewall hit, # it only writes it to the system logs, it doesn't throw it up on # every virtual console also (that's really annoying). # # If you want a firewall log event, use the variable $LOG in the # rule, without a -j in front of it. And if you want a custom log # prefix for that log rule, add a --log-prefix "CustomLogPrefix" # to the end. # # Examples: # I want this logged with no custom log (?) # /sbin/iptables -A INPUT -i $EXTIF -p tcp -s 1.2.3.4 $LOG # # I want this logged with a custom log prefix # /sbin/iptables -A INPUT -i $EXTIF -p tcp -s 3.4.5.6 $LOG --log-prefix "Some Hacker! :" # LOG="-j LOG --log-level 6" ###################################################################### # # ADDRESS VARIABLES # # Our Routable IP Address Space (Network ID) # (IP's we will route traffic for) OURIPBLOCK="10.1.2.80/28" # Broadcast Address for the ISP's subnet mask # Although we may have use/need for broadcast to # DMZ Hosts, we will not allow broadcast traffic # out of the external interface. DMZBROAD="10.1.2.127" echo "ISP Subnet Broadcast Address (DMZ Use Only):" $DMZBROAD # LVS VIP Addresses VIP1="10.1.2.80" VIP2="10.1.2.81" VIP3="10.1.2.82" MYIP="10.1.2.95" # DMZ HOSTS with Routable IP Addresses # # Our FTP Server (not LVS) PUBFTP="10.1.2.93" # INTERNAL NAT GATEWAY/FIREWALL # The NAT gateway is an internal firewall host in # the DMZ, which routes all traffic to/from the # internet for our internal network hosts. We # use one of our static IP's as a "source NAT" # address for all internal internet traffic. # "Source NAT" is the way to do IP Masquerading # with iptables when you have a static IP address # to NAT with. # # Note that the actual SNAT work will be done on the # internal firewall host with a POSTROUTING rule. We # have this variable here because we will need some # specific ACCEPT rules on this firewall to allow # certain types of NEW connections to come in from the # outside, and make it to the internal NAT gateway # where the traffic will actually be forwarded in # to the internal network hosts. # SNATIP="10.1.2.94" # DMZ LAN IP Subnet # IP Subnet of LVS Real Servers and other # internal hosts with internal "mgmt" # IP's. DMZLAN="192.168.0.0/24" # IP Address of the DSL Modem CPE device DSLMODEMIP="192.168.1.1" echo DSL Modem IP Address: $DSLMODEMIP # DSL Modem IP Address w/Netmask DSLIPMASK="192.168.1.1/29" echo "DSL Modem IP Address w/NetMask:" $DSLIPMASK # Our IP Address on the CPE Mgmt Subnet CPELANIP="192.168.1.2" echo OUR IP Address on CPE Mgmt Subnet: $CPELANIP # Our IP Address on the CPE Mgmt Subnet w/Netmask # (make this different on the backup director) CPELANIPMASK="192.168.1.2/29" echo "OUR IP Address on CPE Mgmt Subnet w/Netmask:" $CPELANIPMASK ###################################################################### # # INTERFACE VARIABLES # # External Interface (connected to internet) EXTIF="eth1" # DMZ Interface DMZIF="eth0" ###################################################################### # # OTHER VARIABLES # # XWindow Ports XWINPORTS="6000:6063" ###################################################################### # # FIREWALL SYSCTLS # # TURN OFF IP FORWARDING IN THE LINUX KERNEL UNTIL COMPLETE # SET OF FIREWALL RULES ARE LOADED echo "0" > /proc/sys/net/ipv4/ip_forward # Turn OFF PROXY ARP functionality until all of the firewall rules # are loaded. Note that without an address on a certain interface, # we cannot actually toggle the value of proxy_arp, because the # sysctl for that interface doesn't exist until it has an address. # But by setting the default proxy_arp value, as soon as an address # is put on the interface, the proxy_arp sysctl will come up for # the interface, with the default value. echo "0" > /proc/sys/net/ipv4/conf/$DMZIF/proxy_arp echo "0" > /proc/sys/net/ipv4/conf/$EXTIF/proxy_arp echo "0" > /proc/sys/net/ipv4/conf/all/proxy_arp echo "0" > /proc/sys/net/ipv4/conf/default/proxy_arp # Disable IP spoofing attacks. # echo " - Disabling IP Spoofing attacks." for file in /proc/sys/net/ipv4/conf/*/rp_filter; do echo "1" > $file done # Enable TCP SYN Cookies # echo " - Enabling TCP SYN Cookies" echo "1" > /proc/sys/net/ipv4/tcp_syncookies # ICMP SYSCTLS # echo " - Setting ICMP handling controls" # Enable ICMP broadcast echo protection echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Enable bad error message protection echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses # Disable ICMP Re-directs for file in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo "0" > $file done # From IPVS How-To - Turn off sending of ICMP redirects echo "0" > /proc/sys/net/ipv4/conf/all/send_redirects echo "0" > /proc/sys/net/ipv4/conf/default/send_redirects echo "0" > /proc/sys/net/ipv4/conf/$DMZIF/send_redirects echo "0" > /proc/sys/net/ipv4/conf/$EXTIF/send_redirects # Accepting Source-Routed Traffic # If you are running IPROUTE2 and doing some more advanced # routing of traffic, this may need to be DISABLED (set to 1). # echo " - Dropping source-routed packets " for file in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo "0" > $file done ###################################################################### # ROUTING TABLE STUFF ###################################################################### # ADD MULTICAST ROUTE # In this example, we are adding a multicast route for the DMZ # interface. Keepalived needs to be able to multicast in order # to communicate with the BACKUP Director(s). If you are using # a different interface for Keepalived/VRRP elections, or doing # other kinds of multicasting, you may need to modify this. echo " - Adding multicast route on DMZ interface" /sbin/ip route add 224.0.0.0/4 dev $DMZIF ###################################################################### # # IPTABLES INITIALIZATION # ###################################################################### # CLEAR OUT THE RULES AND RELOAD THEM # # Change default policies to DROP. # # If there isn't a rule to specifically allow a certain type of # traffic, it will be DROPPED. Note that some of our user-defined # chains will change this behavior by having the last rule in the # chain be a blanket ACCEPT (after passing specific block tests). # # IPTables doesn't like using REJECT as a chain policy, we'll have to use # DROP instead echo " - Setting Default Policies of Built-In Chains" /sbin/iptables -P INPUT DROP /sbin/iptables -P OUTPUT DROP /sbin/iptables -P FORWARD DROP echo " - Setting Default NAT Policies to ACCEPT:" /sbin/iptables -t nat -P PREROUTING ACCEPT /sbin/iptables -t nat -P POSTROUTING ACCEPT /sbin/iptables -t nat -P OUTPUT ACCEPT echo " - Flushing All Built-In Chain Rules" # Flush all old rule sets # /sbin/iptables -F echo " - Flushing NAT Rules" # Flush NAT rules /sbin/iptables -t nat -F echo " - Flushing MANGLE Rules" /sbin/iptables -t mangle -F echo " - Flushing and Deleting All User-Defined Chains" # Flush all user-defined chains. Per how-to, not specifying a specific chain # flushes all of them. I like this better than 28 more flush commands... ;) /sbin/iptables -F # Now that the user-defined chains are empty, we can delete them. Again, # we'll kill all of them by not specifying a specific chain. /sbin/iptables -X /sbin/iptables -t nat -X /sbin/iptables -t mangle -X ############################################################################# # # BUILD THE CHAINS # ############################################################################# # CREATE THE USER-DEFINED CPE MGMT TRAFFIC CHAINS FIRST # We have to do this because we are referring (jumping) to some of # the CPE MGMT TRAFFIC chains VERY EARLY in the built-in OUTPUT # rules. Since chains that are referred to must already exist # when a rule is added that points to them, we have to do this NOW, # and we may as well keep this all together. # # The CPE has an RFC1918 private network address on its ethernet # interface (defined by the DSLMODEMIP variable), which would # otherwise be considered a bad destination address for traffic # going out the external interface. We want/need to be able to # ping, telnet, and ftp the CPE from our firewall boxes, so we # will place matching rules ahead of the "bad destinations" list # in the main OUTPUT chain. # # Some explanation may be in order here on my DSLLAN chains... # # I only allow REPLY (ESTABLISHED,RELATED) traffic from # $DSLMODEMIP. My CPE is configured to ONLY function as an # "ADSL ethernet bridge" device, so any incoming NEW traffic # from $DSLMODEMIP would be HIGHLY suspect. # /sbin/iptables -N tcp_cpe_in /sbin/iptables -N tcp_cpe_out /sbin/iptables -N udp_cpe_in /sbin/iptables -N udp_cpe_out /sbin/iptables -N icmp_cpe_in /sbin/iptables -N icmp_cpe_out ########################################################################### # CPE TCP INPUT RULES tcp_cpe_in # # Connections in progress are OK /sbin/iptables -A tcp_cpe_in -m state --state ESTABLISHED,RELATED -j ACCEPT # END OF DSLLAN TCP INPUT CHAIN # Anything else tries to come through, I want to know about it /sbin/iptables -A tcp_cpe_in -m limit $LOG --log-prefix "CPE Chatter Block:" /sbin/iptables -A tcp_cpe_in -j REJECT ########################################################################### ########################################################################### # DSLLAN UDP INPUT RULES udp_cpe_in # # Connections in progress are OK /sbin/iptables -A udp_cpe_in -m state --state ESTABLISHED,RELATED -j ACCEPT # END OF DSLLAN TCP INPUT CHAIN # Anything else tries to come through, I want to know about it /sbin/iptables -A udp_cpe_in -m limit $LOG --log-prefix "CPE Chatter Block:" /sbin/iptables -A udp_cpe_in -j REJECT ########################################################################### ########################################################################### # DSLLAN ICMP INPUT RULES icmp_cpe_in # # Connections in progress are OK /sbin/iptables -A icmp_cpe_in -m state --state ESTABLISHED,RELATED -j ACCEPT # END OF DSLLAN TCP INPUT CHAIN # Anything else tries to come through, I want to know about