Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Simple Stateful Firewall - Beginner
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
gentian
Tux's lil' helper
Tux's lil' helper


Joined: 26 Mar 2012
Posts: 113

PostPosted: Thu May 10, 2012 8:55 am    Post subject: Simple Stateful Firewall - Beginner Reply with quote

Is this a safe wiki to use for someone who is a beginner in IPTABLES?

https://wiki.archlinux.org/index.php/Simple_Stateful_Firewall
Back to top
View user's profile Send private message
aCOSwt
Moderator
Moderator


Joined: 19 Oct 2007
Posts: 2389
Location: Hilbert space

PostPosted: Thu May 10, 2012 9:15 am    Post subject: Reply with quote

I cannot tell about this one but, while being a gentooer, why not The Gentoo's one ?
_________________
Back to top
View user's profile Send private message
gentian
Tux's lil' helper
Tux's lil' helper


Joined: 26 Mar 2012
Posts: 113

PostPosted: Thu May 10, 2012 9:17 am    Post subject: Reply with quote

aCOSwt wrote:
I cannot tell about this one but, while being a gentooer, why not The Gentoo's one ?

I was always dubious about the gentoo-wiki validity and status, as it is not an official gentoo.org source. I think that the Arch wiki entries are phenomenal and very simplistic. Just wondering if it covers the ground better?
Back to top
View user's profile Send private message
PaulBredbury
Watchman
Watchman


Joined: 14 Jul 2005
Posts: 7310

PostPosted: Thu May 10, 2012 10:25 am    Post subject: Reply with quote

Both pages seem reasonable. My advice is:

1. Beware - there's lots of gotchas, in iptables rules, and networking.
2. No one document tells you everything - you have to google a lot, and experiment a lot.
3. You're not the NSA, so don't need to be as paranoid as some of the docs are.
4. ICMP is needed for e.g. MTU negotiation, so be very careful if you choose to selectively block/rate-limit it.
Back to top
View user's profile Send private message
Goverp
Guru
Guru


Joined: 07 Mar 2007
Posts: 325

PostPosted: Fri May 11, 2012 8:54 am    Post subject: Reply with quote

If you're just after a simple firewall, rather than learning iptables, try net-firewall/ufw (and perhaps kde-misc/kcm-ufw). They make configuring a simple firewall really easy.
_________________
Greybeard
Back to top
View user's profile Send private message
gentian
Tux's lil' helper
Tux's lil' helper


Joined: 26 Mar 2012
Posts: 113

PostPosted: Fri May 11, 2012 9:00 am    Post subject: Reply with quote

Goverp wrote:
If you're just after a simple firewall, rather than learning iptables, try net-firewall/ufw (and perhaps kde-misc/kcm-ufw). They make configuring a simple firewall really easy.
I tried installing ufw and I got:
Code:
 *   CONFIG_NETFILTER_XT_MATCH_COMMENT:    is not set when it should be.
 *   CONFIG_IP6_NF_MATCH_HL:    is not set when it should be.
 *   CONFIG_NETFILTER_XT_MATCH_LIMIT:    is not set when it should be.
 *   CONFIG_NETFILTER_XT_MATCH_MULTIPORT:    is not set when it should be.
 *   CONFIG_NETFILTER_XT_MATCH_RECENT:    is not set when it should be.
 *   CONFIG_NETFILTER_XT_MATCH_ADDRTYPE:    is not set when it should be.
 * Please check to make sure these options are set correctly.
 * Failure to do so may cause unexpected problems.
It installed fine, but I cannot set simple default rules. Maybe I need to recompile my kernel including the missing options?
Back to top
View user's profile Send private message
Goverp
Guru
Guru


