Jump to content

Firewall Configuration at Kortek Electronics Local Server

From TetraWiki
Revision as of 14:30, 14 January 2013 by Biswajit (talk | contribs) (Created page with "Kortek Electronics India Limited Firewall configurations vi /etc/rc.d/rc.firewall <nowiki>---------------------------------------------------------------</nowiki> <nowik...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Kortek Electronics India Limited


Firewall configurations


vi /etc/rc.d/rc.firewall

---------------------------------------------------------------

# Internet Configuration.


INET_IP="203.124.23.170"


INET_IFACE="eth1"


INET_BROADCAST="203.124.23.255"


# Local Area Network configuration.


LAN_IP="10.203.10.149"


LAN_IP_RANGE="10.203.10.0/255.255.255.0"


LAN_IFACE="eth0"


# Localhost Configuration.


LO_IFACE="lo"


LO_IP="127.0.0.1"


# IPTables Configuration.


IPTABLES="/sbin/iptables"


# Module loading.


/sbin/depmod -a


/sbin/modprobe ip_tables


/sbin/modprobe ip_conntrack


/sbin/modprobe ip_nat_ftp


/sbin/modprobe ip_conntrack_ftp


/sbin/modprobe iptable_filter


/sbin/modprobe iptable_mangle


/sbin/modprobe iptable_nat


/sbin/modprobe ipt_LOG


/sbin/modprobe ipt_limit


/sbin/modprobe ipt_state


# /proc set up.


echo "1" > /proc/sys/net/ipv4/ip_forward


# Delete old chains for ICMP, TCP and UDP to traverse


$IPTABLES -F


$IPTABLES -X allowed


$IPTABLES -X tcp_packets


$IPTABLES -X udp_packets


$IPTABLES -X icmp_packets


# Set Default Policy


$IPTABLES -P INPUT DROP


$IPTABLES -P OUTPUT DROP


$IPTABLES -P FORWARD DROP


#$IPTABLES -P INPUT ACCEPT


#$IPTABLES -P OUTPUT ACCEPT


#$IPTABLES -P FORWARD ACCEPT


# Defaults are to DROP anything sent to the firewall or internal network and to permit


# anything going out.


$IPTABLES -t filter -P INPUT DROP


$IPTABLES -t filter -P FORWARD DROP


$IPTABLES -t filter -P OUTPUT ACCEPT


$IPTABLES -t nat -P PREROUTING ACCEPT


$IPTABLES -t nat -P POSTROUTING ACCEPT


$IPTABLES -t nat -P OUTPUT ACCEPT


$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags ALL NONE -j REJECT --reject-with icmp-host-unreachable


$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags SYN,FIN SYN,FIN -j REJECT --reject-with icmp-host-unreachable


$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags SYN,RST SYN,RST -j REJECT --reject-with icmp-host-unreachable


$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags FIN,RST FIN,RST -j REJECT --reject-with icmp-host-unreachable


$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags ACK,FIN FIN -j REJECT --reject-with icmp-host-unreachable


$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags ACK,PSH PSH -j REJECT --reject-with icmp-host-unreachable


$IPTABLES -t filter -A INPUT -i $INET_IFACE -p TCP --tcp-flags ACK,URG URG -j REJECT --reject-with icmp-host-unreachable


$IPTABLES -t filter -A INPUT -i $INET_IFACE -f -j DROP


#Allow all packets to be travelled on local network


$IPTABLES -A INPUT -p ALL -s $LAN_IP_RANGE -d $LAN_IP_RANGE -j ACCEPT


$IPTABLES -A OUTPUT -p ALL -s $LAN_IP_RANGE -d $LAN_IP_RANGE -j ACCEPT


# Create chain for bad tcp packets


$IPTABLES -N allowed


$IPTABLES -N tcp_packets


$IPTABLES -N udp_packets


$IPTABLES -N icmp_packets


#$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 10000 -j DNAT --to-destination 10.203.10.147:10000


$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 110 -j DNAT --to-destination 10.203.10.147:110


$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 10000 -j DNAT --to-destination 10.203.10.149:10000


$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 3389 -j DNAT --to-destination 10.203.10.150:3389


$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 25 -j DNAT --to-destination 10.203.10.147:25


$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 80 -j DNAT --to-destination 10.203.10.147:80


#$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 -d 203.124.23.170 -m multiport --dport 110,25,80 -j DNAT --to-destination 10.203.10.147


#$IPTABLES -t nat -A PREROUTING -p tcp -i eth1 -d 203.124.23.170 -m multiport --dport 110,25,80 -j DNAT --to-destination 10.203.10.147


$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 110 -j DNAT --to-destination 10.203.10.147:110


$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 10000 -j DNAT --to-destination 10.203.10.149:10000


$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 3389 -j DNAT --to-destination 10.203.10.150:3389


$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 25 -j DNAT --to-destination 10.203.10.147:25


$IPTABLES -t nat -I PREROUTING -d 203.124.23.170 -p tcp --dport 80 -j DNAT --to-destination 10.203.10.147:80


#iptables -t nat -I POSTROUTING -o eth0 -s 10.203.10.0/24 -d 10.203.10.147 -j MASQUERADE


#iptables -I FORWARD -i eth0 -o eth0 -d 10.203.10.147 -j ACCEPT


#iptables -I FORWARD -i eth0 -o eth0 -s 10.203.10.147 -j ACCEPT


# allowed chain


$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 3389 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


#$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 10000 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 110 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 10000 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


$IPTABLES -A FORWARD -i eth1 -o eth0 -p TCP --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


