Bigbruin.com
Home :: Reviews & Articles :: Forum :: Info :: :: Facebook :: Youtube :: RSS Feed
Search  :: Register :: Log in
Custom Home Router - iptables Help
 		Go To Page 1, 2  Next
Post new topic   Reply to topic    Bigbruin.com Forum Index -> Software
View previous topic :: View next topic  
Author Message
Blue|Fusion
Rated XXX


Joined: 30 May 2005
Posts: 441
Location: Cleveland, OH
PostPosted: Sun, 13 May 2007 21:09:18    Post Subject: Custom Home Router - iptables Help Reply with quote View Single Post
Over the past few months I have been vastly improving my tiny home network in an effort to learn a little more about more advanced networks. Just recently I replaced my Linksys Router with a spare PC running Linux with dual NICs and iptables.

Right now, it's doing it's job fine with NAT. I am new to manually setting iptables rules, but am trying to learn it in the process. I want to make the system drop or reject (whatever's best suited for the situation) all incoming traffic that shouldn't be coming in. Since there's desktops surfing the web, using IM, and mail, obviously the related traffic would need to get back to the FORWARD chain. I'm not certain, but would assume that's related to checking the packet's state? In essence, I want this PC to firewall all outside traffic to INPUT and FORWARD chains except for that traffic that really should be there.

Here's the relative info:
LAN: eth0: 10.1.1.1
WAN: eth1: 64.233.255.0
Network: 10.1.1.0/24

I have most of the rules set from this HOWTO: http://www.gentoo.org/doc/en/home-router-howto.xml

I also have TCP port 80 forwarded to 10.1.1.20 for web. One thing about this, though is outsiders can view it, but when I attempt to go to the site hosted on the server with the WAN IP, I get connection refused. Any idea about that one?

Any help very appreciated! I really want to learn this iptables stuff already! I've been putting this off for years Rolling Eyes .
_________________
5 home-built PCs, ASUS A6Jc Laptop, and a PowerEdge 2650 - all running Gentoo. Now if only I can get a car and plane to run it. Take a look at my Gallery!
Back to top
View user's profile Send private message
Little Bruin
Boo Boo

Joined: 07 Apr 2003
Posts: 667
Location: Pic-A-Nic Basket
BeerCheeze
*hick*


Joined: 14 Jun 2003
Posts: 9285
Location: At the Bar
PostPosted: Sun, 13 May 2007 21:44:05    Post Subject: Reply with quote View Single Post
Going from inside to outside back in generally confuses things. Don't do it Grin

Also, you want to drop, not reject. Just don't respond to requests.

As for manually setting it up... it's been years since I did it, so I would have to dig through it all and figure it back out. If you can't get it done, let me know and I'll look through the doc's and help you out.
Back to top
View user's profile Send private message
knight0334
Rated XXX


Joined: 22 Aug 2003
Posts: 2234
Location: Neither Here, Nor There
PostPosted: Sun, 13 May 2007 23:33:11    Post Subject: Reply with quote View Single Post
I had the same problem back when I was trying to do the same thing, ...view the site from within the LAN via the WAN IP. However I was using WinXP or Win2K3 with Apache. There were a few "fixes" that I tried, but none really worked. One sorta worked, had to make changes to the config file for certain allowed IP ranges.

I had to setup a local DNS server for my LAN machines to use for resolving for it to work. For LAN viewing of the page, it redirected to the LAN IP of the server rather then going through the WAN IP for local viewing. The rest of the world resolved via remote DNS to my WAN IP.

