Biswajit at 14:32, 14 January 2013

2013-01-14T14:32:13Z

Biswajit: Created page with "Kortek Electronics India Limited Firewall configurations vi /etc/rc.d/rc.firewall ---------------------------------------------------------------
2013-01-14T14:30:23Z

Created page with "Kortek Electronics India Limited Firewall configurations vi /etc/rc.d/rc.firewall <nowiki>---------------------------------------------------------------</nowiki> <nowik..."

New page
Kortek Electronics India Limited

Firewall configurations

vi /etc/rc.d/rc.firewall

<nowiki>---------------------------------------------------------------</nowiki>

<nowiki># Internet Configuration.</nowiki>

INET_IP="203.124.23.170"

INET_IFACE="eth1"

INET_BROADCAST="203.124.23.255"

<nowiki># Local Area Network configuration.</nowiki>

LAN_IP="10.203.10.149"

LAN_IP_RANGE="10.203.10.0/255.255.255.0"

LAN_IFACE="eth0"

<nowiki># Localhost Configuration.</nowiki>

LO_IFACE="lo"

LO_IP="127.0.0.1"

<nowiki># IPTables Configuration.</nowiki>

IPTABLES="/sbin/iptables"

<nowiki># Module loading.</nowiki>

/sbin/depmod -a

/sbin/modprobe ip_tables

/sbin/modprobe ip_conntrack

/sbin/modprobe ip_nat_ftp

/sbin/modprobe ip_conntrack_ftp

/sbin/modprobe iptable_filter

/sbin/modprobe iptable_mangle

/sbin/modprobe iptable_nat

/sbin/modprobe ipt_LOG

/sbin/modprobe ipt_limit

/sbin/modprobe ipt_state

<nowiki># /proc set up.</nowiki>

echo "1" > /proc/sys/net/ipv4/ip_forward

<nowiki># Delete old chains for ICMP, TCP and UDP to traverse</nowiki>

$IPTABLES -F

$IPTABLES -X allowed

$IPTABLES -X tcp_packets

$IPTABLES -X udp_packets

$IPTABLES -X icmp_packets

<nowiki># Set Default Policy</nowiki>

$IPTABLES -P INPUT DROP

$IPTABLES -P OUTPUT DROP

$IPTABLES -P FORWARD DROP

<nowiki>#$IPTABLES -P INPUT ACCEPT</nowiki>

<nowiki>#$IPTABLES -P OUTPUT ACCEPT</nowiki>

<nowiki>#$IPTABLES -P FORWARD ACCEPT</nowiki>

<nowiki># Defaults are to DROP anything sent to the firewall or internal network and to permit</nowiki>

<nowiki># anything going out.</nowiki>

$IPTABLES -t filter -P INPUT DROP

$IPTABLES -t filter -P FORWARD DROP

$IPTABLES -t filter -P OUTPUT ACCEPT

$IPTABLES -t nat -P PREROUTING ACCEPT

$IPTABLES -t nat -P POSTROUTING ACCEPT

$IPTABLES -t nat -P OUTPUT ACCEPT

$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags ALL NONE -j REJECT --reject-with icmp-host-unreachable

$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags SYN,FIN SYN,FIN -j REJECT --reject-with icmp-host-unreachable

$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags SYN,RST SYN,RST -j REJECT --reject-with icmp-host-unreachable

$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags FIN,RST FIN,RST -j REJECT --reject-with icmp-host-unreachable

$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags ACK,FIN FIN -j REJECT --reject-with icmp-host-unreachable

$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags ACK,PSH PSH -j REJECT --reject-with icmp-host-unreachable

$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags ACK,URG URG -j REJECT --reject-with icmp-host-unreachable

$IPTABLES -t filter -A INPUT -i $INET_IFACE -f -j DROP

<nowiki>#Allow all packets to be travelled on local network</nowiki>

$IPTABLES -A INPUT -p ALL -s $LAN_IP_RANGE -d $LAN_IP_RANGE -j ACCEPT

$IPTABLES -A OUTPUT -p ALL -s $LAN_IP_RANGE -d $LAN_IP_RANGE -j ACCEPT

<nowiki># Create chain for bad tcp packets</nowiki>

$IPTABLES -N allowed

$IPTABLES -N tcp_packets

$IPTABLES -N udp_packets

$IPTABLES -N icmp_packets

<nowiki>#$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 10000 -j DNAT --to-destination 10.203.10.147:10000</nowiki>

$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 110 -j DNAT --to-destination 10.203.10.147:110

$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 10000 -j DNAT --to-destination 10.203.10.149:10000

$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 3389 -j DNAT --to-destination 10.203.10.150:3389

$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 25 -j DNAT --to-destination 10.203.10.147:25

$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 80 -j DNAT --to-destination 10.203.10.147:80