Joined: 07 Mar 2007
Posts: 325

PostPosted: Sat May 12, 2012 5:48 am    Post subject: Reply with quote

gentian wrote:
I tried installing ufw and I got:
Code:
 *   CONFIG_NETFILTER_XT_MATCH_COMMENT:    is not set when it should be.
 *   CONFIG_IP6_NF_MATCH_HL:    is not set when it should be.
 *   CONFIG_NETFILTER_XT_MATCH_LIMIT:    is not set when it should be.
 *   CONFIG_NETFILTER_XT_MATCH_MULTIPORT:    is not set when it should be.
 *   CONFIG_NETFILTER_XT_MATCH_RECENT:    is not set when it should be.
 *   CONFIG_NETFILTER_XT_MATCH_ADDRTYPE:    is not set when it should be.
 * Please check to make sure these options are set correctly.
 * Failure to do so may cause unexpected problems.
It installed fine, but I cannot set simple default rules. Maybe I need to recompile my kernel including the missing options?
Yes, to use UFW you need to configure the appropriate kernel options. I installed it some time back, and then it stopped working - turned out I'd missed similar warning messages when an upgrade of UFW required new options in the later version of the kernel I was by then running.

I don't know what those setting actually mean, and whether you could build a decent firewall without them (not using UFW). That's either a strength or a drawback of using a package - it may be making a good decision on your behalf, or it may just be bloating the kernel for a few irrelevant edge cases. I've better things to do than read the code to find out ;-) so I just did as UFW asked.

Whether or not those settings are the actual cause of UFW not working for you is a different question. Try changing the kernel. If that doesn't cure the problem, what are the symptoms of its failure?
_________________
Greybeard
Back to top
View user's profile Send private message
gentian
Tux's lil' helper
Tux's lil' helper


Joined: 26 Mar 2012
Posts: 113

PostPosted: Sat May 12, 2012 10:56 am    Post subject: Reply with quote

Goverp wrote:
gentian wrote:
I tried installing ufw and I got:
Code:
 *   CONFIG_NETFILTER_XT_MATCH_COMMENT:    is not set when it should be.
 *   CONFIG_IP6_NF_MATCH_HL:    is not set when it should be.
 *   CONFIG_NETFILTER_XT_MATCH_LIMIT:    is not set when it should be.
 *   CONFIG_NETFILTER_XT_MATCH_MULTIPORT:    is not set when it should be.
 *   CONFIG_NETFILTER_XT_MATCH_RECENT:    is not set when it should be.
 *   CONFIG_NETFILTER_XT_MATCH_ADDRTYPE:    is not set when it should be.
 * Please check to make sure these options are set correctly.
 * Failure to do so may cause unexpected problems.
It installed fine, but I cannot set simple default rules. Maybe I need to recompile my kernel including the missing options?
Yes, to use UFW you need to configure the appropriate kernel options. I installed it some time back, and then it stopped working - turned out I'd missed similar warning messages when an upgrade of UFW required new options in the later version of the kernel I was by then running.

I don't know what those setting actually mean, and whether you could build a decent firewall without them (not using UFW). That's either a strength or a drawback of using a package - it may be making a good decision on your behalf, or it may just be bloating the kernel for a few irrelevant edge cases. I've better things to do than read the code to find out ;-) so I just did as UFW asked.

Whether or not those settings are the actual cause of UFW not working for you is a different question. Try changing the kernel. If that doesn't cure the problem, what are the symptoms of its failure?
I just need to setup a really simple - basic firewall setup. I am not sure how can this be easily acomplished using IPTABLES. I basically need to achieve the ufw rules of denying incoming connections, except from ssh and allow all outcoming.
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 31373
Location: 56N 3W

PostPosted: Sat May 12, 2012 11:28 am    Post subject: Reply with quote

gentian,

I like shorewall. There is no need to wrestle with raw iptables and it saves some of the learning.
That are other tools like it too.

Maybe I'm nore paranoid than many as nothing is allowed in or out of my network without a rule to permit it.
This keeps nasty things out and stops them phoning home if they do get in.

Security is like layers of an onion. The idea is not to make it absolutly impossible to break in, just difficult enough so casual attackers will give up and move on.
You set the bar where you like.

One of the biggest threats today is a combination of nasty websites and social engineering. You firewall cannot protect you against them.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
gentian
Tux's lil' helper
Tux's lil' helper


Joined: 26 Mar 2012
Posts: 113

PostPosted: Sat May 12, 2012 11:37 am    Post subject: Reply with quote

NeddySeagoon wrote:
gentian,

I like shorewall. There is no need to wrestle with raw iptables and it saves some of the learning.
That are other tools like it too.