it /sbin/iptables -A icmp_cpe_in -m limit $LOG --log-prefix "CPE Chatter Block:" /sbin/iptables -A icmp_cpe_in -j REJECT ########################################################################### ########################################################################### # DSLLAN TCP OUTPUT RULES tcp_cpe_out # # Anything goes... /sbin/iptables -A tcp_cpe_out -j ACCEPT ########################################################################### ########################################################################### # DSLLAN UDP OUTPUT RULES udp_cpe_out # Anything goes... /sbin/iptables -A udp_cpe_out -j ACCEPT ########################################################################### ########################################################################### # DSLLAN ICMP OUTPUT RULES icmp_cpe_out # Anything goes... /sbin/iptables -A icmp_cpe_out -j ACCEPT ########################################################################### ########################################################################### echo " Initializing BUILT-IN Chains: " echo "----------------------------------------------------" # GENERAL RULES ########################################################################### # FIRST THINGS FIRST - RULES WE WANT TO PUT IN THE BUILT-IN CHAINS # echo " --- " echo " Populating built-in chains with preliminary rules:" echo " --------------------------------------------------" echo " - Populating built-in OUTPUT chain..." # DSL/CPE MGMT TRAFFIC OUTPUT JUMP TABLES ***MUST*** GO FIRST # Since we are using private RFC1918 addresses on the DSL Modem # and as an additional address on the external interface, # we have to put the jump tables for CPE MGMT traffic ahead of # everything else, and mainly before we let it hit the REJECT rules # for other non-routable addresses in the same RFC1918 subnet... # # This ALSO means that the chains we are referring to have to already # exist and be preloaded with their rules. So we had to pull these # out and stick them above all of this. If we're going to do that, # we might as well put ALL of the CPE MGMT traffic-related chains # above this, so we can at least keep them all together. /sbin/iptables -A OUTPUT -o $EXTIF -p tcp -d $DSLMODEMIP -j tcp_cpe_out /sbin/iptables -A OUTPUT -o $EXTIF -p udp -d $DSLMODEMIP -j udp_cpe_out /sbin/iptables -A OUTPUT -o $EXTIF -p icmp -d $DSLMODEMIP -j icmp_cpe_out echo " - Monitoring Outbound LOCAL Traffic for Bad Destination IP's..." # OUTBOUND TRAFFIC FROM THIS BOX # We will REJECT this traffic, rather than DROP it, so the app generating # the traffic will QUICKLY find out (via DESTINATION UNREACHABLE) we can't # get there from here. /sbin/iptables -A OUTPUT -o $EXTIF -d 0.0.0.0/8 -j REJECT /sbin/iptables -A OUTPUT -o $EXTIF -d 1.0.0.0/8 -j REJECT /sbin/iptables -A OUTPUT -o $EXTIF -d 10.0.0.0/8 -j REJECT /sbin/iptables -A OUTPUT -o $EXTIF -d 127.0.0.0/8 -j REJECT /sbin/iptables -A OUTPUT -o $EXTIF -d 128.0.0.0/16 -j REJECT /sbin/iptables -A OUTPUT -o $EXTIF -d 128.66.0.0/16 -j REJECT /sbin/iptables -A OUTPUT -o $EXTIF -d 172.16.0.0/12 -j REJECT /sbin/iptables -A OUTPUT -o $EXTIF -d 191.255.0.0/16 -j REJECT /sbin/iptables -A OUTPUT -o $EXTIF -d 192.0.0.0/24 -j REJECT /sbin/iptables -A OUTPUT -o $EXTIF -d 192.0.1.0/24 -j REJECT /sbin/iptables -A OUTPUT -o $EXTIF -d 192.0.2.0/24 -j REJECT /sbin/iptables -A OUTPUT -o $EXTIF -d 192.168.0.0/24 -j REJECT /sbin/iptables -A OUTPUT -o $EXTIF -d 192.168.1.0/24 -j REJECT /sbin/iptables -A OUTPUT -o $EXTIF -d 240.0.0.0/5 -j REJECT /sbin/iptables -A OUTPUT -o $EXTIF -d 248.0.0.0/6 -j REJECT echo " - Monitoring Outbound FWD Traffic for Bad Destination IP's..." # OUTBOUND TRAFFIC FROM THE INTERNAL NETWORK # We will REJECT this traffic, rather than DROP it, so the app generating # the traffic will QUICKLY find out (via DESTINATION UNREACHABLE) we can't # get there from here. The -i !$EXTIF statement will cover all interfaces # except the external interface. /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 0.0.0.0/8 -j REJECT /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 1.0.0.0/8 -j REJECT /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 10.0.0.0/8 -j REJECT /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 127.0.0.0/8 -j REJECT /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 128.0.0.0/16 -j REJECT /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 128.66.0.0/16 -j REJECT /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 172.16.0.0/12 -j REJECT /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 191.255.0.0/16 -j REJECT /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 192.0.0.0/24 -j REJECT /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 192.0.1.0/24 -j REJECT /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 192.0.2.0/24 -j REJECT /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 192.168.0.0/24 -j REJECT /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 192.168.1.0/24 -j REJECT /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 240.0.0.0/5 -j REJECT /sbin/iptables -A FORWARD ! -i $EXTIF -o $EXTIF -d 248.0.0.0/6 -j REJECT echo " - Suppressing Broadcast Output on the External Interface..." /sbin/iptables -A OUTPUT -o $EXTIF -d $DMZBROAD -j REJECT /sbin/iptables -A FORWARD -o $EXTIF -d $DMZBROAD -j REJECT echo " --- " ########################################################################### # USER-DEFINED CHAINS ########################################################################### # # PROTOCOL/INTERFACE/ROUTE IDENTIFICATION # # By categorizing the packets early in the process by type (ie protocol), # which interface(s), and which direction they're going, we can keep the # number of rules any packet has to traverse before its fate is determined # to a minimum (vs. having single giant input, output, and forward chains). # And more significantly, packets will only be checked against rules that # apply to that category of traffic. This should help speed things up, # at least for a lot of the traffic. # # The user-defined chains are named like this -- # # FIRST part of name is which protocol this chain is for. # # SECOND part is for which interface the packets are moving on. In the # case of the fwd chains, this part is which interface the traffic is # coming IN on. # # THIRD part is for where the traffic is headed (IN or OUT of this box, # or forwarding THRU the box). echo " Creating custom traffic chains:" echo " -------------------------------" # LOCALHOST CHAINS # For some reason, I HAD to make user-defined localhost chains. Having # explicit ACCEPTS at the top of the INPUT and OUTPUT chains for lo *DID # NOT WORK* (the rules were not actually getting put into the INPUT and # OUTPUT chains!!!). # /sbin/iptables -N local_in /sbin/iptables -N local_out /sbin/iptables -N tcp_ext_in /sbin/iptables -N tcp_ext_fwd /sbin/iptables -N tcp_ext_out /sbin/iptables -N tcp_dmz_in /sbin/iptables -N tcp_dmz_fwd /sbin/iptables -N tcp_dmz_out /sbin/iptables -N udp_ext_in /sbin/iptables -N udp_ext_fwd /sbin/iptables -N udp_ext_out /sbin/iptables -N udp_dmz_in /sbin/iptables -N udp_dmz_fwd /sbin/iptables -N udp_dmz_out /sbin/iptables -N icmp_ext_in /sbin/iptables -N icmp_ext_fwd /sbin/iptables -N icmp_ext_out /sbin/iptables -N icmp_dmz_in /sbin/iptables -N icmp_dmz_fwd /sbin/iptables -N icmp_dmz_out ########################################################################### # SPECIAL DROP & REJECT CHAINS # This wouldn't be necessary if it were possible to LOG a packet we wanted to # kill and DROP/REJECT it at the same time. (This could be done in IPCHAINS). # # Anything that gets sent to these chains are going to be either DROPPED # or REJECTED. We just have separate chains so we can get offending # traffic out of the calling chains before they hit an ACCEPT rule. /sbin/iptables -N bad_tcp_reject /sbin/iptables -N bad_udp_reject # PRE- and POSTROUTING DROP and REJECT chains /sbin/iptables -t nat -N prenat_bad_dest /sbin/iptables -t nat -N prenat_bad_src /sbin/iptables -t nat -N prenat_getlost /sbin/iptables -t nat -N prenat_impostor /sbin/iptables -t nat -N bad_prenat ########################################################################### ########################################################################### # BAD TCP OUTPUT/FORWARD REJECT CHAIN bad_tcp_reject # # This chain is pretty much like the rules in the bad_prenat chain, except, # well you guessed it, we're going to REJECT the packets instead of just # dropping 'em. # # This chain is for Internal / DMZ hosts, so they get a quick ICMP # errormsg back. The folks on the internet just get DROPPED. # # If your box is a little strained for CPU Idle time, you may want to # comment out the custom log entries and uncomment the generic log # entry at the bottom of this chain. You'll lose the custom log # entries but it should reduce the CPU load a bit... ########################################################################### echo " - Populating TCP Outbound/FWD LOG and REJECT Chain..." ########################################################################### # RPC /sbin/iptables -A bad_tcp_reject -p tcp --sport 111 -m limit $LOG --log-prefix "RPC Block:" /sbin/iptables -A bad_tcp_reject -p tcp --dport 111 -m limit $LOG --log-prefix "RPC Block:" # SMB /sbin/iptables -A bad_tcp_reject -p tcp --dport 135:139 -m limit $LOG --log-prefix "SMB LEAK:" /sbin/iptables -A bad_tcp_reject -p tcp --dport 445 -m limit $LOG --log-prefix "SMB LEAK:" /sbin/iptables -A bad_tcp_reject -p tcp --sport 135:139 -m limit $LOG --log-prefix "SMB LEAK:" /sbin/iptables -A bad_tcp_reject -p tcp --sport 445 -m limit $LOG --log-prefix "SMB LEAK:" # IPSec /sbin/iptables -A bad_tcp_reject -p tcp --sport 500 -m limit $LOG --log-prefix "IPSec Block:" /sbin/iptables -A bad_tcp_reject -p tcp --dport 500 -m limit $LOG --log-prefix "IPSec Block:" # PPTP /sbin/iptables -A bad_tcp_reject -p tcp --dport 1723 -m limit $LOG --log-prefix "PPTP Block:" # Remote Winsock /sbin/iptables -A bad_tcp_reject -p tcp --dport 1745 -m limit $LOG --log-prefix "RmtWinSock Block:" # NFS /sbin/iptables -A bad_tcp_reject -p tcp --sport 2049 -m limit $LOG --log-prefix "NFS Block:" /sbin/iptables -A bad_tcp_reject -p tcp --dport 2049 -m limit $LOG --log-prefix "NFS Block:" # MySQL /sbin/iptables -A bad_tcp_reject -p tcp --sport 3306 -m limit $LOG --log-prefix "MySQL Block:" # EggDrop IRC Bots /sbin/iptables -A bad_tcp_reject -p tcp --sport 3456 -m limit $LOG --log-prefix "EggDrop Block:" # PCAnywhere /sbin/iptables -A bad_tcp_reject -p tcp --dport 5631 -m limit $LOG --log-prefix "PCAnywhere Block:" /sbin/iptables -A bad_tcp_reject -p tcp --dport 5632 -m limit $LOG --log-prefix "PCAnywhere Block:" # XWindows /sbin/iptables -A bad_tcp_reject -p tcp --dport $XWINPORTS -m limit $LOG --log-prefix "XWIN Block:" # TCP TRACEROUTE REPLIES /sbin/iptables -A bad_tcp_reject -p tcp --dport 33434 -m limit $LOG --log-prefix "TrcRt Reply Block:" # KNOWN TROJANS # # WinCrash /sbin/iptables -A bad_tcp_reject -p tcp --dport 5742 -m limit $LOG --log-prefix "WinCrash? :" # NetBus /sbin/iptables -A bad_tcp_reject -p tcp --dport 12345 -m limit $LOG --log-prefix "NetBus? :" /sbin/iptables -A bad_tcp_reject -p tcp --dport 12346 -m limit $LOG --log-prefix "NetBus? :" # NetBus Pro /sbin/iptables -A bad_tcp_reject -p tcp --dport 20034 -m limit $LOG --log-prefix "NetBus Pro? :" # Shaft /sbin/iptables -A bad_tcp_reject -p tcp --sport 20432 -m limit $LOG --log-prefix "Shaft? :" # Trinoo UDP Flooder /sbin/iptables -A bad_tcp_reject -p tcp --sport 27665 -m limit $LOG --log-prefix "Trinoo? :" # Socket DeTroye /sbin/iptables -A bad_tcp_reject -p tcp --dport 30303 -m limit $LOG --log-prefix "SocketDeTroye? :" # Unknown Trojan (Master's Paradise [CHR]) /sbin/iptables -A bad_tcp_reject -p tcp --dport 40421 -m limit $LOG --log-prefix "Master's Paradise? :" # GENERIC LOG TARGET # If the CPU is low on horsepower, we can reduce the load somewhat by # commenting all of the above LOG matching rules, and only using this line: #/sbin/iptables -A bad_tcp_reject -m limit $LOG --log-prefix "Bad TCP Reject:" # END OF bad_tcp_reject CHAIN #/sbin/iptables -A bad_tcp_reject -j REJECT ########################################################################### ########################################################################### # BAD UDP OUT/FWD REJECT CHAIN bad_udp_reject # # This is for Internal / DMZ hosts. We will REJECT this traffic, so an # ICMP errmsg will be immediately returned to them. # # If your box is a little strained for CPU Idle time, you may want to # comment out the custom log entries and uncomment the generic # log entry at the bottom of this chain. You'll lose the custom log # entries but it should reduce the CPU load a bit... # ########################################################################### echo " - Populating UDP Outbound/FWD LOG and REJECT Chain..." ########################################################################### # RPC /sbin/iptables -A bad_udp_reject -p udp --dport 111 -m limit $LOG --log-prefix "RPC Block:" /sbin/iptables -A bad_udp_reject -p udp --sport 111 -m limit $LOG --log-prefix "RPC Block:" # SMB /sbin/iptables -A bad_udp_reject -p udp --dport 135:139 -m limit $LOG --log-prefix "SMB LEAK:" /sbin/iptables -A bad_udp_reject -p udp --dport 445 -m limit $LOG --log-prefix "SMB LEAK:" /sbin/iptables -A bad_udp_reject -p udp --sport 135:139 -m limit $LOG --log-prefix "SMB LEAK:" /sbin/iptables -A bad_udp_reject -p udp --sport 445 -m limit $LOG --log-prefix "SMB LEAK:" # Mountd /sbin/iptables -A bad_udp_reject -p udp --dport 635 -m limit $LOG --log-prefix "Mountd Block:" /sbin/iptables -A bad_udp_reject -p udp --sport 635 -m limit $LOG --log-prefix "Mountd Block:" # PPTP /sbin/iptables -A bad_udp_reject -p udp --dport 1723 -m limit $LOG --log-prefix "PPTP Block:" # Remote Winsock /sbin/iptables -A bad_udp_reject -p udp --dport 1745 -m limit $LOG --log-prefix "RmtWinSock Block:" # NFS /sbin/iptables -A bad_udp_reject -p udp --dport 2049 -m limit $LOG --log-prefix "NFS Block:" /sbin/iptables -A bad_udp_reject -p udp --sport 2049 -m limit $LOG --log-prefix "NFS Block:" # PcAnywhere /sbin/iptables -A bad_udp_reject -p udp --dport 5631 -m limit $LOG --log-prefix "PCAnyWhere Block:" /sbin/iptables -A bad_udp_reject -p udp --dport 5632 -m limit $LOG --log-prefix "PCAnyWhere Block:" # Xwindows /sbin/iptables -A bad_udp_reject -p udp --dport $XWINPORTS -m limit $LOG --log-prefix "XWin Block:" # KNOWN TROJANS # # Shaft /sbin/iptables -A bad_udp_reject -p udp --sport 18753 -m limit $LOG --log-prefix "Shaft? :" /sbin/iptables -A bad_udp_reject -p udp --sport 20433 -m limit $LOG --log-prefix "Shaft? :" # Trinoo UDP flooder /sbin/iptables -A bad_udp_reject -p udp --sport 27444 -m limit $LOG --log-prefix "Trinoo? :" /sbin/iptables -A bad_udp_reject -p udp --sport 31335 -m limit $LOG --log-prefix "Trinoo? :" # BackOrifice /sbin/iptables -A bad_udp_reject -p udp --dport 31337 -m limit $LOG --log-prefix "BackOrifice? :" /sbin/iptables -A bad_udp_reject -p udp --dport 31338 -m limit $LOG --log-prefix "BackOrifice? :" # # GENERIC LOG TARGET # If the CPU is low on horsepower, we can reduce the load somewhat # by commenting all of the above LOG matching rules, and only using # this one: #/sbin/iptables -A bad_udp_reject -m limit $LOG --log-prefix "Bad UDP Reject:" # END OF CHAIN - REJECT /sbin/iptables -A bad_udp_reject -j REJECT ########################################################################### echo " - Populating Inbound DROP & LOG Chains..." ########################################################################### # NAT PRE-ROUTING BAD ADDRESS LOG & DROP CHAINS # # The logic here is fairly simple and we do not want to waste a lot of # CPU ticks. Anything that ends up in either of these chains got here # because of either a bad source or destination IP address. There is # really no need to test any further to figure out what is wrong, since # each case has its own log and drop chain. We only need two rules # in each chain, the first to log, and the other to drop the packet. ########################################################################### # DROP ANY INCOMING TRAFFIC NOT SPECIFICALLY ADDRESSED TO US # This will hopefully also cover broadcast traffic, etc. The NAT # PREROUTING chain seems to be the logical place to put this if you ask me, # so it gets dropped before we spend any more time on the packets. /sbin/iptables -t nat -A prenat_bad_dest -m limit $LOG --log-prefix "PreNAT-Bad Dest:" /sbin/iptables -t nat -A prenat_bad_dest -j DROP ########################################################################### # DROP INBOUND PKTS WITH INVALID SOURCE ADDRESSES # (RESERVED BLOCKS, RFC 1918, BLACKHOLE ADDRESSES, ETC.) # # We will not even grace these folks with a reply. They are either up to # NO GOOD, or they are polluting the internet with their misconfigured LAN. # Either way, I don't have time for them. /sbin/iptables -t nat -A prenat_bad_src -m limit $LOG --log-prefix "PreNAT-Bad Src:" /sbin/iptables -t nat -A prenat_bad_src -j DROP ########################################################################### ########################################################################### # DROP INBOUND PKTS FROM PEOPLE WHO NEED TO GET A LIFE # AND MIND THEIR OWN BUSINESS /sbin/iptables -t nat -A prenat_getlost $LOG --log-prefix "PreNAT-GetLost:" /sbin/iptables -t nat -A prenat_getlost -j DROP ########################################################################### ########################################################################### # DROP INBOUND PKTS FROM EXTERNAL INTERFACE IMPOSTORS # # DROP and LOG any traffic coming from the EXTERNAL interface, when # it claims to be from a SOURCE address in our IP block (they are # trying to bypass the firewall by claiming to be from inside) # # The truth of the matter is, we shouldn't really see anything hit # this chain, because it is what the rp_filter sysctl is supposed # to do. It's here just in case... /sbin/iptables -t nat -A prenat_impostor -s $OURIPBLOCK -m limit $LOG --log-prefix "PreNAT-Impostor!:" /sbin/iptables -t nat -A prenat_impostor -j DROP ########################################################################### ########################################################################### # NAT PRE-ROUTING LOG AND DROP CHAIN bad_prenat # Things hitting this chain are already headed for the bitbucket, we # are only doing further testing to pick up custom log entries. # # If your box is a little strained for CPU Idle time, you may want to # comment out the custom log entries and uncomment the generic # log entry at the bottom of this chain. You'll lose the custom log # entries but it should reduce the CPU load a bit... # ########################################################################### # Port Scanners /sbin/iptables -t nat -A bad_prenat -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 5 $LOG --log-prefix "PORTSCAN! :" # Trinoo UDP flooder - port # will probably change over time /sbin/iptables -t nat -A bad_prenat -p tcp --sport 27665 -m limit $LOG --log-prefix "PreNAT-Trinoo Ctl Block:" /sbin/iptables -t nat -A bad_prenat -p udp --sport 27444 -m limit --limit 1/s $LOG --log-prefix "PreNAT-Trinoo UDP Flood! :" /sbin/iptables -t nat -A bad_prenat -p udp --sport 31335 -m limit --limit 1/s $LOG --log-prefix "PreNAT-Trinoo UDP Flood! :" # Shaft distributed flooder - port # will probably change over time /sbin/iptables -t nat -A bad_prenat -p tcp --sport 20432 -m limit $LOG --log-prefix "PreNAT-Shaft Ctl Block:" /sbin/iptables -t nat -A bad_prenat -p udp --sport 18753 -m limit --limit 1/s $LOG --log-prefix "PreNAT-Shaft UDP Flood! :" /sbin/iptables -t nat -A bad_prenat -p udp --sport 20433 -m limit --limit 1/s $LOG --log-prefix "PreNAT-Shaft UDP Flood! :" # GENERIC LOG TARGET # If the CPU is low on horsepower, we can reduce the load somewhat # by commenting all of the above LOG matching rules, and only using # this line: #/sbin/iptables -t nat -A bad_prenat -m limit --limit 1/s $LOG --log-prefix "Bad PreNAT:" # END OF CHAIN - DROP (NO REPLY) /sbin/iptables -t nat -A bad_prenat -j DROP ########################################################################### ########################################################################### # USER-DEFINED CHAINS ########################################################################### echo " " echo " --------------------------------------------" echo " Populating User-Defined Chains..." ########################################################################### # LOCALHOST CHAINS # I don't know why but I had to do this to get localhost-generated traffic # to work. I originally tried just adding ACCEPT rules to the main input # and output chains, but it wouldn't actually add the rules! Go figure... ########################################################################### # LOCALHOST INPUT /sbin/iptables -A local_in -j ACCEPT ########################################################################### # LOCALHOST OUTPUT /sbin/iptables -A local_out -j ACCEPT ########################################################################### ########################################################################### # INPUT CHAINS # Remember -- with IPTables, INPUT means the destination address is defined # on the firewall machine, not a host behind the firewall! (Those are # handled by FORWARD rules). # # HOWEVER, things change a bit with this being an LVS(-NAT) DIRECTOR. # VIP's that are publically advertised via external DNS records are # actually defined on the Director, and then DNAT'd to internal hosts by # IPVS. So we have to let this traffic come IN on the INPUT chain, then # after IPVS mangles the packets, they will hit the FORWARD chains to get # to the Real Server IP's (RIP's). ########################################################################### # # EXTERNAL TCP INPUT tcp_ext_in # We will only define items we specifically want to ALLOW, and DROP # everything else at the end of the chain. # # Allow connections already in progress, and those related to others already # in progress. # /sbin/iptables -A tcp_ext_in -i $EXTIF -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT # IPVS RULES # # Telnet to VIP1 - for testing only #/sbin/iptables -A tcp_ext_in -i $EXTIF -p tcp --syn -d $VIP1 --dport 23 -m state --state NEW -j ACCEPT # SMTP /sbin/iptables -A tcp_ext_in -i $EXTIF -p tcp --syn -d $VIP1 --dport 25 -m state --state NEW -j ACCEPT # SMTP High Port /sbin/iptables -A tcp_ext_in -i $EXTIF -p tcp --syn -d $VIP1 --dport 20025 -m state --state NEW -j ACCEPT # PUBLIC DNS /sbin/iptables -A tcp_ext_in -i $EXTIF -p tcp --syn -d $VIP1 --dport 53 -m state --state NEW -j ACCEPT /sbin/iptables -A tcp_ext_in -i $EXTIF -p tcp --syn -d $VIP2 --dport 53 -m state --state NEW -j ACCEPT # Apache Webservers /sbin/iptables -A tcp_ext_in -i $EXTIF -p tcp --syn -d $VIP1 --dport 80 -m state --state NEW -j ACCEPT /sbin/iptables -A tcp_ext_in -i $EXTIF -p tcp --syn -d $VIP3 --dport 80 -m state --state NEW -j ACCEPT # POP3 /sbin/iptables -A tcp_ext_in -i $EXTIF -p tcp --syn -d $VIP1 --dport 110 -m state --state NEW -j ACCEPT # HTTPS (VIP1 Only) /sbin/iptables -A tcp_ext_in -i $EXTIF -p tcp --syn -d $VIP1 --dport 443 -m state --state NEW -j ACCEPT #END OF EXTERNAL TCP INPUT CHAIN # If you're not so concerned about LOGGING inbound stuff that gets dropped, # you can comment out the line below to just DROP it: /sbin/iptables -A tcp_ext_in -i $EXTIF -p tcp -m limit $LOG --log-prefix "TCP IN Drop:" /sbin/iptables -A tcp_ext_in -i $EXTIF -p tcp -j DROP ########################################################################### ########################################################################### # EXTERNAL UDP INPUT udp_ext_in # Again, we will only define the items we WANT, the rest will be dropped. /sbin/iptables -A udp_ext_in -i $EXTIF -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT # IPVS rules # # DNS /sbin/iptables -A udp_ext_in -i $EXTIF -p udp -d $VIP1 --dport 53 -m state --state NEW -j ACCEPT /sbin/iptables -A udp_ext_in -i $EXTIF -p udp -d $VIP2 --dport 53 -m state --state NEW -j ACCEPT # END OF EXTERNAL UDP INPUT CHAIN # If you're not so concerned about LOGGING inbound stuff that gets dropped, # you can comment out the line below to just DROP it: /sbin/iptables -A udp_ext_in -i $EXTIF -p udp -m limit $LOG --log-prefix "UDP IN Drop:" /sbin/iptables -A udp_ext_in -i $EXTIF -p udp -j DROP ########################################################################### ########################################################################### # EXTERNAL ICMP INPUT icmp_ext_in # We are going to be VERY picky about what kind of ICMP traffic we allow in # from the external interface. # # It is really nice that IPTables and Kernel 2.4.x can do stateful # inspection on ICMP! Thanks guys!!!! # # Echo Replies - ONLY accept echo replies from addresses we actually sent an # echo request to: /sbin/iptables -A icmp_ext_in -i $EXTIF -p icmp --icmp-type echo-reply -m state --state ESTABLISHED,RELATED -j ACCEPT # ICMP Traceroute Replies (TTL-EXPIRED, etc.) /sbin/iptables -A icmp_ext_in -i $EXTIF -p icmp --icmp-type 11 -m state --state ESTABLISHED,RELATED -j ACCEPT # ICMP Destination (host, protocol, etc.) Unreachable /sbin/iptables -A icmp_ext_in -i $EXTIF -p icmp --icmp-type 3 -m state --state ESTABLISHED,RELATED -j ACCEPT #Fragmentation Needed - we NEED to let this in (and also forward) /sbin/iptables -A icmp_ext_in -i $EXTIF -p icmp --icmp-type fragmentation-needed -m state --state ESTABLISHED,RELATED -j ACCEPT # OPTIONAL - ALLOW INBOUND ECHO REQUESTS # If you don't mind your firewall being pinged from the outside, # you can uncomment the following rule. The NAT PREROUTING rules # will have already cut down on the number of echo requests at a # time we let in. Also note that if you want this box to be able # to REPLY, you will also have to uncomment the rule in the # icmp_ext_out chain to allow echo-reply traffic. #/sbin/iptables -A icmp_ext_in -i $EXTIF -p icmp --icmp-type echo-request -j ACCEPT #END OF EXTERNAL ICMP INPUT CHAIN # If you're not so concerned about LOGGING inbound stuff that gets dropped, # you can comment out the line below to just DROP it: #/sbin/iptables -A icmp_ext_in -i $EXTIF -p icmp -m limit --limit 1/s $LOG --log-prefix "ICMP IN Drop:" /sbin/iptables -A icmp_ext_in -i $EXTIF -p icmp -j DROP ########################################################################### ########################################################################### # EXTERNAL TCP OUTPUT tcp_ext_out # Remember, the OUTPUT chains *ONLY* control output directly from this box, # not traffic forwarded THRU the box! # # If the connection is not already in progress (ie, a new connection), we # are going to MAKE SURE it isn't bad traffic before we let it go out. # # Also, we need to LOG a lot of the things we are specifically forbidding to # go out, because if these things are happening, we probably need to know # about them! So we will send them to the bad_tcp_reject chain. ########################################################################### # SESSIONS IN PROGRESS ARE OK /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT # OUTPUT TYPES WE DON'T ALLOW # SMB /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --dport 135:139 -j bad_tcp_reject /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --dport 445 -j bad_tcp_reject /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --sport 135:139 -j bad_tcp_reject /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --sport 445 -j bad_tcp_reject # RPC /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --sport 111 -j bad_tcp_reject /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --dport 111 -j bad_tcp_reject # IPSec VPN /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --sport 500 -j bad_tcp_reject /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --dport 500 -j bad_tcp_reject # PPTP /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --dport 1723 -j bad_tcp_reject # NFS /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --sport 2049 -j bad_tcp_reject /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --dport 2049 -j bad_tcp_reject # MySQL /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --sport 3306 -j bad_tcp_reject # EggDrop IRC Bot /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --sport 3456 -j bad_tcp_reject # Xwindows /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --dport $XWINPORTS -j bad_tcp_reject # TCP TRACEROUTE REQUESTS /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --dport 33434 -j bad_tcp_reject # KNOWN TROJANS # # Win Crash Trojan /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --dport 5742 -j bad_tcp_reject # NetBus /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --dport 12345 -j bad_tcp_reject /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --dport 12346 -j bad_tcp_reject # NetBus Pro /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --dport 20034 -j bad_tcp_reject # Shaft distributed flooder - port # will probably change over time /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --sport 20432 -j bad_tcp_reject # Trinoo UDP flooder - port # will probably change over time /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --sport 27665 -j bad_tcp_reject # Socket De Troye /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --dport 30303 -j bad_tcp_reject # Unknown Trojan Horse (Master's Paradise [CHR]) /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp --dport 40421 -j bad_tcp_reject ########################################################################### # END OF TCP EXTERNAL OUTPUT CHAIN # Now that we have checked to make sure stuff going out isn't one of the # above, we will allow new connections to go out of THIS box. If anything # is left after that, we'll REJECT it. ########################################################################### /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp -m state --state NEW -j ACCEPT /sbin/iptables -A tcp_ext_out -o $EXTIF -p tcp -j bad_tcp_reject ########################################################################### ########################################################################### # EXTERNAL UDP OUTPUT RULES udp_ext_out # # Remember, the OUTPUT chains *ONLY* control output directly from this box, # not traffic forwarded THRU the box! # # If the connection is not already in progress (ie, a new connection), we # are going to MAKE SURE it isn't bad traffic before we let it go out. # # Also, we need to LOG a lot of the things we are specifically forbidding to # go out, because if these things are happening, we probably need to know # about them! So we will send them to the bad_udp_reject chain. ########################################################################### # Sessions in progress are OK /sbin/iptables -A udp_ext_out -o $EXTIF -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT # RPC /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --dport 111 -j bad_udp_reject /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --sport 111 -j bad_udp_reject # SMB /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --dport 135:139 -j bad_udp_reject /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --dport 445 -j bad_udp_reject /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --sport 135:139 -j bad_udp_reject /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --sport 445 -j bad_udp_reject # Mountd /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --dport 635 -j bad_udp_reject /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --sport 635 -j bad_udp_reject # PPTP /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --dport 1723 -j bad_udp_reject # Remote Winsock /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --dport 1745 -j bad_udp_reject # NFS /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --dport 2049 -j bad_udp_reject /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --sport 2049 -j bad_udp_reject # Xwindows /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --dport $XWINPORTS -j bad_udp_reject # Known Trojan ports # # Shaft distributed flooder - port # will probably change over time /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --sport 18753 -j bad_udp_reject /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --sport 20433 -j bad_udp_reject # Trinoo UDP flooder - port # will probably change over time /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --sport 27444 -j bad_udp_reject /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --sport 31335 -j bad_udp_reject # BackOrifice /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --dport 31337 -j bad_udp_reject /sbin/iptables -A udp_ext_out -o $EXTIF -p udp --dport 31338 -j bad_udp_reject ########################################################################### # END OF UDP_EXT_OUTPUT CHAIN # Now that we have checked to make sure stuff going out isn't one of the # above, we will allow new connections to go out of THIS box. If anything # is left after that, we'll REJECT it. /sbin/iptables -A udp_ext_out -o $EXTIF -p udp -m state --state NEW -j ACCEPT /sbin/iptables -A udp_ext_out -o $EXTIF -p udp -j bad_udp_reject ########################################################################### ########################################################################### # EXTERNAL ICMP OUTPUT RULES icmp_ext_out # Sort of like our ICMP Input, I am being VERY picky about what ICMP # traffic I will let out of this box onto the internet. Basically, all I # am letting out are echo requests (this also lets you do a traceroute from # this box to hosts on the internet). # # Needless to say, we need to REJECT other output, rather than DROP it. # We want to be polite to our firewall!!! ;) # # PING and TRACEROUTE hosts on the internet /sbin/iptables -A icmp_ext_out -o $EXTIF -p icmp --icmp-type echo-request -j ACCEPT # OPTIONAL - Let echo replies go out # If you don't mind allowing your firewall to reply to incoming # ping requests, you need to let the replies out. This is # disabled by default. #/sbin/iptables -A icmp_ext_out -o $EXTIF -p icmp --icmp-type echo-reply -j ACCEPT # THIS IS JUST ABOUT ALL WE WANT TO LET OUT, SO THE CHAIN STOPS HERE /sbin/iptables -A icmp_ext_out -o $EXTIF -p icmp -m limit $LOG --log-prefix "ICMP Out Block:" /sbin/iptables -A icmp_ext_out -o $EXTIF -p icmp -j REJECT ########################################################################### ########################################################################### # COMMENTS ON THE FORWARD CHAINS # # The jump tables in the main FORWARD chains are written based on which # interface the traffic to be forwarded (or not) is coming *IN* on. # Therefore, in each of these user-defined FORWARD chains, we only have to # worry about where the traffic is going, not where it came from. # # By basing the jump tables (and the chains they lead to) on the interfaces # the would-be FWD traffic is coming IN on, we can end each chain with # either a DROP or a REJECT: # # Traffic we want to block coming from INSIDE our network will get a # REJECT - this is more polite - as it will send the host an ICMP error # message, and the host will quickly recover, rather than sitting there # waiting for a reply which will never come, until it times out. # # On the other hand, traffic coming IN from the INTERNET which fails the # _ext_fwd chains will simply be DROPPED. They will get no type of reply # from us (especially since we're blocking all types of outbound ICMP except # echo-request). # ########################################################################### ########################################################################### # EXTERNAL TCP FORWARDING RULES tcp_ext_fwd # # CONNECTIONS IN PROGRESS ARE OK # Since these are already in progress I won't specify interfaces and will # let this stuff thru without any further adieu.... ;) # # IPVS NOTE: # With the way that IPVS with Antefacto mangles the packets destined # for the Real Servers, even packets creating NEW CONNECTIONS (the # initial SYN packets) will be marked ESTABLISHED as they hit the # forward chains. This seems a little unusual, but it works out # great for our firewall rules. Just don't forget that this ONLY # works this way for IPVS services. If it's not an IPVS virtual # service you will still need an explicit rule to allow NEW SYN # packets to be forwarded (like our FTP server example rule below). /sbin/iptables -A tcp_ext_fwd -i $EXTIF -o $DMZIF -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT # ACK PACKETS # Per a msg I read in netfilter mailing list, I decided to add the # following rule to let packets through that have the ACK flag set. # The firewall was logging a lot of dropped ACK packets because it # didn't think they were part of an ESTABLISHED or RELATED # connection, when they actually were. /sbin/iptables -A tcp_ext_fwd -i $EXTIF -o $DMZIF -p tcp --tcp-flags ACK ACK -j ACCEPT ########################################################################### # FORWARD FROM EXTIF INTO DMZ # # Public FTP Server # Netfilter's conntrack ftp helper will handle the port 20 stuff. /sbin/iptables -A tcp_ext_fwd -o $DMZIF -p tcp --syn -d $PUBFTP --dport 21 -m state --state NEW -j ACCEPT ########################################################################### # FORWARD FROM EXTIF INTO INTERNAL LAN # # For the most part, we only want to forward REPLY traffic all the way # into the INTERNAL LAN. We have already done this with the first rule in # this chain. # # However, we DO need to add specific forwarding rules to allow any # incoming new connections we are going to allow to be made to hosts on # our internal LAN which are behind the internal SNAT gateway/firewall, # such as hosts running WinMX, BitTorrent, etc. Note that the internal # SNAT gateway/firewall is doing all the -j DNAT work to get this traffic # to the correct internal hosts in its NAT PREROUTING rules. ########################################################################### # # WinMX TCP PORTS (To allow sharing) /sbin/iptables -A tcp_ext_fwd -o $DMZIF -p tcp --syn -d $SNATIP --dport 6690:6696 -m state --state NEW -j ACCEPT # BitTorrent # Another file sharing application, used to get the latest 24 episodes #/sbin/iptables -A tcp_ext_fwd -o $DMZIF -p tcp --syn -d $SNATIP --dport 6881:6889 -m state --state NEW -j ACCEPT /sbin/iptables -A tcp_ext_fwd -o $DMZIF -p tcp --syn -d $SNATIP --dport 6881 -m state --state NEW -j ACCEPT # END OF TCP EXTERNAL FORWARD CHAIN # We are going to DROP anything we haven't specifically allowed above, # so if there is any other traffic you need to let in, you need to add # a specific forwarding rule before we get here. /sbin/iptables -A tcp_ext_fwd -o $DMZIF -p tcp -m limit $LOG --log-prefix "TCP ExtFwd Drop:" /sbin/iptables -A tcp_ext_fwd -o $DMZIF -p tcp -j DROP ########################################################################### ########################################################################### # EXTERNAL UDP FORWARDING RULES udp_ext_fwd # # CONNECTIONS IN PROGRESS ARE OK # Since these are already in progress I won't specify interfaces and will # let this stuff thru without any further adieu.... ;) # # IPVS NOTE: # With the way that IPVS with Antefacto mangles the packets destined # for the Real Servers, even NEW CONNECTIONS will be marked ESTABLISHED # as they hit the forward chains. This is a little unusual, but it works # out great for our firewall rules. Just don't forget that this ONLY # works this way for IPVS services. If it's not an IPVS virtual service # you will still need an explicit rule to allow UDP packets the firewall # considers NEW to be forwarded. /sbin/iptables -A udp_ext_fwd -o $DMZIF -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT ########################################################################### # FORWARD FROM EXTIF INTO DMZ ########################################################################### # ALLOW