<nowiki>#$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 -d 203.124.23.170 -m multiport --dport 110,25,80 -j DNAT --to-destination 10.203.10.147</nowiki>

<nowiki>#$IPTABLES -t nat -A PREROUTING -p tcp -i eth1 -d 203.124.23.170 -m multiport --dport 110,25,80 -j DNAT --to-destination 10.203.10.147</nowiki>

$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 110 -j DNAT --to-destination 10.203.10.147:110

$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 10000 -j DNAT --to-destination 10.203.10.149:10000

$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 3389 -j DNAT --to-destination 10.203.10.150:3389

$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 25 -j DNAT --to-destination 10.203.10.147:25

$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 80 -j DNAT --to-destination 10.203.10.147:80

<nowiki>#iptables -t nat -I POSTROUTING -o eth0 -s 10.203.10.0/24 -d 10.203.10.147 -j MASQUERADE</nowiki>

<nowiki>#iptables -I FORWARD -i eth0 -o eth0 -d 10.203.10.147 -j ACCEPT</nowiki>

<nowiki>#iptables -I FORWARD -i eth0 -o eth0 -s 10.203.10.147 -j ACCEPT</nowiki>

<nowiki># allowed chain</nowiki>

$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 3389 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

<nowiki>#$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 10000 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT</nowiki>

$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 110 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 10000 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A allowed -p TCP --syn -j ACCEPT

$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A allowed -p TCP -j DROP

<nowiki># TCP rules</nowiki>

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 110 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 10000 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 25 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 3389 -j allowed

$IPTABLES -A tcp_packets -p TCP -d 207.46.170.123 -j allowed

<nowiki>#$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 10000 -j allowed</nowiki>

<nowiki>#In this example iptables is being configured to allow the firewall send ICMP echo-requests</nowiki>

<nowiki># and in turn, accept the expected ICMP echo-replies.</nowiki>

$IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT

$IPTABLES -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

<nowiki># UDP ports</nowiki>

$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT

$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 123 -j ACCEPT

$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 2074 -j ACCEPT

$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 4000 -j ACCEPT

<nowiki># In Microsoft Networks you will be swamped by broadcasts. These lines</nowiki>

<nowiki># will prevent them from showing up in the logs.</nowiki>

$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d $INET_BROADCAST --destination-port 135:139 -j DROP

<nowiki># If we get DHCP requests from the Outside of our network, our logs will</nowiki>

<nowiki># be swamped as well. This rule will block them from getting logged.</nowiki>

$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d 255.255.255.255 --destination-port 67:68 -j DROP

<nowiki># ICMP rules</nowiki>

$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT

$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT

<nowiki># Rules for special networks not part of the Internet</nowiki>

$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT

$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT

$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT

<nowiki># Rules for incoming packets from anywhere.</nowiki>

$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A INPUT -p TCP -j tcp_packets

$IPTABLES -A INPUT -p UDP -j udp_packets

$IPTABLES -A INPUT -p ICMP -j icmp_packets

<nowiki>###Allow incoming packets for following ports only</nowiki>

$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 3389 -j ACCEPT

$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 80 -j ACCEPT

$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 25 -j ACCEPT

$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 110 -j ACCEPT

<nowiki>#$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d </nowiki>207.46.170.0/255.255.255.0 -j ACCEPT

<nowiki>#$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d </nowiki>64.4.31.0/255.255.255.0 -j ACCEPT

<nowiki>#$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 10000 -j ACCEPT</nowiki>

<nowiki># If you have a Microsoft Network on the outside of your firewall, you may also</nowiki>

<nowiki># get flooded by Multicasts. We drop them so we do not get flooded by logs</nowiki>

<nowiki># Log weird packets that don't match the above.</nowiki>

$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "

<nowiki># Accept the packets we actually want to forward</nowiki>

$IPTABLES -t nat -A POSTROUTING -d ! 10.203.10.0/255.255.255.0 -j MASQUERADE

$IPTABLES -t nat -I POSTROUTING -o eth0 -s 10.203.10.0/24 -d 10.203.10.147 -j MASQUERADE

<nowiki>#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 64.4.13.0/24 -j MASQUERADE</nowiki>

<nowiki>#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 152.163.241.0/24 -j MASQUERADE</nowiki>

<nowiki>#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 207.46.110.0/24 -j MASQUERADE</nowiki>

<nowiki>#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 207.46.1.0/24 </nowiki>-j MASQUERADE

<nowiki>#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 65.54.0.0/16 -j MASQUERADE</nowiki>

<nowiki>#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 207.46.104.0/24 -j MASQUERADE</nowiki>

<nowiki>#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 207.46.110.0/24 -j MASQUERADE</nowiki>

