Wat is er mis met deze firewall ?!

[Verwijderd]

Ik ben nogal een linux-newbie, en heb met deze site *geprobeerd* een rc.firewall file te maken...
http://www.linux-firewall-tools.com/linux/firewall/index.html

en dat leverde mij dit op:

code:

#!/bin/sh

# Script generated Mon Aug 13 06:26:07 2001


# ----------------------------------------------------------------------------
# Copyright (C) 1997, 1998, 1999, 2000  Robert L. Ziegler
#
#  Permission to use, copy, modify, and distribute this software and its
#  documentation for educational, research, private and non-profit purposes,
#  without fee, and without a written agreement is hereby granted. 
#  This software is provided as an example and basis for individual firewall
#  development.  This software is provided without warranty.
#
#  Any material furnished by Robert L. Ziegler is furnished on an 
#  "as is" basis.  He makes no warranties of any kind, either expressed 
#  or implied as to any matter including, but not limited to, warranty 
#  of fitness for a particular purpose, exclusivity or results obtained
#  from use of the material.
# ----------------------------------------------------------------------------

#  /etc/rc.d/rc.firewall
#  Invoked from /etc/sysconfig/network-scripts/pump-done, or
#  from /etc/dhcpc/dhcpcd-eth0.exe, or
#  from /etc/sysconfig/network-scripts/ifdhcpc-done.

echo "Starting firewalling... "

# ----------------------------------------------------------------------------
#  Some definitions for easy maintenance.
#  EDIT THESE TO SUIT YOUR SYSTEM AND ISP.

EXTERNAL_INTERFACE="eth0"       # Internet connected interface
LOOPBACK_INTERFACE="lo"         # or your local naming convention
LOCAL_INTERFACE_1="eth1"        # internal LAN interface

IPADDR="my.ip.address"          # your IP address
LOCALNET_1="192.168.1.0/24"     # whatever private range you use

ANYWHERE="0/0"          # match any IP address

DHCP_SERVER="0/0"
NAMESERVER_1="0/0"          # everyone must have at least one

SMTP_SERVER="out.pandora.be"            # Your ISP mail gateway. Your relay.
POP_SERVER="in.pandora.be"      # Your ISP pop mail server.
NEWS_SERVER="news.pandora.be"       # Your ISP news server
WEB_PROXY_SERVER="proxy.pandora.be"     # Your ISP web proxy server

LOOPBACK="127.0.0.0/8"          # reserved loopback address range
CLASS_A="10.0.0.0/8"            # class A private networks
CLASS_B="172.16.0.0/12"         # class B private networks
CLASS_C="192.168.0.0/16"        # class C private networks
CLASS_D_MULTICAST="224.0.0.0/4"     # class D multicast addresses
CLASS_E_RESERVED_NET="240.0.0.0/5"  # class E reserved addresses
BROADCAST_SRC="0.0.0.0"         # broadcast source address
BROADCAST_DEST="255.255.255.255"    # broadcast destination address
PRIVPORTS="0-1023"          # well known, privileged port range
UNPRIVPORTS="1024-65535"        # unprivileged port range

# ----------------------------------------------------------------------------

# nameservers are originally from /etc/dhcpc/resolv.conf.
# The example ifdhcpc-done script updates these automatically and
# appends them to /etc/dhcpc/hostinfo-$EXTERNAL_INTERFACE or
# /etc/dhcpc/dhcpcd-$EXTERNAL_INTERFACE.info.

#  The IP address, $IPADDR, is defined by dhcpc

if [ -f /etc/dhcpc/hostinfo-$EXTERNAL_INTERFACE ]; then
    . /etc/dhcpc/hostinfo-$EXTERNAL_INTERFACE
elif [ -f /etc/dhcpc/dhcpcd-$EXTERNAL_INTERFACE.info ]; then
    . /etc/dhcpc/dhcpcd-$EXTERNAL_INTERFACE.info
elif [ -f /etc/dhcpc/pump.info ]; then
    . /etc/dhcpc/pump.info
else
    echo "rc.firewall:  dhcp is not configured."
    iptables -F
    iptables -P INPUT  DROP
    iptables -P OUTPUT DROP
    iptables -P FORWARD DROP

    iptables -A INPUT  -i $LOOPBACK_INTERFACE -j ACCEPT
    iptables -A OUTPUT -o $LOOPBACK_INTERFACE -j ACCEPT
    iptables -A INPUT  -i $LOCAL_INTERFACE_1 -j ACCEPT
    iptables -A OUTPUT -o $LOCAL_INTERFACE_1 -j ACCEPT
    exit 1
fi

