Editing Firewall Configuration at Kortek Electronics Local Server (section)

==Firewall configurations at /etc/rc.d/rc.firewall ==


vi /etc/rc.d/rc.firewall

<nowiki>---------------------------------------------------------------</nowiki>

<nowiki># Internet Configuration.</nowiki>


INET_IP="203.124.23.170"


INET_IFACE="eth1"


INET_BROADCAST="203.124.23.255"


<nowiki># Local Area Network configuration.</nowiki>


LAN_IP="10.203.10.149"


LAN_IP_RANGE="10.203.10.0/255.255.255.0"


LAN_IFACE="eth0"


<nowiki># Localhost Configuration.</nowiki>


LO_IFACE="lo"


LO_IP="127.0.0.1"


<nowiki># IPTables Configuration.</nowiki>


IPTABLES="/sbin/iptables"


<nowiki># Module loading.</nowiki>


/sbin/depmod -a


/sbin/modprobe ip_tables


/sbin/modprobe ip_conntrack


/sbin/modprobe ip_nat_ftp


/sbin/modprobe ip_conntrack_ftp


/sbin/modprobe iptable_filter


/sbin/modprobe iptable_mangle


/sbin/modprobe iptable_nat


/sbin/modprobe ipt_LOG


/sbin/modprobe ipt_limit


/sbin/modprobe ipt_state


<nowiki># /proc set up.</nowiki>


echo "1" > /proc/sys/net/ipv4/ip_forward


<nowiki># Delete old chains for ICMP, TCP and UDP to traverse</nowiki>


$IPTABLES -F


$IPTABLES -X allowed


$IPTABLES -X tcp_packets


$IPTABLES -X udp_packets


$IPTABLES -X icmp_packets


<nowiki># Set Default Policy</nowiki>


$IPTABLES -P INPUT DROP


$IPTABLES -P OUTPUT DROP


$IPTABLES -P FORWARD DROP


<nowiki>#$IPTABLES -P INPUT ACCEPT</nowiki>


<nowiki>#$IPTABLES -P OUTPUT ACCEPT</nowiki>


<nowiki>#$IPTABLES -P FORWARD ACCEPT</nowiki>


<nowiki># Defaults are to DROP anything sent to the firewall or internal network and to permit</nowiki>


<nowiki># anything going out.</nowiki>


$IPTABLES -t filter -P INPUT DROP


$IPTABLES -t filter -P FORWARD DROP


$IPTABLES -t filter -P OUTPUT ACCEPT


$IPTABLES -t nat -P PREROUTING ACCEPT


$IPTABLES -t nat -P POSTROUTING ACCEPT


$IPTABLES -t nat -P OUTPUT ACCEPT


$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags ALL NONE -j REJECT --reject-with icmp-host-unreachable


$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags SYN,FIN SYN,FIN -j REJECT --reject-with icmp-host-unreachable


$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags SYN,RST SYN,RST -j REJECT --reject-with icmp-host-unreachable


$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags FIN,RST FIN,RST -j REJECT --reject-with icmp-host-unreachable


$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags ACK,FIN FIN -j REJECT --reject-with icmp-host-unreachable


$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags ACK,PSH PSH -j REJECT --reject-with icmp-host-unreachable


$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags ACK,URG URG -j REJECT --reject-with icmp-host-unreachable


$IPTABLES -t filter -A INPUT -i $INET_IFACE -f -j DROP


<nowiki>#Allow all packets to be travelled on local network</nowiki>


$IPTABLES -A INPUT -p ALL -s $LAN_IP_RANGE -d $LAN_IP_RANGE -j ACCEPT


$IPTABLES -A OUTPUT -p ALL -s $LAN_IP_RANGE -d $LAN_IP_RANGE -j ACCEPT


<nowiki># Create chain for bad tcp packets</nowiki>


$IPTABLES -N allowed


$IPTABLES -N tcp_packets


$IPTABLES -N udp_packets


$IPTABLES -N icmp_packets


<nowiki>#$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 10000 -j DNAT --to-destination 10.203.10.147:10000</nowiki>


$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 110 -j DNAT --to-destination 10.203.10.147:110


$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 10000 -j DNAT --to-destination 10.203.10.149:10000