$IPTABLES -A allowed -p TCP --syn -j ACCEPT


$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT


$IPTABLES -A allowed -p TCP -j DROP


# TCP rules


$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 110 -j allowed


$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 10000 -j allowed


$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 25 -j allowed


$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed


$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed


$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 3389 -j allowed


$IPTABLES -A tcp_packets -p TCP -d 207.46.170.123 -j allowed


#$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 10000 -j allowed


#In this example iptables is being configured to allow the firewall send ICMP echo-requests


# and in turn, accept the expected ICMP echo-replies.


$IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT


$IPTABLES -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT


# UDP ports


$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT


$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 123 -j ACCEPT


$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 2074 -j ACCEPT


$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 4000 -j ACCEPT


# In Microsoft Networks you will be swamped by broadcasts. These lines


# will prevent them from showing up in the logs.


$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d $INET_BROADCAST --destination-port 135:139 -j DROP


# If we get DHCP requests from the Outside of our network, our logs will


# be swamped as well. This rule will block them from getting logged.


$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d 255.255.255.255 --destination-port 67:68 -j DROP


# ICMP rules


$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT


$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT


# Rules for special networks not part of the Internet


$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT


$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT


$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT


# Rules for incoming packets from anywhere.


$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT


$IPTABLES -A INPUT -p TCP -j tcp_packets


$IPTABLES -A INPUT -p UDP -j udp_packets


$IPTABLES -A INPUT -p ICMP -j icmp_packets


###Allow incoming packets for following ports only


$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 3389 -j ACCEPT


$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 80 -j ACCEPT


$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 25 -j ACCEPT


$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 110 -j ACCEPT


#$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d 207.46.170.0/255.255.255.0 -j ACCEPT


#$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d 64.4.31.0/255.255.255.0 -j ACCEPT


#$IPTABLES -A INPUT -i $INET_IFACE -s 0.0.0.0 -d $INET_IP -p 10000 -j ACCEPT


# If you have a Microsoft Network on the outside of your firewall, you may also


# get flooded by Multicasts. We drop them so we do not get flooded by logs


# Log weird packets that don't match the above.


$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "


# Accept the packets we actually want to forward


$IPTABLES -t nat -A POSTROUTING -d ! 10.203.10.0/255.255.255.0 -j MASQUERADE


$IPTABLES -t nat -I POSTROUTING -o eth0 -s 10.203.10.0/24 -d 10.203.10.147 -j MASQUERADE


#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 64.4.13.0/24 -j MASQUERADE


#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 152.163.241.0/24 -j MASQUERADE


#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 207.46.110.0/24 -j MASQUERADE


#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 207.46.1.0/24 -j MASQUERADE


#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 65.54.0.0/16 -j MASQUERADE


#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 207.46.104.0/24 -j MASQUERADE


#$IPTABLES -A POSTROUTING -t nat -o eth0 -s 10.203.10.0/24 -d 207.46.110.0/24 -j MASQUERADE


## For ram


$IPTABLES -I FORWARD -i eth0 -o eth0 -d 10.203.10.11 -j ACCEPT


$IPTABLES -I FORWARD -i eth0 -o eth0 -s 10.203.10.11 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.37 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.37 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.253 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.253 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.147 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.147 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.150 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.150 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.146 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.146 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.7 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.7 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.249 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.249 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.248 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.248 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.29 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.29 -j ACCEPT


#$IPTABLES -A FORWARD -s 10.203.10.251 -j ACCEPT


#$IPTABLES -A FORWARD -d 10.203.10.251 -j ACCEPT


$IPTABLES -A FORWARD -s 10.203.10.62 -j ACCEPT


$IPTABLES -A FORWARD -d 10.203.10.62 -j ACCEPT


#iptables -A FORWARD -s 10.203.10.252 -p tcp --dport 1863 -j ACCEPT


#iptables -A FORWARD -s 10.203.10.252 -p tcp --dport 80 -j ACCEPT


#iptables -A FORWARD -s 10.203.10.252 -p tcp --dport 443 -j ACCEPT


#iptables -A FORWARD -s 10.203.10.252 -p tcp --dport 6891:6900 -j ACCEPT


#iptables -A FORWARD -s 10.203.10.252 -p udp --dport 5004:65535 -j ACCEPT


#iptables -A FORWARD -d 10.203.10.252 -p tcp --sport 1863 -j ACCEPT


#iptables -A FORWARD -d 10.203.10.252 -p tcp --dport 80 -j ACCEPT


#iptables -A FORWARD -d 10.203.10.252 -p tcp --dport 443 -j ACCEPT


#iptables -A FORWARD -d 10.203.10.252 -p tcp --sport 6891:6900 -j ACCEPT


#iptables -A FORWARD -d 10.203.10.252 -p udp --sport 5004:65535 -j ACCEPT


#iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 1863 -j ACCEPT


#iptables -A FORWARD -d 207.46.111.0/255.255.255.0 -j ACCEPT


#iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 6891:6900 -j ACCEPT


#iptables -A FORWARD -i eth0 -o eth1 -p udp --dport 5004:65535 -j ACCEPT


$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "


#


# 4.1.6 OUTPUT chain


#


#


# Bad TCP packets we don't want.


#


#


# Special OUTPUT rules to decide which IP's to allow.


#


$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT


$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT


$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT


# Log weird packets that don't match the above.


$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "


# Enable simple IP Forwarding and Network Address Translation

---------------------------------------------------------------


vi /etc/rc.local

/etc/rc.d/rc.firewall


/etc/rc.d/rc.firewall

Retrieved from "https://wiki.tetrain.com/index.php?title=Firewall_Configuration_at_Kortek_Electronics_Local_Server&oldid=1044"