# If using the example ifdhcpc-done script, the above NAMESERVER
# definitions will be overridden correctly here.

DHCP_SERVER=$DHCPSIADDR

# ----------------------------------------------------------------------------

NFS_PORT="2049"             # (TCP/UDP) NFS
SOCKS_PORT="1080"           # (TCP) Socks

# X Windows port allocation begins at 6000 and increments to 6063
# for each additional server running.
XWINDOW_PORTS="6000-6063"       # (TCP) X windows

# traceroute usually uses -S 32769:65535 -D 33434:33523
TRACEROUTE_SRC_PORTS="32769-65535"
TRACEROUTE_DEST_PORTS="33434-33523"

# ----------------------------------------------------------------------------
# Default policy is DENY
# Explicitly accept desired INCOMING & OUTGOING connections

    # Remove all existing rules belonging to this filter
    iptables -F

    iptables -F -t nat

    # Remove any existing user-defined chains.
    iptables -X

    # Set the default policy of the filter to deny.
    iptables -P INPUT  DROP
    iptables -P OUTPUT REJECT
    iptables -P FORWARD DROP

# ----------------------------------------------------------------------------

    # Enable IP Forwarding, if it isn't already
    echo 1 > /proc/sys/net/ipv4/ip_forward

    # Enable TCP SYN Cookie Protection
    echo 1 > /proc/sys/net/ipv4/tcp_syncookies

    # Enable always defragging Protection
    echo 1 > /proc/sys/net/ipv4/ip_always_defrag

    # Enable broadcast echo  Protection
    echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

    # Enable bad error message  Protection
    echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

    # Enable IP spoofing protection
    # turn on Source Address Verification
    for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
      echo 1 > $f
    done

    # Disable ICMP Redirect Acceptance
    for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
      echo 0 > $f
    done

    for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
      echo 0 > $f
    done

    # Disable Source Routed Packets
    for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
      echo 0 > $f
    done

    # Log Spoofed Packets, Source Routed Packets, Redirect Packets
    for f in /proc/sys/net/ipv4/conf/*/log_martians; do
      echo 1 > $f
    done


    # These modules are necessary to masquerade their respective services.
    /sbin/insmod ip_nat_ftp
    /sbin/insmod ip_conntrack_ftp

# ----------------------------------------------------------------------------
# LOOPBACK

    # Unlimited traffic on the loopback interface.

    iptables -A INPUT  -i $LOOPBACK_INTERFACE  -j ACCEPT
    iptables -A OUTPUT -o $LOOPBACK_INTERFACE  -j ACCEPT

# ----------------------------------------------------------------------------
# Unlimited traffic within the local network.

    # All internal machines have access to the fireall machine.

    iptables -A INPUT  -i $LOCAL_INTERFACE_1 -s $LOCALNET_1 -j ACCEPT
    iptables -A OUTPUT -o $LOCAL_INTERFACE_1 -d $LOCALNET_1 -j ACCEPT

# ----------------------------------------------------------------------------
# Masquerade internal traffic.

    # All internal traffic is masqueraded externally.
    # WARNING:
    #     The iptables functionality is under development.
    #     No filters are applied.  Just masquerading.

    iptables -A POSTROUTING -t nat -o $EXTERNAL_INTERFACE -j MASQUERADE

# ----------------------------------------------------------------------------
# Network Ghouls

    # Deny access to jerks
    # --------------------
    # /etc/rc.d/rc.firewall.blocked contains a list of
    # iptables -A INPUT -i $EXTERNAL_INTERFACE -s address -j DROP
    # rules to block from any access.

    # Refuse any connection from problem sites
    if [ -f /etc/rc.d/rc.firewall.blocked ]; then
      . /etc/rc.d/rc.firewall.blocked
    fi

# ----------------------------------------------------------------------------
# SPOOFING & BAD ADDRESSES
# Refuse spoofed packets.
# Ignore blatantly illegal source addresses.
# Protect yourself from sending to bad addresses.

    # Refuse incoming packets pretending to be from the external address.
    iptables -A INPUT   -s $IPADDR -j DROP

    # Refuse incoming packets claiming to be from a Class A, B or C private network
    iptables -A INPUT   -s $CLASS_A -j DROP
    iptables -A INPUT   -s $CLASS_B -j DROP
    iptables -A INPUT   -s $CLASS_C -j DROP

    # Refuse broadcast address SOURCE packets
    iptables -A INPUT   -s $BROADCAST_DEST -j DROP
    iptables -A INPUT   -d $BROADCAST_SRC -j DROP

    # Refuse Class D multicast addresses
    # Multicast is illegal as a source address.
    # Multicast uses UDP.
    iptables -A INPUT   -s $CLASS_D_MULTICAST -j DROP

    # Refuse Class E reserved IP  addresses
    iptables -A INPUT   -s $CLASS_E_RESERVED_NET -j DROP

    # Refuse special addresses defined as reserved by the IANA.
    # Note:  The remaining reserved addresses are not included.
    # Filtering them causes problems as reserved blocks are
    # being allocated more often now.

    # Note:  this list includes the loopback, multicast, & reserved addresses.

    # 0.*.*.*       - Can't be blocked for DHCP users.
    # 127.*.*.*     - LoopBack
    # 169.254.*.*   - Link Local Networks
    # 192.0.2.*     - TEST-NET
    # 224-255.*.*.* - Classes D & E, plus unallocated.

    iptables -A INPUT   -s 127.0.0.0/8 -j DROP
    iptables -A INPUT   -s 169.254.0.0/16 -j DROP
    iptables -A INPUT   -s 192.0.2.0/24 -j DROP
    iptables -A INPUT   -s 224.0.0.0/3 -j DROP

# ----------------------------------------------------------------------------
# NOTE:
#   The symbolic names used in /etc/services for the port numbers vary by
#   supplier.  Using them is less error prone and more meaningful, though.

# ----------------------------------------------------------------------------
# TCP UNPRIVILEGED PORTS
# Avoid ports subject to protocol & system administration problems.

    # NFS: establishing a TCP connection
    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp --syn \
         --destination-port $NFS_PORT -j DROP
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp --syn \
         --destination-port $NFS_PORT -j REJECT

    # Xwindows: establishing a connection
    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp --syn \
         --destination-port $XWINDOW_PORTS -j DROP
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp --syn \
         --destination-port $XWINDOW_PORTS -j REJECT

    # SOCKS: establishing a connection
    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp --syn \
         --destination-port $SOCKS_PORT -j DROP
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp --syn \
         --destination-port $SOCKS_PORT -j REJECT

# ----------------------------------------------------------------------------
# UDP UNPRIVILEGED PORTS
# Avoid ports subject to protocol & system administration problems.

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         --destination-port $NFS_PORT -j DROP

    # DNS client (53)
    # ---------------
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         -d $NAMESERVER_1 --destination-port 53 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         -s $NAMESERVER_1 --source-port 53 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT


    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         -d $NAMESERVER_1 --destination-port 53 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         -s $NAMESERVER_1 --source-port 53 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    # ------------------------------------------------------------------

    # HTTP client (80)
    # ----------------
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 80 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 80 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    # ------------------------------------------------------------------

    # HTTPS client (443)
    # ------------------
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 443 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 443 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    # ------------------------------------------------------------------

    # WWW-CACHE client
    # ----------------
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         -d $WEB_PROXY_SERVER --destination-port 8080 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         -s $WEB_PROXY_SERVER --source-port 8080 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    # ------------------------------------------------------------------

    # NNTP NEWS client (119)
    # ----------------------
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         -d $NEWS_SERVER --destination-port 119 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         -s $NEWS_SERVER --source-port 119 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    # ------------------------------------------------------------------

    # POP client (110)
    # ----------------
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         -d $POP_SERVER --destination-port 110 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         -s $POP_SERVER --source-port 110 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    # ------------------------------------------------------------------

    # SMTP client (25)
    # ----------------
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         -d $SMTP_SERVER --destination-port 25 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         -s $SMTP_SERVER --source-port 25 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    # ------------------------------------------------------------------

    # AUTH server (113)
    # -----------------

    # Reject, rather than deny, the incoming auth port. (NET-3-HOWTO)
    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp  \
         --source-port $UNPRIVPORTS \
         -d $IPADDR --destination-port 113 -j REJECT


    # AUTH client (113)
    # -----------------
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 113 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 113 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    # ------------------------------------------------------------------

    # WHOIS client (43)
    # -----------------
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 43 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 43 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    # ------------------------------------------------------------------

    # FINGER client (79)
    # ------------------
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 79 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 79 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    # ------------------------------------------------------------------

    # FTP client (21)
    # ---------------

    # outgoing request
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 21 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 21 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT


    # PORT mode data channel
    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp  \
         --source-port 20 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp ! --syn \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 20 -j ACCEPT

    # ------------------------------------------------------------------

    # IRC client (6667)
    # -----------------
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 6667 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 6667 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp  \
         --source-port $UNPRIVPORTS \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    # ------------------------------------------------------------------

    # RealAudio / QuickTime client
    # ----------------------------
    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 554 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 554 -j ACCEPT

    # TCP is a more secure method:  7070:7071

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 7070:7071 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 7070:7071 -j ACCEPT

    # UDP is the preferred method:  6970:6999
    # For LAN machines, UDP requires the RealAudio masquerading module and
    # the ipmasqadm third-party software.

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         --source-port $UNPRIVPORTS \
         -d $IPADDR --destination-port 6970:6999 -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp  \
         -s $IPADDR --source-port 6970:6999 \
         --destination-port $UNPRIVPORTS -j ACCEPT

    # ------------------------------------------------------------------

    # ICQ client (4000)
    # -----------------
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 2000:4000 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 2000:4000 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 4000 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         --source-port 4000 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

# ----------------------------------------------------------------------------
# UDP accept only on selected ports
# ---------------------------------


    # DHCP client (67, 68)
    # --------------------

    # allow dhcp server (67) to connect to dhcp client (68)
    # Note: the DHCP server is the only externel source of broadcast
    #    messages we should see, ever.

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         -s $DHCP_SERVER --source-port 67 \
         -d $IPADDR --destination-port 68 -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp  \
         -s $IPADDR --source-port 68 \
         -d $DHCP_SERVER --destination-port 67 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         -s $DHCP_SERVER --source-port 67 \
         -d $BROADCAST_DEST --destination-port 68 -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp  \
         -s $BROADCAST_SRC --source-port 68 \
         -d $DHCP_SERVER --destination-port 67 -j ACCEPT

    # Getting renumbered
    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         -s $BROADCAST_SRC --source-port 67 \
         -d $BROADCAST_DEST --destination-port 68 -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp  \
         -s $BROADCAST_SRC --source-port 68 \
         -d $BROADCAST_DEST --destination-port 67 -j ACCEPT

    # As a result of the above, we're supposed to change our IP address with
    # this message, which is addressed to our new address before the dhcp
    # client has received the update.

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         -s $DHCP_SERVER --source-port 67 \
         --destination-port 68 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         --source-port 67 \
         -d $IPADDR --destination-port 68 -j DROP

    # ------------------------------------------------------------------

    # OUTGOING TRACEROUTE
    # -------------------
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp  \
         -s $IPADDR --source-port $TRACEROUTE_SRC_PORTS \
         --destination-port $TRACEROUTE_DEST_PORTS -j ACCEPT

# ----------------------------------------------------------------------------
# ICMP

    #    To prevent denial of service attacks based on ICMP bombs, filter
    #    incoming Redirect (5) and outgoing Destination Unreachable (3).
    #    Note, however, disabling Destination Unreachable (3) is not
    #    advisable, as it is used to negotiate packet fragment size.