UNRESTRICTED UDP FROM PUBLIC NTP SERVERS WE SYNC FROM # Allow FWD of External "new" UDP NTP traffic to our internal NTP server, # but only from specified inet hosts. It's not really NEW traffic, but # without these rules, the firewall isn't going to let our NTP server # completely communicate with the NTP servers we sync from on the 'net. # # NOTE: The IP's listed here aren't real NTP servers, they're just here # to demonstrate what needs to be done if you run an NTP time server for # your local network, and it syncs itself with public NTP servers. /sbin/iptables -A udp_ext_fwd -o $DMZIF -p udp -s 10.23.24.25 -d $NTPSRV --dport 123 -j ACCEPT /sbin/iptables -A udp_ext_fwd -o $DMZIF -p udp -s 10.26.27.28 -d $NTPSRV --dport 123 -j ACCEPT /sbin/iptables -A udp_ext_fwd -o $DMZIF -p udp -s 10.29.30.31 -d $NTPSRV --dport 123 -j ACCEPT # Block MySQL (without logging it) /sbin/iptables -A udp_ext_fwd -o $DMZIF -p udp --dport 3306 -j DROP ########################################################################### # FORWARD FROM EXTIF INTO INTERNAL LAN # # For the most part, we only want to forward REPLY traffic all the way into # the INTERNAL LAN. We have already done this with the first rule in this # chain. # # However, we DO need to add specific forwarding rules to allow any # incoming new connections we are going to allow to be made to hosts on # our internal LAN which are behind the internal SNAT gateway/firewall, # such as hosts running WinMX, BitTorrent, etc. Note that the internal # SNAT gateway/firewall is doing all the -j DNAT work to get this traffic # to the correct internal hosts in its NAT PREROUTING rules. ########################################################################### # # WINMX UDP PORTS (PEER-BASED CONNECTIONS) /sbin/iptables -A udp_ext_fwd -o $DMZIF -p udp -d $SNATIP --dport 6257:6263 -j ACCEPT # RealPlayer UDP Transport # RealPlayer likes 3 UDP ports per host /sbin/iptables -A udp_ext_fwd -o $DMZIF -p udp -d $SNATIP --dport 7073:7075 -j ACCEPT # END OF EXTERNAL UDP FORWARD CHAIN # /sbin/iptables -A udp_ext_fwd -o $DMZIF -p udp -m limit --limit 1/s $LOG --log-prefix "UDP ExtFwd Drop:" /sbin/iptables -A udp_ext_fwd -o $DMZIF -p udp -j DROP ########################################################################### ########################################################################### # EXTERNAL ICMP FORWARDING RULES icmp_ext_fwd # # We are going to be VERY picky about what kind of ICMP traffic we allow in # from the external interface. # # It is really nice that IPTables and Kernel 2.4.x can do stateful # inspection on ICMP! Thanks guys!!!! # # Echo Replies - ONLY accept echo replies from addresses we sent an echo # request to: /sbin/iptables -A icmp_ext_fwd -o $DMZIF -p icmp --icmp-type echo-reply -m state --state ESTABLISHED,RELATED -j ACCEPT # ICMP Traceroute Replies (TTL-EXPIRED, etc.) /sbin/iptables -A icmp_ext_fwd -o $DMZIF -p icmp --icmp-type 11 -m state --state ESTABLISHED,RELATED -j ACCEPT # ICMP Destination (host, protocol, etc.) Unreachable /sbin/iptables -A icmp_ext_fwd -o $DMZIF -p icmp --icmp-type 3 -m state --state ESTABLISHED,RELATED -j ACCEPT #Fragmentation Needed - we NEED to let this in (and also forward) /sbin/iptables -A icmp_ext_fwd -o $DMZIF -p icmp --icmp-type fragmentation-needed -m state --state ESTABLISHED,RELATED -j ACCEPT #END OF EXTERNAL ICMP INPUT CHAIN # Log if you want all the gory details #/sbin/iptables -A icmp_ext_fwd -o $DMZIF -p icmp -m limit --limit 1/s $LOG --log-prefix "ICMP ExtFwd Drop:" /sbin/iptables -A icmp_ext_fwd -o $DMZIF -j DROP ########################################################################### ########################################################################### # DMZ TCP INPUT RULES tcp_dmz_in # # For now I'll keep this simple and trust stuff coming from the DMZ /sbin/iptables -A tcp_dmz_in -i $DMZIF -p tcp -j ACCEPT ########################################################################### ########################################################################### # DMZ UDP INPUT RULES udp_dmz_in # For now I'll keep this simple and trust stuff coming from the DMZ /sbin/iptables -A udp_dmz_in -i $DMZIF -p udp -j ACCEPT ########################################################################### ########################################################################### # DMZ ICMP INPUT RULES icmp_dmz_in # For now I'll keep this simple and trust stuff coming from the DMZ /sbin/iptables -A icmp_dmz_in -i $DMZIF -p icmp -j ACCEPT ########################################################################### ########################################################################### # DMZ TCP OUTPUT RULES tcp_dmz_out # For now I'll keep this simple and trust stuff leaving this box headed # to DMZ /sbin/iptables -A tcp_dmz_out -o $DMZIF -p tcp -j ACCEPT ########################################################################### ########################################################################### # DMZ UDP OUTPUT RULES udp_dmz_out # For now I'll keep this simple and trust stuff leaving this box headed # to DMZ /sbin/iptables -A udp_dmz_out -o $DMZIF -p udp -j ACCEPT ########################################################################### ########################################################################### # DMZ ICMP OUTPUT RULES icmp_dmz_out # For now I'll keep this simple and trust stuff leaving this box headed # to DMZ /sbin/iptables -A icmp_dmz_out -o $DMZIF -p icmp -j ACCEPT ########################################################################### ########################################################################### # DMZ TCP FORWARDING RULES tcp_dmz_fwd # # NOTE: Keep in mind that we are not only forwarding traffic from hosts in # the DMZ with this chain, we're also forwarding from Internal Hosts # BEHIND the DMZ!!! # # Connections in Progress - Since these are already in progress I won't # specify interfaces and will let this stuff thru without any further # adieu.... ;) /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT # SPECIFIC FWD REJECTIONS # Things we don't want to let out of our network. # RPC /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 111 -j bad_tcp_reject /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --sport 111 -j bad_tcp_reject # SMB - don't let this be forwarded to the internet, kill it politely /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 135:139 -j bad_tcp_reject /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 445 -j bad_tcp_reject /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --sport 135:139 -j bad_tcp_reject /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --sport 445 -j bad_tcp_reject # IPSec VPN /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --sport 500 -j bad_tcp_reject /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 500 -j bad_tcp_reject # PPTP /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 1723 -j bad_tcp_reject # Remote Winsock /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 1745 -j bad_tcp_reject # NFS /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --sport 2049 -j bad_tcp_reject /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 2049 -j bad_tcp_reject # MySQL /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --sport 3306 -j bad_tcp_reject # EggDrop IRC Bot /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --sport 3456 -j bad_tcp_reject # PcAnywhere /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 5631 -j bad_tcp_reject /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 5632 -j bad_tcp_reject # Xwindows /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport $XWINPORTS -j bad_tcp_reject # KNOWN TROJANS # # Win Crash Trojan /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 5742 -j bad_tcp_reject # NetBus /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 12345 -j bad_tcp_reject /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 12346 -j bad_tcp_reject # NetBus Pro /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 20034 -j bad_tcp_reject # Shaft distributed flooder - port # will probably change over time /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --sport 20432 -j bad_tcp_reject # Trinoo UDP flooder - port # will probably change over time /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --sport 27665 -j bad_tcp_reject # Socket De Troye /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 30303 -j bad_tcp_reject # Unknown Trojan Horse (Master's Paradise [CHR]) /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -o $EXTIF -p tcp --dport 40421 -j bad_tcp_reject # END OF TCP DMZ FORWARD CHAIN # Now that our would-be FWD traffic has satisfied the above rules, we'll let # unspecified new connections go out to the internet. /sbin/iptables -A tcp_dmz_fwd -i $DMZIF -p tcp -j ACCEPT ########################################################################### ########################################################################### # DMZ UDP FORWARDING RULES udp_dmz_fwd # # Connections in progress are OK /sbin/iptables -A udp_dmz_fwd -i $DMZIF -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT # SPECIFIC FWD REJECTIONS # Things we don't want to let out of our network. # RPC /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --dport 111 -j bad_udp_reject /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --sport 111 -j bad_udp_reject # SMB /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --dport 135:139 -j bad_udp_reject /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --dport 445 -j bad_udp_reject /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --sport 135:139 -j bad_udp_reject /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --sport 445 -j bad_udp_reject # Mountd /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --dport 635 -j bad_udp_reject /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --sport 635 -j bad_udp_reject # PPTP /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --dport 