<nowiki>## For ram</nowiki>

$IPTABLES -I FORWARD -i eth0 -o eth0 -d 10.203.10.11 -j ACCEPT

$IPTABLES -I FORWARD -i eth0 -o eth0 -s 10.203.10.11 -j ACCEPT

$IPTABLES -A FORWARD -s 10.203.10.37 -j ACCEPT

$IPTABLES -A FORWARD -d 10.203.10.37 -j ACCEPT

$IPTABLES -A FORWARD -s 10.203.10.253 -j ACCEPT

$IPTABLES -A FORWARD -d 10.203.10.253 -j ACCEPT

$IPTABLES -A FORWARD -s 10.203.10.147 -j ACCEPT

$IPTABLES -A FORWARD -d 10.203.10.147 -j ACCEPT

$IPTABLES -A FORWARD -s 10.203.10.150 -j ACCEPT

$IPTABLES -A FORWARD -d 10.203.10.150 -j ACCEPT

$IPTABLES -A FORWARD -s 10.203.10.146 -j ACCEPT

$IPTABLES -A FORWARD -d 10.203.10.146 -j ACCEPT

$IPTABLES -A FORWARD -s 10.203.10.7 -j ACCEPT

$IPTABLES -A FORWARD -d 10.203.10.7 -j ACCEPT

$IPTABLES -A FORWARD -s 10.203.10.249 -j ACCEPT

$IPTABLES -A FORWARD -d 10.203.10.249 -j ACCEPT

$IPTABLES -A FORWARD -s 10.203.10.248 -j ACCEPT

$IPTABLES -A FORWARD -d 10.203.10.248 -j ACCEPT

$IPTABLES -A FORWARD -s 10.203.10.29 -j ACCEPT

$IPTABLES -A FORWARD -d 10.203.10.29 -j ACCEPT

<nowiki>#$IPTABLES -A FORWARD -s 10.203.10.251 </nowiki>-j ACCEPT

<nowiki>#$IPTABLES -A FORWARD -d 10.203.10.251 </nowiki>-j ACCEPT

$IPTABLES -A FORWARD -s 10.203.10.62 -j ACCEPT

$IPTABLES -A FORWARD -d 10.203.10.62 -j ACCEPT

<nowiki>#iptables -A FORWARD -s 10.203.10.252 -p tcp --dport 1863 -j ACCEPT</nowiki>

<nowiki>#iptables -A FORWARD -s 10.203.10.252 -p tcp --dport 80 -j ACCEPT</nowiki>

<nowiki>#iptables -A FORWARD -s 10.203.10.252 -p tcp --dport 443 -j ACCEPT</nowiki>

<nowiki>#iptables -A FORWARD -s 10.203.10.252 -p tcp --dport 6891:6900 -j ACCEPT</nowiki>

<nowiki>#iptables -A FORWARD -s 10.203.10.252 -p udp --dport 5004:65535 -j ACCEPT</nowiki>

<nowiki>#iptables -A FORWARD -d 10.203.10.252 -p tcp --sport 1863 -j ACCEPT</nowiki>

<nowiki>#iptables -A FORWARD -d 10.203.10.252 -p tcp --dport 80 -j ACCEPT</nowiki>

<nowiki>#iptables -A FORWARD -d 10.203.10.252 -p tcp --dport 443 -j ACCEPT</nowiki>

<nowiki>#iptables -A FORWARD -d 10.203.10.252 -p tcp --sport 6891:6900 -j ACCEPT</nowiki>

<nowiki>#iptables -A FORWARD -d 10.203.10.252 -p udp --sport 5004:65535 -j ACCEPT</nowiki>

<nowiki>#iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 1863 -j ACCEPT</nowiki>

<nowiki>#iptables -A FORWARD </nowiki>-d 207.46.111.0/255.255.255.0 -j ACCEPT

<nowiki>#iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 6891:6900 -j ACCEPT</nowiki>

<nowiki>#iptables -A FORWARD -i eth0 -o eth1 -p udp --dport 5004:65535 -j ACCEPT</nowiki>

$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "

<nowiki>#</nowiki>

<nowiki># 4.1.6 OUTPUT chain</nowiki>

<nowiki>#</nowiki>

<nowiki>#</nowiki>

<nowiki># Bad TCP packets we don't want.</nowiki>

<nowiki>#</nowiki>

<nowiki>#</nowiki>

<nowiki># Special OUTPUT rules to decide which IP's to allow.</nowiki>

<nowiki>#</nowiki>

$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT

$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT

$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT

<nowiki># Log weird packets that don't match the above.</nowiki>

$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "

<nowiki># Enable simple IP Forwarding and Network Address Translation</nowiki>

<nowiki>---------------------------------------------------------------</nowiki>

vi /etc/rc.local

/etc/rc.d/rc.firewall

/etc/rc.d/rc.firewall

Firewall Configuration at Kortek Electronics Local Server - Revision history

Biswajit at 14:32, 14 January 2013