Maybe I'm nore paranoid than many as nothing is allowed in or out of my network without a rule to permit it.
This keeps nasty things out and stops them phoning home if they do get in.

Security is like layers of an onion. The idea is not to make it absolutly impossible to break in, just difficult enough so casual attackers will give up and move on.
You set the bar where you like.

One of the biggest threats today is a combination of nasty websites and social engineering. You firewall cannot protect you against them.
From a first look on the howto, it looks more complicated and defeats the purpose of what I want to accomplish, which is a really simple firewall that blocks all input connections, even ssh for now and allows outcoming connections, coming from my box. Same mentality as the ufw default rules apply. Then the next step, would be to "play" on my vm with some more IPTABLES rules and see what are my main objectives/connections and how I interact with the net on a daily basis and then adjust the rules to my needs.
Back to top
View user's profile Send private message
logical_guy
Apprentice
Apprentice


Joined: 18 Sep 2007
Posts: 241

PostPosted: Wed Jul 11, 2012 4:09 pm    Post subject: Reply with quote

I think you need to take a look at this page http://en.gentoo-wiki.com/wiki/Iptables. It takes only a couple of minutes to set up using iptables.
Back to top
View user's profile Send private message
khayyam
Veteran
Veteran


Joined: 07 Jun 2012
Posts: 1564

PostPosted: Wed Jul 11, 2012 5:19 pm    Post subject: Reply with quote

gentian et al ...

In my opinion Oskar Andreasson's iptables tutorial is the best resource there is on the subject. It is through and detailed but doesn't make too many assumptions about the user. The resources provided in the the netfilter documentation section are directed at more advanced users but none-the-less there is some useful examples there.

As for a "basic" script, well, this depends on what the starting point is ... some people consider it basic to do both ingress and egress filtering, with a default policy of DROP on INPUT, OUTPUT and FORWARD, if you don't need to allow much traffic such rulesets can be fairly staightforward. Then there are scripts that have DROP but ACCEPT on OUTPUT with --state ESTABLISHED,RELATED on INPUT. Different focuses but neither are particularly complex.

Anyhow ... I think your looking for something like the following:

Code:
# clear current ruleset
iptables -F
iptables -X
iptables -Z

# set the default policy
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# allow traffic on the loopback interface
iptables -A INPUT -i lo -j ACCEPT

# accept incomming traffic based on established connections
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# allow connections to port 22
iptables -A INPUT -p tcp -i eth0 --dport 22 -m state --state NEW -j ACCEPT

# allow icmp (if you want hosts to be able to ping)
iptables -A INPUT -p icmp -j ACCEPT

# drop broadcast/mulitcast packets (these will only fill the log file)
iptables -A INPUT -d 255.255.255.255/0.0.0.255 -j DROP
iptables -A INPUT -d 224.0.0.1 -j DROP

# log everything else
iptables -A INPUT -j LOG

... comment the rule for port 22 to disallow incoming ssh connections.

HTH & best ...

khay
Back to top
View user's profile Send private message
Fitzcarraldo
Guru
Guru


Joined: 30 Aug 2008
Posts: 466
Location: United Kingdom

PostPosted: Wed Mar 20, 2013 12:02 pm    Post subject: Reply with quote

I came across the following HowTo on IPTABLES on the Web a few weeks ago, and thought it would be worth posting the link, as it looks quite helpful: IPTABLES - A Beginner's Tutorial.
_________________
Fitzcarraldo's blog


Last edited by Fitzcarraldo on Tue Mar 26, 2013 2:49 pm; edited 2 times in total
Back to top
View user's profile Send private message
nix213
n00b
n00b


Joined: 08 Feb 2013
Posts: 23
Location: Illinois

PostPosted: Wed Mar 20, 2013 1:33 pm    Post subject: Reply with quote

It looks like a great link; thanks for sharing!
building your own firewall can be a great learning experience
_________________
"Wherever you go, go with all your heart." -Confucius
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum