Firewall met ip_tables, internet doet niet meer.

[Verwijderd]

wat doe ik hier nou fout, als ik mijn Firewall aanzet kan ik niet meer internetten door mijn proxy.
Ik kan ook niet pingen naar buiten met mijn Firewall/proxy p.c.

Wie weet een oplossing.
Dit is mijn firewall script.


#!/bin/bash
#Simple Firewall script door Snake Eye

IPTABLES="/sbin/iptables"

MASQ="yes"
SSH_SERVER="yes"
LOG="yes"
HTTP_SERVER="yes"
FTP_SERVER="no"
NAME_SERVER="no"
TELNET_SERVER="no"
SMTP_SERVER="no"

IPADDR="xx.xx.xx.xx"
LAN="192.168.0.0/24"
ANYWHERE="0.0.0.0/0"
LOOPBACK="127.0.0.1"
CLASS_A="10.0.0.0/8"
CLASS_B="172.16.0.0/12"
CLASS_C="192.168.0.0/24"

PRIVPORTS="0:1023"
UNPRIVPORTS="1024:65535"

$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT

#Enable ip_forwarding
echo "1" >/proc/sys/net/ipv4/ip_forward

#Enable TCP sync cookie security
echo "1" >/proc/sys/net/ipv4/tcp_syncookies

#Enable ICMP broadcasting protection
echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

#Enable ICMP dead error message protection
echo "1" >/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

#Enable dynamic TCP/IP address hacking
echo "1" >/proc/sys/net/ipv4/ip_dynaddr

#Enable IP_Spoofing security
echo "1" >/proc/sys/net/ipv4/conf/all/rp_filter
echo "1" >/proc/sys/net/ipv4/conf/default/rp_filter
echo "1" >/proc/sys/net/ipv4/conf/eth0/rp_filter
echo "1" >/proc/sys/net/ipv4/conf/eth1/rp_filter
echo "1" >/proc/sys/net/ipv4/conf/lo/rp_filter

#Disable ICMP redirect acceptation
echo "0" >/proc/sys/net/ipv4/conf/all/accept_redirects
echo "0" >/proc/sys/net/ipv4/conf/eth0/accept_redirects
echo "0" >/proc/sys/net/ipv4/conf/eth1/accept_redirects
echo "0" >/proc/sys/net/ipv4/conf/default/accept_redirects
echo "0" >/proc/sys/net/ipv4/conf/lo/accept_redirects

#Disable ICMP send_redirects
echo "0" >/proc/sys/net/ipv4/conf/all/send_redirects
echo "0" >/proc/sys/net/ipv4/conf/eth0/send_redirects
echo "0" >/proc/sys/net/ipv4/conf/eth1/send_redirects
echo "0" >/proc/sys/net/ipv4/conf/default/send_redirects
echo "0" >/proc/sys/net/ipv4/conf/lo/send_redirects

#Disable accept source routed pakkets
echo "0" >/proc/sys/net/ipv4/conf/all/accept_source_route
echo "0" >/proc/sys/net/ipv4/conf/eth0/accept_source_route
echo "0" >/proc/sys/net/ipv4/conf/eth1/accept_source_route
echo "0" >/proc/sys/net/ipv4/conf/default/accept_source_route
echo "0" >/proc/sys/net/ipv4/conf/lo/accept_source_route

#Log spoofed,source,redirected pakkets
echo "0" >/proc/sys/net/ipv4/conf/all/log_martians
echo "0" >/proc/sys/net/ipv4/conf/eth0/log_martians
echo "0" >/proc/sys/net/ipv4/conf/eth1/log_martians
echo "0" >/proc/sys/net/ipv4/conf/default/log_martians
echo "0" >/proc/sys/net/ipv4/conf/lo/log_martians

#All access loopback interface;
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT

#All access Internal Network;
$IPTABLES -A INPUT -i eth1 -j ACCEPT
$IPTABLES -A OUTPUT -o eth1 -j ACCEPT

# Block and log all fragmented pakkets;
$IPTABLES -A INPUT -i eth0 -f -j LOG --log-prefix "FRAGMENT!"
$IPTABLES -A INPUT -i eth0 -f -j DROP

# Block all internal NIC traffic on external NIC;
$IPTABLES -A INPUT -i eth0 -s $LOOPBACK -j LOG --log-prefix "SPOOFING!"
$IPTABLES -A INPUT -i eth0 -s $CLASS_A -j LOG --log-prefix "CLASS A ADDRESS!"
$IPTABLES -A INPUT -i eth0 -s $CLASS_B -j LOG --log-prefix "CLASS B ADDRESS!"
$IPTABLES -A INPUT -i eth0 -s $CLASS_C -j LOG --log-prefix "CLASS C ADDRESS!"
$IPTABLES -A INPUT -i eth0 -s $LOOPBACK -j DROP
$IPTABLES -A INPUT -i eth0 -s $CLASS_A -j DROP
$IPTABLES -A INPUT -i eth0 -s $CLASS_B -j DROP
$IPTABLES -A INPUT -i eth0 -s $CLASS_C -j DROP

# masquerade
## Alles met afkomst van of bestemming lokale netwerk heeft forwarden

if [ $MASQ=yes ] ; then
$IPTABLES -A POSTROUTING -t nat -o eth0 -j MASQUERADE
$IPTABLES -A FORWARD -i eth1 -o eth0 -s $LAN -d $LAN -j ACCEPT
$IPTABLES -A FORWARD -o eth1 -i eth0 -d $LAN -s ! $LAN -j ACCEPT
fi

#accepteer bepaalde ICMP pakketten
# Een aantal typen ICMP pakketten accepteren

$IPTABLES -A INPUT -i eth0 -p icmp \
--icmp-type 0 -s $ANYWHERE -d $IPADDR \
-m limit --limit 2/s -j ACCEPT

$IPTABLES -A INPUT -i eth0 -p icmp \
--icmp-type 3 -s $ANYWHERE -d $IPADDR \
-m limit --limit 2/s -j ACCEPT

$IPTABLES -A INPUT -i eth0 -p icmp \
--icmp-type 5 -s $ANYWHERE -d $IPADDR \
-m limit --limit 2/s -j ACCEPT

$IPTABLES -A INPUT -i eth0 -p icmp \
--icmp-type 8 -s $ANYWHERE -d $IPADDR \
-m limit --limit 2/s -j ACCEPT

$IPTABLES -A INPUT -i eth0 -p icmp \
--icmp-type 11 -s $ANYWHERE -d $IPADDR \
-m limit --limit 10/s -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p icmp \
--icmp-type 3 -s $IPADDR -d $ANYWHERE \
-m limit --limit 2/s -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p icmp \
--icmp-type 8 -s $IPADDR -d $ANYWHERE \
-m limit --limit 2/s -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p icmp \
--icmp-type 0 -s $IPADDR -d $ANYWHERE \
-m limit --limit 2/s -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p icmp \
--icmp-type 11 -s $IPADDR -d $ANYWHERE \
-m limit --limit 10/s -j ACCEPT

# TCP connecties gestart vanuit lokale netwerk accepteren
## accepteer TCP connecties vlgs SYS, ACK+SYN, ACK principe

$IPTABLES -A OUTPUT -o eth0 -p tcp \
-m state --state ESTABLISHED,RELATED \
-s $IPADDR -d $ANYWHERE -j ACCEPT

$IPTABLES -A INPUT -i eth0 -p tcp \
-m state --state ESTABLISHED,RELATED \
-s $ANYWHERE -d $IPADDR -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p tcp \
--tcp-flags ACK,SYN SYN \
-s $IPADDR -d $ANYWHERE -j ACCEPT

## auth aanvragen accepteren (voorkomt timeouts)

#$IPTABLES -A INPUT -i eth0 -p tcp \
#-s $ANYWHERE -d $IPADDR \
#--source-port $UNPRIVPORTS --destination-port 113 -j ACCEPT

# UDP
## dns aanvragen vanuit lokale netwerk toestaan

$IPTABLES -A INPUT -i eth0 -p udp \
-s $ANYWHERE -d $IPADDR \
--source-port 53 --destination-port $UNPRIVPORTS -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p udp \
-s $IPADDR -d $ANYWHERE \
--source-port $UNPRIVPORTS --destination-port 53 -j ACCEPT

## traceroute toestaan

#$IPTABLES -A INPUT -i eth0 -p udp \
-s $ANYWHERE -d $IPADDR \
--source-port 32769:65535 --destination-port 33434:33523 -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p udp \
-s $IPADDR -d $ANYWHERE \
--source-port 32769:65535 --destination-port 33434:33523 -j ACCEPT

## time toestaan

$IPTABLES -A INPUT -i eth0 -p udp \
-s $ANYWHERE -d $IPADDR \
--source-port 37 --destination-port $UNPRIVPORTS -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p udp \
-s $IPADDR -d $ANYWHERE \
--source-port $UNPRIVPORTS --destination-port 37 -j ACCEPT

# andere UDP poorten hier toevoegen

# zelf servers draaien
## http server openstellen voor buitenwereld

if [ $HTTP_SERVER=yes ] ; then
$IPTABLES -A INPUT -i eth0 -p tcp \
-s $ANYWHERE -d $IPADDR \
--source-port $UNPRIVPORTS --destination-port 80 -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p tcp \
-s $IPADDR -d $ANYWHERE \
--source-port 80 --destination-port $UNPRIVPORTS -j ACCEPT
fi

## nameserver openstellen voor buitenwereld
#if [ $NAME_SERVER = yes ] ; then
#$IPTABLES -A INPUT -i eth0 -p tcp \
#-s $ANYWHERE -d $IPADDR \
#--source-port $UNPRIVPORTS --destination-port 53 -j ACCEPT

#$IPTABLES -A OUTPUT -o eth0 -p tcp \
#-s $IPADDR -d $ANYWHERE \
#--source-port 53 --destination-port $UNPRIVPORTS -j ACCEPT
#fi

## ssh server openstellen voor buitenwereld
if [ $SSH_SERVER=yes ] ; then
$IPTABLES -A INPUT -i eth1 -p tcp \
-s $ANYWHERE -d $IPADDR \
--source-port 1020:1023 --destination-port 22 -j ACCEPT

$IPTABLES -A OUTPUT -o eth1 -p tcp \
-s $IPADDR -d $ANYWHERE \
--source-port 22 --destination-port 1020:1023 -j ACCEPT
fi

## telnet server openstellen voor buitenwereld
#if [ $TELNET_SERVER = yes ] ; then
#$IPTABLES -A INPUT -i eth0 -p tcp \
#-s $ANYWHERE -d $IPADDR \
#--source-port $UNPRIVPORTS --destination-port 25 -j ACCEPT

#$IPTABLES -A OUTPUT -o eth0 -p tcp \
#-s $IPADDR -d $ANYWHERE \
#--source-port 25 --destination-port $UNPRIVPORTS -j ACCEPT
#fi

## smtp server openstellen voor buitenwereld
#if [ $SMTP_SERVER = yes ] ; then
#$IPTABLES -A INPUT -i eth0 -p tcp \
#-s $ANYWHERE -d $IPADDR \
#--source-port $UNPRIVPORTS --destination-port 25 -j ACCEPT

#$IPTABLES -A OUTPUT -o eth0 -p tcp \
#-s $IPADDR -d $ANYWHERE \
#--source-port 25 --destination-port $UNPRIVPORTS -j ACCEPT
#fi

## ftp server openstellen voor buitenwereld
if [ $FTP_SERVER = yes ] ; then
$IPTABLES -A INPUT -i eth0 -p tcp \
-s $ANYWHERE -d $IPADDR -m state --state NEW,ESTABLISHED \
--source-port $UNPRIVPORTS --destination-port 21 -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p tcp \
-s $IPADDR -d $ANYWHERE -m state --state ESTABLISHED,RELATED \
--source-port 21 --destination-port $UNPRIVPORTS -j ACCEPT

# ftp server - active
$IPTABLES -A INPUT -i eth0 -p tcp \
-s $ANYWHERE -d $IPADDR -m state --state ESTABLISHED,RELATED ! --syn \
--destination-port 20 -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p tcp \
-s $IPADDR -d $ANYWHERE -m state --state ESTABLISHED,RELATED \
--source-port 20 -j ACCEPT

# ftp server - passive
$IPTABLES -A INPUT -i eth0 -p tcp \
-s $ANYWHERE -d $IPADDR -m state --state ESTABLISHED,RELATED \
--destination-port $UNPRIVPORTS -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p tcp \
-s $IPADDR -d $ANYWHERE -m state --state ESTABLISHED,RELATED \
--source-port $UNPRIVPORTS -j ACCEPT
fi

# trash opvangen
# alles dat nu nog wordt opgevangen loggen
if [ $LOG = yes ] ; then
$IPTABLES -A INPUT -j LOG --log-prefix "filtered on INPUT "
$IPTABLES -A OUTPUT -j LOG --log-prefix "filtered on OUTPUT "
$IPTABLES -A FORWARD -j LOG --log-prefix "filtered on FORWARD "
fi

[Koffie]

move [forum=24] > NOS

[Verwijderd]

move [forum=23] -> Slotske

Dubbel met [topic=439420]

snakeeye gelieve in het vervolg niet meer te crossposten a.u.b.