$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 3389 -j DNAT --to-destination 10.203.10.150:3389


$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 25 -j DNAT --to-destination 10.203.10.147:25


$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 80 -j DNAT --to-destination 10.203.10.147:80


<nowiki>#$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 -d 203.124.23.170 -m multiport --dport 110,25,80 -j DNAT --to-destination 10.203.10.147</nowiki>


<nowiki>#$IPTABLES -t nat -A PREROUTING -p tcp -i eth1 -d 203.124.23.170 -m multiport --dport 110,25,80 -j DNAT --to-destination 10.203.10.147</nowiki>


$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 110 -j DNAT --to-destination 10.203.10.147:110


$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 10000 -j DNAT --to-destination 10.203.10.149:10000


$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 3389 -j DNAT --to-destination 10.203.10.150:3389


$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 25 -j DNAT --to-destination 10.203.10.147:25


$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 80 -j DNAT --to-destination 10.203.10.147:80


<nowiki>#iptables -t nat -I POSTROUTING -o eth0 -s 10.203.10.0/24 -d 10.203.10.147 -j MASQUERADE</nowiki>


<nowiki>#iptables -I FORWARD -i eth0 -o eth0 -d 10.203.10.147 -j ACCEPT</nowiki>


<nowiki>#iptables -I FORWARD -i eth0 -o eth0 -s 10.203.10.147 -j ACCEPT</nowiki>


<nowiki># allowed chain</nowiki>


$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 3389 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


<nowiki>#$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 10000 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT</nowiki>


$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 110 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 10000 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


$IPTABLES -A allowed -p TCP --syn -j ACCEPT


$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT


$IPTABLES -A allowed -p TCP -j DROP


<nowiki># TCP rules</nowiki>


$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 110 -j allowed


$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 10000 -j allowed


$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 25 -j allowed


$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed


$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed


$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 3389 -j allowed


$IPTABLES -A tcp_packets -p TCP -d 207.46.170.123 -j allowed


<nowiki>#$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 10000 -j allowed</nowiki>


<nowiki>#In this example iptables is being configured to allow the firewall send ICMP echo-requests</nowiki>


<nowiki># and in turn, accept the expected ICMP echo-replies.</nowiki>


$IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT


$IPTABLES -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT


<nowiki># UDP ports</nowiki>


$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT


$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 123 -j ACCEPT


$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 2074 -j ACCEPT


$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 4000 -j ACCEPT


<nowiki># In Microsoft Networks you will be swamped by broadcasts. These lines</nowiki>


<nowiki># will prevent them from showing up in the logs.</nowiki>


$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d $INET_BROADCAST --destination-port 135:139 -j DROP


<nowiki># If we get DHCP requests from the Outside of our network, our logs will</nowiki>


<nowiki># be swamped as well. This rule will block them from getting logged.</nowiki>


$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d 255.255.255.255 --destination-port 67:68 -j DROP


<nowiki># ICMP rules</nowiki>


$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT


$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT


<nowiki># Rules for special networks not part of the Internet</nowiki>


$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT


$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT


$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT


<nowiki># Rules for incoming packets from anywhere.</nowiki>


$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT


$IPTABLES -A INPUT -p TCP -j tcp_packets


$IPTABLES -A INPUT -p UDP -j udp_packets


$IPTABLES -A INPUT -p ICMP -j icmp_packets


<nowiki>###Allow incoming packets for following ports only</nowiki>


$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 3389 -j ACCEPT


$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 80 -j ACCEPT


$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 25 -j ACCEPT


$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 110 -j ACCEPT


<nowiki>#$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d </nowiki>207.46.170.0/255.255.255.0 -j ACCEPT


<nowiki>#$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d </nowiki>64.4.31.0/255.255.255.0 -j ACCEPT


<nowiki>#$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 10000 -j ACCEPT</nowiki>


<nowiki># If you have a Microsoft Network on the outside of your firewall, you may also</nowiki>


<nowiki># get flooded by Multicasts. We drop them so we do not get flooded by logs</nowiki>


<nowiki># Log weird packets that don't match the above.</nowiki>


$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "


<nowiki># Accept the packets we actually want to forward</nowiki>


$IPTABLES -t nat -A POSTROUTING -d ! 10.203.10.0/255.255.255.0 -j MASQUERADE


$IPTABLES -t nat -I POSTROUTING -o eth0 -s 10.203.10.0/24 -d 10.203.10.147 -j MASQUERADE


<nowiki>#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 64.4.13.0/24 -j MASQUERADE</nowiki>


<nowiki>#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 152.163.241.0/24 -j MASQUERADE</nowiki>


<nowiki>#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 207.46.110.0/24 -j MASQUERADE</nowiki>


<nowiki>#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 207.46.1.0/24 </nowiki>-j MASQUERADE


<nowiki>#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 65.54.0.0/16 -j MASQUERADE</nowiki>


<nowiki>#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 207.46.104.0/24 -j MASQUERADE</nowiki>


<nowiki>#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 207.46.110.0/24 -j MASQUERADE</nowiki>


<nowiki>## For ram</nowiki>


$IPTABLES -I FORWARD -i eth0 -o eth0 -d 10.203.10.11 -j ACCEPT


$IPTABLES -I FORWARD -i eth0 -o eth0 -s 10.203.10.11 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.37 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.37 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.253 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.253 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.147 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.147 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.150 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.150 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.146 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.146 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.7 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.7 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.249 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.249 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.248 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.248 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.29 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.29 -j ACCEPT


<nowiki>#$IPTABLES -A FORWARD -s 10.203.10.251 </nowiki>-j ACCEPT


<nowiki>#$IPTABLES -A FORWARD -d 10.203.10.251 </nowiki>-j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.62 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.62 -j ACCEPT


<nowiki>#iptables -A FORWARD -s 10.203.10.252 -p tcp --dport 1863 -j ACCEPT</nowiki>


<nowiki>#iptables -A FORWARD -s 10.203.10.252 -p tcp --dport 80 -j ACCEPT</nowiki>


<nowiki>#iptables -A FORWARD -s 10.203.10.252 -p tcp --dport 443 -j ACCEPT</nowiki>


<nowiki>#iptables -A FORWARD -s 10.203.10.252 -p tcp --dport 6891:6900 -j ACCEPT</nowiki>


<nowiki>#iptables -A FORWARD -s 10.203.10.252 -p udp --dport 5004:65535 -j ACCEPT</nowiki>


<nowiki>#iptables -A FORWARD -d 10.203.10.252 -p tcp --sport 1863 -j ACCEPT</nowiki>


<nowiki>#iptables -A FORWARD -d 10.203.10.252 -p tcp --dport 80 -j ACCEPT</nowiki>


<nowiki>#iptables -A FORWARD -d 10.203.10.252 -p tcp --dport 443 -j ACCEPT</nowiki>


<nowiki>#iptables -A FORWARD -d 10.203.10.252 -p tcp --sport 6891:6900 -j ACCEPT</nowiki>


<nowiki>#iptables -A FORWARD -d 10.203.10.252 -p udp --sport 5004:65535 -j ACCEPT</nowiki>


<nowiki>#iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 1863 -j ACCEPT</nowiki>


<nowiki>#iptables -A FORWARD </nowiki>-d 207.46.111.0/255.255.255.0 -j ACCEPT


<nowiki>#iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 6891:6900 -j ACCEPT</nowiki>


<nowiki>#iptables -A FORWARD -i eth0 -o eth1 -p udp --dport 5004:65535 -j ACCEPT</nowiki>


$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "


<nowiki>#</nowiki>


<nowiki># 4.1.6 OUTPUT chain</nowiki>


<nowiki>#</nowiki>


<nowiki>#</nowiki>


<nowiki># Bad TCP packets we don't want.</nowiki>


<nowiki>#</nowiki>


<nowiki>#</nowiki>


<nowiki># Special OUTPUT rules to decide which IP's to allow.</nowiki>


<nowiki>#</nowiki>


$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT


$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT


$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT


<nowiki># Log weird packets that don't match the above.</nowiki>


$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "


<nowiki># Enable simple IP Forwarding and Network Address Translation</nowiki>

<nowiki>---------------------------------------------------------------</nowiki>


vi /etc/rc.local

/etc/rc.d/rc.firewall


/etc/rc.d/rc.firewall