    # For bi-directional ping.
    #     Message Types:  Echo_Reply (0),  Echo_Request (8)
    #     To prevent attacks, limit the src addresses to your ISP range.
    # 
    # For outgoing traceroute.
    #     Message Types:  INCOMING Dest_Unreachable (3), Time_Exceeded (11)
    #     default UDP base: 33434 to base+nhops-1
    # 
    # For incoming traceroute.
    #     Message Types:  OUTGOING Dest_Unreachable (3), Time_Exceeded (11)
    #     To block this, deny OUTGOING 3 and 11

    #  0: echo-reply (pong)
    #  3: destination-unreachable, port-unreachable, fragmentation-needed, etc.
    #  4: source-quench
    #  5: redirect
    #  8: echo-request (ping)
    # 11: time-exceeded
    # 12: parameter-problem

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type echo-reply \
         -d $IPADDR -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type destination-unreachable \
         -d $IPADDR -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type source-quench \
         -d $IPADDR -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type echo-request \
         -d $IPADDR -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type time-exceeded \
         -d $IPADDR -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type parameter-problem \
         -d $IPADDR -j ACCEPT


    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p icmp  \
         -s $IPADDR --icmp-type echo-reply -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p icmp  \
         -s $IPADDR --icmp-type destination-unreachable -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p icmp  \
         -s $IPADDR --icmp-type source-quench -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p icmp  \
         -s $IPADDR --icmp-type echo-request -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p icmp  \
         -s $IPADDR --icmp-type time-exceeded -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p icmp  \
         -s $IPADDR --icmp-type parameter-problem -j ACCEPT

# ----------------------------------------------------------------------------
# Enable logging for selected denied packets

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp  -j DROP

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         --destination-port $PRIVPORTS -j DROP

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         --destination-port $UNPRIVPORTS -j DROP


    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type 5 -j DROP
    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type 13:255 -j DROP

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE  -j REJECT

# ----------------------------------------------------------------------------

echo "done"

exit 0

# ----------------------------------------------------------------------------
# NOTE for DHCP users:
#  
#  The following is an example "/etc/sysconfig/network-scripts/ifdhcpc-done".
#  DHCP clients through at least version "dhcpcd-0.70-2" used the "-c"
#  mechanism to specify a program to execute whenever dhcpcd successfully 
#  received an IP address.
#  
#  As presented, the example "ifdhcpc-done" updates your host IP address in
#  /etc/hosts and updates the NAMESERVER definitions in the hostinfo file.
#  
#-------------------------------- CUT HERE ---------------------------
#!/bin/sh -x

# Get the pid of the process which is waiting for this to complete.
# If the wait file doesn't exist, either the parent timed out, or
# the dhcp server is issuing a new IP address.

SLEEPPIDFILE=/var/run/dhcp-wait-${IFNAME}.pid

if [ -f $SLEEPPIDFILE ]; then
    SLEEPPID=`cat $SLEEPPIDFILE`
    rm -f $SLEEPPIDFILE
    kill $SLEEPPID
else
    echo "DHCP is configured, but ifup may have timed out." > /dev/console
fi

#---------------------------------------------------------------------
# RedHat Versions thru 5.2 use /etc/dhcpc/hostinfo-eth0
# Future releases (RedHat development releases) use /etc/dhcpc/dhcpcd-eth0.info

if [ -f /etc/dhcpc/hostinfo-eth0 ]; then
    hostinfo="/etc/dhcpc/hostinfo-eth0"
elif [ -f /etc/dhcpc/dhcpcd-eth0.info ]; then
    hostinfo="/etc/dhcpc/dhcpcd-eth0.info"
else
    echo "DHCP is configured, but ifup may have timed out." > /dev/console
    exit 1
fi

# get the hostinfo
. $hostinfo

# Update domainname
domain=`fgrep domain /etc/dhcpc/resolv.conf | sed -e "s/domain //"`
domainname $domain

# Update /etc/hosts
# Some services will break without this, unless you use localhost (eg. pop)

sed -e "s/^.*YOU/$IPADDR      YOU.$domain   YOU/" /etc/hosts > /var/tmp/hosts
cp /var/tmp/hosts /etc/hosts
rm /var/tmp/hosts

#---------------------------------------------------------------------
# Update $hostinfo with the current nameservers from /etc/resolv.conf.
# Thanks to Roger Goun for the idea of appending these to $hostinfo and
# getting rid of the temporary file.

let cnt=1
fgrep nameserver /etc/dhcpc/resolv.conf | sed -e "s/nameserver //" |
    while read naddr
    do
    echo NAMESERVER_$cnt="$naddr" >> $hostinfo
      let cnt=$cnt+1
    done

#---------------------------------------------------------------------

cp /etc/dhcpc/resolv.conf /etc

sh /etc/rc.d/rc.firewall
echo "Firewalling enabled." > /dev/console

Ik weet het, hij is nogal uitgebreid...