1723 -j bad_udp_reject # Remote Winsock /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --dport 1745 -j bad_udp_reject # NFS /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --dport 2049 -j bad_udp_reject /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --sport 2049 -j bad_udp_reject # PcAnywhere /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --dport 5631 -j bad_udp_reject /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --dport 5632 -j bad_udp_reject # Xwindows /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --dport $XWINPORTS -j bad_udp_reject # KNOWN TROJANS # # Shaft distributed flooder - port # will probably change over time /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --sport 18753 -j bad_udp_reject /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --sport 20433 -j bad_udp_reject # Trinoo UDP flooder - port # will probably change over time /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --sport 27444 -j bad_udp_reject /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --sport 31335 -j bad_udp_reject # BackOrifice /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --dport 31337 -j bad_udp_reject /sbin/iptables -A udp_dmz_fwd -i $DMZIF -o $EXTIF -p udp --dport 31338 -j bad_udp_reject # END OF UDP DMZ FORWARDING CHAIN # Now that our would-be FWD traffic has satisfied the above rules, we'll let # unspecified UDP traffic out to the internet. /sbin/iptables -A udp_dmz_fwd -i $DMZIF -p udp -j ACCEPT ########################################################################### ########################################################################### # DMZ ICMP FORWARDING RULES icmp_dmz_fwd # Once again, we're being very picky! # DMZ and Internal Hosts can PING or TRACEROUTE anywhere they want to, # inside or outside /sbin/iptables -A icmp_dmz_fwd -i $DMZIF -o $EXTIF -p icmp --icmp-type echo-request -j ACCEPT # END OF DMZ ICMP FWD CHAIN - REJECT anything else /sbin/iptables -A icmp_dmz_fwd -i $DMZIF -o $DMZIF -p icmp -m limit $LOG --log-prefix "ICMP FWD Reject:" /sbin/iptables -A icmp_dmz_fwd -i $DMZIF -o $DMZIF -p icmp -j REJECT ########################################################################### echo " - Population of User-Defined Chains is Complete." echo " --- " ########################################################################### # CREATE JUMP TABLES IN BUILT-IN CHAINS echo " - Loading Jump Tables into Main INPUT, OUTPUT, and FWD Chains..." ########################################################################### # OK, now that we have the protocol- and interface-specific user-defined # chains created, let's create the "jump tables" - these are type-matching # rules in the built-in INPUT, OUTPUT, and FORWARD chains -- which will # direct packets to the appropriate user-defined chains. Since a packet # will have already matched one of these types to even end up in one of # these user-defined chains, and also since we cannot define a default # policy for user-defined chains, we will put a DROP, REJECT, or ACCEPT (as # appropriate) at the end of EACH user-defined chain. # # INPUT CHAIN /sbin/iptables -A INPUT -i lo -j local_in # /sbin/iptables -A INPUT -i $EXTIF -p tcp -s $DSLMODEMIP -j tcp_dsl_in /sbin/iptables -A INPUT -i $EXTIF -p tcp -j tcp_ext_in /sbin/iptables -A INPUT -i $DMZIF -p tcp -j tcp_dmz_in # /sbin/iptables -A INPUT -i $EXTIF -p udp -s $DSLMODEMIP -j udp_dsl_in /sbin/iptables -A INPUT -i $EXTIF -p udp -j udp_ext_in /sbin/iptables -A INPUT -i $DMZIF -p udp -j udp_dmz_in # /sbin/iptables -A INPUT -i $EXTIF -p icmp -s $DSLMODEMIP -j icmp_dsl_in /sbin/iptables -A INPUT -i $EXTIF -p icmp -j icmp_ext_in /sbin/iptables -A INPUT -i $DMZIF -p icmp -j icmp_dmz_in # # # OUTPUT CHAIN /sbin/iptables -A OUTPUT -o lo -j local_out # /sbin/iptables -A OUTPUT -o $EXTIF -p tcp -j tcp_ext_out /sbin/iptables -A OUTPUT -o $DMZIF -p tcp -j tcp_dmz_out # /sbin/iptables -A OUTPUT -o $EXTIF -p udp -j udp_ext_out /sbin/iptables -A OUTPUT -o $DMZIF -p udp -j udp_dmz_out # /sbin/iptables -A OUTPUT -o $EXTIF -p icmp -j icmp_ext_out /sbin/iptables -A OUTPUT -o $DMZIF -p icmp -j icmp_dmz_out # # # FORWARD CHAIN /sbin/iptables -A FORWARD -i $EXTIF -p tcp -j tcp_ext_fwd /sbin/iptables -A FORWARD -i $DMZIF -p tcp -j tcp_dmz_fwd # /sbin/iptables -A FORWARD -i $EXTIF -p udp -j udp_ext_fwd /sbin/iptables -A FORWARD -i $DMZIF -p udp -j udp_dmz_fwd # /sbin/iptables -A FORWARD -i $EXTIF -p icmp -j icmp_ext_fwd /sbin/iptables -A FORWARD -i $DMZIF -p icmp -j icmp_dmz_fwd # # echo " - Jump Tables Loaded for TCP, UDP, and ICMP Protocols." echo " --- " ########################################################################### # ALLOW IGMP AND VRRP PROTOCOLS FOR KEEPALIVED # We need specific allow rules for these protocols so that keepalived # can communicate between the MASTER and BACKUP Director(s). Note that if # you are doing your Keepalived communications on a different interface, # or doing other multicast traffic/routing, you may need to modify these # rules a bit. ########################################################################### echo " Permitting IGMP & VRRP Protocol (112) on DMZ Interface for Keepalived." ########################################################################### # # Allow IGMP input on DMZ Interface /sbin/iptables -A INPUT -i $DMZIF -p igmp -j ACCEPT # # Allow VRRP input on DMZ Interface /sbin/iptables -A INPUT -i $DMZIF -p 112 -j ACCEPT # # Allow IGMP Output on DMZ Interface /sbin/iptables -A OUTPUT -o $DMZIF -p igmp -j ACCEPT # # Allow VRRP Output on DMZ Interface /sbin/iptables -A OUTPUT -o $DMZIF -p 112 -j ACCEPT ########################################################################### ########################################################################### # END OF JUMP TABLES - DROP OR REJECT ALL OTHER INPUT/OUTPUT/FWD TRAFFIC echo " - Discarding ALL OTHER TRAFFIC." ########################################################################### /sbin/iptables -A INPUT -i $EXTIF -j DROP /sbin/iptables -A INPUT ! -i $EXTIF $LOG --log-prefix "EndofInput-Reject:" /sbin/iptables -A INPUT ! -i $EXTIF -j REJECT # Reject output of multicast traffic on EXTIF without logging it /sbin/iptables -A OUTPUT -o $EXTIF -d 224.0.0.0/4 -j REJECT /sbin/iptables -A OUTPUT $LOG --log-prefix "EndofOutput-Reject:" /sbin/iptables -A OUTPUT -j REJECT /sbin/iptables -A FORWARD -i $EXTIF -j DROP /sbin/iptables -A FORWARD ! -i $EXTIF -j REJECT ########################################################################### echo " ---------------------" ########################################################################### # MANGLE TABLE RULES # Packet mangling stuff. I'm not really doing much of this, other than # occasional bumping of TTL so I can MIRROR annoying traffic back at the # senders. ########################################################################### echo " Populating MANGLE table" echo " " ########################################################################### echo " - Changing TTL of REALLY annoying internet traffic " echo " so we can MIRROR it back at them and hopefully " echo " achieve successful delivery..." # # UDP Ports 1433-1434 (MS SQL Server?) /sbin/iptables -t mangle -A PREROUTING -i $EXTIF -p udp -d $OURIPBLOCK --dport 1433:1434 -j TTL --ttl-set 255 # # ########################################################################### echo " MANGLE table completed." ########################################################################### echo " ---------------------" ########################################################################### # NAT TABLES echo " Loading NAT Tables..." ########################################################################### # IPTables uses 2 main chains, PREROUTING for input, and POSTROUTING for # output. We'll do the PREROUTING first, since we are being much more # picky on incoming stuff. # # There is also an OUTPUT NAT chain for locally-generated stuff. It is # probably not required to tell NAT to NAT stuff heading out from the local # box though. I think it's just there in case you want to redirect the # packets elsewhere. # ########################################################################### # NAT PREROUTING CHAIN # Incoming packets are processed by NAT before they are actually passed to # the packet filter. And since we don't NEED to try to figure out where # SOME kinds of traffic are really going before we kill them, we can save # some CPU ticks (and eliminate some redundancy in the INPUT and FORWARD # chains) by doing some checking here first. But AGAIN, since we don't want # to let packets we deem BAD hit any ACCEPT rules in this chain (because # they could match them too!), we have to send them to a different DROP # chain to LOG *AND* KILL them. # ########################################################################### echo " - Loading NAT PRE-ROUTING Rules..." ########################################################################### # DROP FAKE MULTICAST TRAFFIC # Per the RFC's, real multicast traffic will not have a source IP address # in the 224.0.0.0/4 IP range, it will have a routable source IP. So # anything claiming to be from 224.0.0.0/4 is bogus. echo " - Blocking Incoming FAKE Multicast Traffic from External Interface." /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 224.0.0.0/4 -j DROP ########################################################################### # DROP ANY INCOMING TRAFFIC NOT SPECIFICALLY ADDRESSED TO US # This shouldn't really ever be a problem unless your ISP has poorly- # programmed routers or something. But this should also cover broadcast # traffic, something that could be a problem anyway. echo " - LOG and DROP packets not having $OURIPBLOCK as Destination Address." /sbin/iptables -t nat -A PREROUTING -i $EXTIF -d ! $OURIPBLOCK -j prenat_bad_dest ########################################################################### # DROP INBOUND PKTS WITH INVALID SOURCE ADDRESSES (RESERVED BLOCKS, # RFC 1918, ETC.) # We will not even grace these folks with a reply. They are either up to NO # GOOD, or they are polluting the internet with their misconfigured LAN. # Either way, I don't have time for them. echo " - DROP and LOG inbound packets with RESERVED or INVALID Source Addresses..." /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 0.0.0.0/8 -j prenat_bad_src /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 1.0.0.0/8 -j prenat_bad_src /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 10.0.0.0/8 -j prenat_bad_src /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 127.0.0.0/8 -j prenat_bad_src /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 128.0.0.0/16 -j prenat_bad_src /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 128.66.0.0/16 -j prenat_bad_src /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 172.16.0.0/12 -j prenat_bad_src /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 191.255.0.0/16 -j prenat_bad_src /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 192.0.0.0/24 -j prenat_bad_src /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 192.0.1.0/24 -j prenat_bad_src /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 192.0.2.0/24 -j prenat_bad_src #ALLOW MGMT TRAFFIC IN FROM DSL MODEM /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s $DSLMODEMIP -j ACCEPT /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 192.168.0.0/24 -j prenat_bad_src /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 192.168.1.0/24 -j prenat_bad_src /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 240.0.0.0/5 -j prenat_bad_src /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 248.0.0.0/6 -j prenat_bad_src ########################################################################### # IP Spoofing # This shouldn't really be necessary since we have the rp_filter sysctl # running, but just in case... echo " - DROP and LOG External inbound with SOURCE ADDR claiming to be $OURIPBLOCK..." /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s $OURIPBLOCK -j prenat_impostor ########################################################################### echo " - Reserved / Invalid Address Tables Loaded." ########################################################################### # BLACKLISTED IP ADDRESSES, SUBNETS, AND TRAFFIC TYPES # IP's, IP subnets, and traffic listed here are of particular annoyance # to me, and worthy of being listed to demonstrate example usage of these # rules and user-defined chains. Each of these represents something that # has generated enough log activity that I am tired of looking at it. ########################################################################### echo " - Populating NAT PREROUTING BLACKLISTED Source IP and Traffic List." ########################################################################### /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 216.52.126.0/24 -j DROP # getting a bunch of pings from these folks /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 64.94.1.64/28 -j DROP # these people keep scanning our IP block and indexing our webservers /sbin/iptables -t nat -A PREROUTING -i $EXTIF -s 217.21.114.0/24 -j prenat_getlost # M$-SQL TRAFFIC # MIRROR M$-SQL Server UDP traffic back at the admins who don't know how # to maintain their servers. Maybe we'll get their attention (but I'm # not going to hold my breath - you can always tell an MCSE, but you # can't tell him much... ;) #/sbin/iptables -t nat -A PREROUTING -i $EXTIF -p udp --dport 1433:1434 -m limit $LOG --log-prefix "MS-SQL Mirror: " /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p udp --dport 1433:1434 -j MIRROR # # SILENTLY DROP M$-SQL SERVER Connection Attempts /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p tcp --dport 1433 -j DROP # SILENTLY DROP NETBIOS/SMB TRAFFIC /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p tcp --dport 135:139 -j DROP /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p tcp --dport 445 -j DROP /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p tcp --sport 135:139 -j DROP /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p tcp --sport 445 -j DROP /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p udp --dport 135:139 -j DROP /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p udp --dport 445 -j DROP /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p udp --sport 135:139 -j DROP /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p udp --sport 445 -j DROP # Block MySQL /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3306 -j DROP # SILENTLY DROP Port 27374 (what is this?) /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p tcp --dport 27374 -j DROP echo " - BLACKLISTED Source IP and Traffic Table Completed." ########################################################################### ####################################################################### # AVOIDANCE (or should we say "reduced impact") OF SOME DoS ATTACKS ####################################################################### echo " - Enabling Protection from DoS Attacks.." # # SYN-FLOOD # If I'm understanding this correctly it should not hurt legitimate # inbound connections. /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p tcp --syn -m limit --limit 5/s -j ACCEPT # PING ATTACKS # This rule doesn't mean "I want to accept pings" - it just limits # how many will be allowed past the NAT PREROUTING chain into the INPUT # and FORWARD chains. /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT # Trinoo UDP flooder - port # will probably change over time /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p tcp --sport 27665 -j bad_prenat /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p udp --sport 27444 -j bad_prenat /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p udp --sport 31335 -j bad_prenat # Shaft distributed flooder - port # will probably change over time /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p tcp --sport 20432 -j bad_prenat /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p udp --sport 18753 -j bad_prenat /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p udp --sport 20433 -j bad_prenat ####################################################################### echo " - DoS Protection Ruleset Loading Complete." ####################################################################### ####################################################################### # NAT PREROUTING DNAT RULES # These rules will cause incoming traffic the firewall sees as NEW to # have the destination address changed (DNAT'd) to the address we want # it to be delivered to. This is really useful, especially when the # destination address is a reserved/private address (like our LVS-NAT # Real Servers). # NTP TRAFFIC # External "new" NTP traffic - DNAT to NTPSRV (This is our NTP Server) # This had to be done because some traffic coming in from our selected # internet servers wasn't being seen as established/related. # # NOTE: The 3 source IP's listed aren't real NTP servers, they're just # shown here as an example to demonstrate what you'll probably need to # do so your local NTP server can sync with public NTP servers on the # internet. /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p udp -s 10.23.24.25 -d $VIP1 --dport 123 -m state --state NEW -j DNAT --to $NTPSRV /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p udp -s 10.26.27.28 -d $VIP1 --dport 123 -m state --state NEW -j DNAT --to $NTPSRV /sbin/iptables -t nat -A PREROUTING -i $EXTIF -p udp -s 10.29.30.31 -d $VIP1 --dport 123 -m state --state NEW -j DNAT --to $NTPSRV ########################################################################### # END OF NAT PREROUTING CHAIN # echo " - NAT PREROUTING Chain and Port Forwarding Table Loaded." ########################################################################### ########################################################################### # NAT *POSTROUTING* CHAIN # We shouldn't need much here, except for SNAT rules to change the source # IP addresses of new outgoing connections from our LVS-NAT Real Servers # into one of our routable public IP's. # # One possible optimization we could make to the firewall script would be # to move the specific rejects in the *_ext_out and *_dmz_fwd chains # (which currently have many redundant rules) to a set of rules here, # like we did with the NAT PREROUTING chain. ########################################################################### # SOURCE-NAT ALL OUTBOUND NEW CONNECTIONS FROM DMZHOSTS # We need to change the source IP address of NEW outbound connections from # DMZ Hosts with internal private addresses (ie, our LVS Real Servers), # before we let their traffic out onto the internet. This will allow these # hosts to make the outbound connections they need to make - examples # include SMTP delivery, DNS digs, pings, just to name a few. Many of # the new outbound connections we need to let out will be expected # to be coming from "official" (DNS-listed) IP addresses, like SMTP # delivery. # # NOTE: If your DNS-listed servers (MX's, etc.) are registered to more # than one IP, you MAY have to add more rules here, and be more specific # with the -s address you want each rule to do SNAT work on (ie, which # routable IP address you want to SNAT those hosts to) /sbin/iptables -t nat -A POSTROUTING -o $EXTIF -s $DMZLAN -j SNAT --to $VIP1 ########################################################################### # OK Everything is loaded - LET'S ROCK!!! # TURN ON IP FORWARDING IN THE LINUX KERNEL echo "1" > /proc/sys/net/ipv4/ip_forward # Turn on PROXY ARP functionality echo "1" > /proc/sys/net/ipv4/conf/$DMZIF/proxy_arp echo "1" > /proc/sys/net/ipv4/conf/$EXTIF/proxy_arp echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp echo "1" > /proc/sys/net/ipv4/conf/default/proxy_arp ########################################################################### echo "Firewall Rule Set Loading is COMPLETE." echo "IPVS Virtual Services, Proxy-ARP, and IP Forwarding is now ENABLED." |