Not that familiar with Linux, but if it has a "hosts" type file, you might be able to redirect to the LAN IP of the server on each local machine without having to use a DNS server.
Back to top
View user's profile Send private message
knight0334
Rated XXX


Joined: 22 Aug 2003
Posts: 2234
Location: Neither Here, Nor There
PostPosted: Sun, 13 May 2007 23:41:39    Post Subject: Reply with quote View Single Post
I see you're running Apache, check this out.

http://www.webservertalk.com/message1892313.html
Back to top
View user's profile Send private message
Blue|Fusion
Rated XXX


Joined: 30 May 2005
Posts: 441
Location: Cleveland, OH
PostPosted: Mon, 14 May 2007 11:02:31    Post Subject: Reply with quote View Single Post
Thanks for the replies. Prior to using the PC-as-router, the Linksys router allowed me to view Apache via the WAN IP, and I'm trying to emulate that. For now I do have it set in the hosts file, but hopefully only temporarily.

Here are the current iptables rules I have in place. I got these rules from the Gentoo documentation link I posted above.
Code:
#First we flush our current rules
iptables -F
iptables -t nat -F
iptables -t mangle -F

#Setup default policies to handle unmatched traffic
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

#Then we lock our services so they only work from the LAN
iptables -I INPUT 1 -i eth0 -j ACCEPT
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -A INPUT -p UDP --dport bootps -i eth1 -j REJECT
iptables -A INPUT -p UDP --dport domain -i eth1 -j REJECT

#(Optional) Allow access to our ssh server from the WAN
#iptables -A INPUT -p TCP --dport ssh -i eth1 -j ACCEPT

#Drop TCP / UDP packets to privileged ports
iptables -A INPUT -p TCP -i eth1 -d 0/0 --dport 0:1023 -j DROP
iptables -A INPUT -p UDP -i eth1 -d 0/0 --dport 0:1023 -j DROP

#Finally we add the rules for NAT
iptables -I FORWARD -i eth0 -d 10.1.1.0/24 -j DROP
iptables -A FORWARD -i eth0 -s 10.1.1.0/24 -j ACCEPT
iptables -A FORWARD -i eth1 -d 10.1.1.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

#HTTP forwarding to an internal host
iptables -t nat -A PREROUTING -p tcp --dport http -i eth1 -j DNAT --to 10.1.1.20


Like I said, these do their job for NAT and firewalling the LAN, but want to ensure the router box itself is secure on the eth1 interface.
_________________
5 home-built PCs, ASUS A6Jc Laptop, and a PowerEdge 2650 - all running Gentoo. Now if only I can get a car and plane to run it. Take a look at my Gallery!
Back to top
View user's profile Send private message
acruxksa
Doh!


Joined: 17 Oct 2003
Posts: 1051
Location: The Cradle of Storms
PostPosted: Mon, 14 May 2007 13:08:14    Post Subject: Reply with quote View Single Post
I know it might be cheating, but have you tried one of the many iptables script generators?

http://www.iptables.1go.dk/index1.php

http://qtables.radom.org/

http://easyfwgen.morizot.net/gen/

There are dozens of these things out there. Most will give you a good basic firewall that you can then customize to either lock it down further or punch holes in it for specific purposes.

LinuxQuestions - Linux Security Forum can also be a pretty good source of general configuration info.
_________________
Back to top
View user's profile Send private message
Blue|Fusion
Rated XXX


Joined: 30 May 2005
Posts: 441
Location: Cleveland, OH
PostPosted: Mon, 14 May 2007 19:08:46    Post Subject: Reply with quote View Single Post
Thanks for the links. I found a cool howto from a Stanford user and modified it slightly for my own use:

Code:
# chain policies
# drop everything and open stuff as necessary
/sbin/iptables -P INPUT DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -P OUTPUT DROP

/sbin/iptables -F
/sbin/iptables -F INPUT
/sbin/iptables -F OUTPUT
/sbin/iptables -F FORWARD
/sbin/iptables -F -t mangle
/sbin/iptables -F -t nat
/sbin/iptables -X
/sbin/iptables -Z

# create DUMP table
/sbin/iptables -N DUMP
/sbin/iptables -F DUMP
# limited logs
/sbin/iptables -A DUMP -p icmp -m limit --limit 1/m --limit-burst 5 -j LOG --log-prefix "IPT ICMPDUMP: "
/sbin/iptables -A DUMP -p tcp -m limit --limit 1/m --limit-burst 5 -j LOG --log-prefix "IPT TCPDUMP: "
/sbin/iptables -A DUMP -p udp -m limit --limit 1/m --limit-burst 5 -j LOG --log-prefix "IPT UDPDUMP: "

/sbin/iptables -A DUMP -p tcp -j REJECT --reject-with tcp-reset
/sbin/iptables -A DUMP -p udp -j REJECT --reject-with icmp-port-unreachable
/sbin/iptables -A DUMP -j DROP

# Stateful table
/sbin/iptables -N STATEFUL
/sbin/iptables -F STATEFUL
/sbin/iptables -I STATEFUL -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A STATEFUL -m state --state NEW -i ! eth1 -j ACCEPT
/sbin/iptables -A STATEFUL -j DUMP

# SSH protection table
/sbin/iptables -N SSH
/sbin/iptables -F SSH
/sbin/iptables -A SSH -i eth0 -j RETURN
/sbin/iptables -A SSH -m recent --name SSH --set --rsource
/sbin/iptables -A SSH -m recent ! --rcheck --seconds 300 --hitcount 3 --name SSH --rsource -j RETURN
/sbin/iptables -A SSH -j DUMP

# SYN protection table
/sbin/iptables -N SYN-FLOOD
/sbin/iptables -F SYN-FLOOD
/sbin/iptables -A SYN-FLOOD -m limit --limit 1/s --limit-burst 4 -j RETURN
/sbin/iptables -A SYN-FLOOD -j DROP
/sbin/iptables -A INPUT -i eth1 -p tcp --syn -j SYN-FLOOD
/sbin/iptables -A INPUT -p tcp -i eth1 ! --syn -m state --state NEW -j DROP

# watch out for fragments
/sbin/iptables -A INPUT -i eth1 -f -j LOG --log-prefix "IPT FRAGMENTS: "
/sbin/iptables -A INPUT -i eth1 -f -j DROP

# allow loopback in
/sbin/iptables -A INPUT -i lo -j ACCEPT
# allow loopback and LAN out
/sbin/iptables -A OUTPUT -o lo -j ACCEPT
/sbin/iptables -A OUTPUT -p ALL -s ${lannet} -j ACCEPT

# needs to be defined before reserved addresses,
# since our ISP typically uses a reserved address for a DHCP server (sigh)
#/sbin/iptables -A INPUT -p tcp -i eth1 --sport bootps --dport bootpc -j ACCEPT
#/sbin/iptables -A INPUT -p udp -i eth1 --sport bootps --dport bootpc -j ACCEPT

# drop reserved addresses incoming as per IANA listing
/sbin/iptables -A INPUT -i eth1 -s 0.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth1 -s 240.0.0.0/8 -j DUMP

# drop RFC-1918 reserved addresses
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DUMP
iptables -A INPUT -i eth1 -s 172.16.0.0/12 -j DUMP
iptables -A INPUT -i eth1 -s 192.168.0.0/16 -j DUMP

# allow certain inbound ICMP types
/sbin/iptables -A INPUT -i eth1 -p icmp --icmp-type echo-reply -j ACCEPT
/sbin/iptables -A INPUT -i eth1 -p icmp --icmp-type destination-unreachable -j ACCEPT
/sbin/iptables -A INPUT -i eth1 -p icmp --icmp-type source-quench -j ACCEPT
/sbin/iptables -A INPUT -i eth1 -p icmp --icmp-type echo-request -j ACCEPT
/sbin/iptables -A INPUT -i eth1 -p icmp --icmp-type time-exceeded -j ACCEPT
/sbin/iptables -A INPUT -i eth1 -p icmp --icmp-type parameter-problem -j ACCEPT

# opened ports
/sbin/iptables -A INPUT -p tcp -i eth1 --dport ssh -m state --state NEW -j SSH
/sbin/iptables -A INPUT -p tcp -i eth1 --dport ssh -j ACCEPT

# accept all other public ports
#/sbin/iptables -A INPUT -p tcp -i eth1 --dport 1024: -j ACCEPT
#/sbin/iptables -A INPUT -p udp -i eth1 --dport 33434: -j ACCEPT

# masquerade from internal network
/sbin/iptables -I FORWARD -i eth0 -d ${lannet} -j DROP
/sbin/iptables -A FORWARD -i eth0 -s ${lannet} -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -d ${lannet} -j ACCEPT
/sbin/iptables -t nat -A POSTROUTING -s ${lannet} -o eth1 -j MASQUERADE

/sbin/iptables -A INPUT -j STATEFUL
/sbin/iptables -A FORWARD -j STATEFUL
/sbin/iptables -A OUTPUT -j STATEFUL

#Forward Ports to NAT
iptables -t nat -A PREROUTING -p tcp --dport http -i eth1 -j DNAT --to 10.1.1.20


Using nmap against it from one of my servers, it seems pretty solid. If you do see an issue with some of the config, let me know because I am not that experienced with iptables.
_________________
5 home-built PCs, ASUS A6Jc Laptop, and a PowerEdge 2650 - all running Gentoo. Now if only I can get a car and plane to run it. Take a look at my Gallery!

Last edited by Blue|Fusion on Tue, 15 May 2007 01:02:43; edited 1 time in total
Back to top
View user's profile Send private message
Little Bruin
Boo Boo

Joined: 07 Apr 2003
Posts: 667
Location: Pic-A-Nic Basket
BeerCheeze
*hick*


Joined: 14 Jun 2003
Posts: 9285
Location: At the Bar
PostPosted: Mon, 14 May 2007 19:50:41    Post Subject: Reply with quote View Single Post
Deny all ICMP except echo-request & echo-reply.
Back to top
View user's profile Send private message
Blue|Fusion
Rated XXX


Joined: 30 May 2005
Posts: 441
Location: Cleveland, OH
PostPosted: Mon, 14 May 2007 20:32:05    Post Subject: Reply with quote View Single Post
OK, only accepting echo-request and echo-reply. All others are dropped as per INPUT profile.
_________________
5 home-built PCs, ASUS A6Jc Laptop, and a PowerEdge 2650 - all running Gentoo. Now if only I can get a car and plane to run it. Take a look at my Gallery!
Back to top
View user's profile Send private message
BeerCheeze
*hick*


Joined: 14 Jun 2003
Posts: 9285
Location: At the Bar
PostPosted: Mon, 14 May 2007 21:16:39    Post Subject: Reply with quote View Single Post
You also want to drop anything on eth1 coming from an RFC-1918 address (I'm not giving you those, because I want you to look them up... so you remember what it is in case you don't already know it).

Also DHCP (Bootp) doesn't use TCP, no need to allow that. If you have a static IP, you shouldn't need that at all.

You are allowing ssh from the internet, are you sure you want that?

Also this:
Quote:
# accept all other public ports
/sbin/iptables -A INPUT -p tcp -i eth1 --dport 1024: -j ACCEPT
/sbin/iptables -A INPUT -p udp -i eth1 --dport 33434: -j ACCEPT


appears strange. Is there a reason for it? What is running on 1025/tcp and 33434/udp It makes it sound like it's taking all ports, but I don't think so. Not sure of the syntax.

That's a good look through your config with out looking at syntax that is. Grin If I think of anything else I'll let you know.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Bigbruin.com Forum Index -> Software All times are GMT - 4 Hours
Go To Page 1, 2  Next
Page 1 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
Contact Us :: On Facebook :: On Youtube :: Newsletter :: RSS Feed :: FAQ :: Links :: Sponsors :: Privacy Policy
Copyright © 2000 - 2023 Bigbruin.com - All rights reserved