Als ik hem run, geeft hij geen foutmeldingen ofzo, maar hij blokkeert de hele zooi...

Zien jullie wat er niet klopt ?

Bedankt

[charlie]

Heb je aan de variabele my.ip.address een waarde gegeven???

[Prozaq]

geen flauw idee, log eens wat er wordt geblokt zou ik zo zeggen

[charlie]

Wat is het resultaat van iptables -L -n -v?
Welke distributie draai je.
Snap je uberhaupt zelf iets van dit script?
Anders raad ik je aan om er eerst eens wat meer over te lezen, en zelf enkele eenvoudige regels te schrijven...

[Verwijderd]

...
Snap je uberhaupt zelf iets van dit script?
Anders raad ik je aan om er eerst eens wat meer over te lezen, en zelf enkele eenvoudige regels te schrijven...

Ok, dat zal ik doen....

[Martin Sturm]

Ik vind het echt een k*t werk om zelf een firewall script te maken. Maarja, het is nu eenmaal nodig.

Ik heb hem gewoon zelf gemaakt, aan de hand van how-to's en wat voorbeeldscripts.

[Verwijderd]

Ah, is me duidelijk.

[charlie]

Op maandag 13 augustus 2001 13:44 schreef msturm10 het volgende:
Ik vind het echt een k*t werk om zelf een firewall script te maken. Maarja, het is nu eenmaal nodig.

Ik heb hem gewoon zelf gemaakt, aan de hand van how-to's en wat voorbeeldscripts.

Maar je leert er wel veel mee bij, en je weet tenminste wat je script doet...
Heb het trouwens ook al meerdere keren zelf gedaan.

[Verwijderd]

Kan iemand niet zijn of haar script online posten dan heb ik iets om vanaf op te bouwen

[Martin Sturm]

Op maandag 13 augustus 2001 14:11 schreef Charlie23 het volgende:

[..]

Maar je leert er wel veel mee bij, en je weet tenminste wat je script doet...
Heb het trouwens ook al meerdere keren zelf gedaan.

Ik heb het nog maar 1x gedaan, en ik denk dat die van mij niet 100% secure is..
Maar ik was het beu. Ik vind dat echt niet cool, zelf een firewall maken

[Verwijderd]

Op maandag 13 augustus 2001 14:19 schreef Maus het volgende:
Kan iemand niet zijn of haar script online posten dan heb ik iets om vanaf op te bouwen

Ik gebruik gShield, een uitgebreide maar goed gedocumenteerde firewall. Verkrijgbaar op http://muse.linuxmafia.org/gshield.html
Succes !
<Typo>

[Verwijderd]

ik gebruik PMFirewall. Zie www.pointman.org
Het is een script die je door de installlatie meeneemt. Als je wat elementaire zaken zelf wel eens uitgeschreven of bestudeerd hebt dan moet het lukken. kosste mij ca 15 minuten, en 't werkte in 1 keer.
Een versie van IPTables is er nog niet (?)

Wat er op lijkt is http://monmotha.mplug.org/firewall/index.php
maar daar heb ik geen ervaring mee. Die is wel voor IPTables.

[Mior]

goeiedag zeg wat een lap van een firewall..

zal de snelheid niet ten goede komen.
Beste wat je kunt doen is er een zelf bouwen, eerst alles deny'en en dan expliciet aangeven wat wel en niet mag.

[jant]

Op woensdag 15 augustus 2001 00:53 schreef Phantom_ het volgende:
goeiedag zeg wat een lap van een firewall..

zal de snelheid niet ten goede komen.
Beste wat je kunt doen is er een zelf bouwen, eerst alles deny'en en dan expliciet aangeven wat wel en niet mag.

Dat is precies wat dit scriptje doet...

[Torrac]

De porten zijn niet goed er staat 1024-65335 of zo maar dit moet niet met min maar met : teken zijn.

[Questor]

Schrijf ook zelf m'n scripts, maar voor de startende IPtable'er is FERM wellicht onderstaand een uitkomst. Een soort scripttaal voor ipchains/iptables firewalls waarbij iets beter de structuur naar boven komt (te vinden op freshmeat.net + voorbeeld scripts). http://www.geo.vu.nl/~koka/ferm/