ip_tables Firewall en proxy.

[Verwijderd]

wat doe ik hier nou fout, als ik mijn Firewall aanzet kan ik niet meer internetten door mijn proxy.
Ik kan ook niet pingen naar buiten met mijn Firewall/proxy p.c.

Wie weet een oplossing.
Dit is mijn firewall script.


#!/bin/bash
#Simple Firewall script door Snake Eye

IPTABLES="/sbin/iptables"

MASQ="yes"
SSH_SERVER="yes"
LOG="yes"
HTTP_SERVER="yes"
FTP_SERVER="no"
NAME_SERVER="no"
TELNET_SERVER="no"
SMTP_SERVER="no"

IPADDR="xx.xx.xx.xx"
LAN="192.168.0.0/24"
ANYWHERE="0.0.0.0/0"
LOOPBACK="127.0.0.1"
CLASS_A="10.0.0.0/8"
CLASS_B="172.16.0.0/12"
CLASS_C="192.168.0.0/24"

PRIVPORTS="0:1023"
UNPRIVPORTS="1024:65535"

$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT

#Enable ip_forwarding
echo "1" >/proc/sys/net/ipv4/ip_forward

#Enable TCP sync cookie security
echo "1" >/proc/sys/net/ipv4/tcp_syncookies

#Enable ICMP broadcasting protection
echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

#Enable ICMP dead error message protection
echo "1" >/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

#Enable dynamic TCP/IP address hacking
echo "1" >/proc/sys/net/ipv4/ip_dynaddr

#Enable IP_Spoofing security
echo "1" >/proc/sys/net/ipv4/conf/all/rp_filter
echo "1" >/proc/sys/net/ipv4/conf/default/rp_filter
echo "1" >/proc/sys/net/ipv4/conf/eth0/rp_filter
echo "1" >/proc/sys/net/ipv4/conf/eth1/rp_filter
echo "1" >/proc/sys/net/ipv4/conf/lo/rp_filter

#Disable ICMP redirect acceptation
echo "0" >/proc/sys/net/ipv4/conf/all/accept_redirects
echo "0" >/proc/sys/net/ipv4/conf/eth0/accept_redirects
echo "0" >/proc/sys/net/ipv4/conf/eth1/accept_redirects
echo "0" >/proc/sys/net/ipv4/conf/default/accept_redirects
echo "0" >/proc/sys/net/ipv4/conf/lo/accept_redirects

#Disable ICMP send_redirects
echo "0" >/proc/sys/net/ipv4/conf/all/send_redirects
echo "0" >/proc/sys/net/ipv4/conf/eth0/send_redirects
echo "0" >/proc/sys/net/ipv4/conf/eth1/send_redirects
echo "0" >/proc/sys/net/ipv4/conf/default/send_redirects
echo "0" >/proc/sys/net/ipv4/conf/lo/send_redirects

#Disable accept source routed pakkets
echo "0" >/proc/sys/net/ipv4/conf/all/accept_source_route
echo "0" >/proc/sys/net/ipv4/conf/eth0/accept_source_route
echo "0" >/proc/sys/net/ipv4/conf/eth1/accept_source_route
echo "0" >/proc/sys/net/ipv4/conf/default/accept_source_route
echo "0" >/proc/sys/net/ipv4/conf/lo/accept_source_route

#Log spoofed,source,redirected pakkets
echo "0" >/proc/sys/net/ipv4/conf/all/log_martians
echo "0" >/proc/sys/net/ipv4/conf/eth0/log_martians
echo "0" >/proc/sys/net/ipv4/conf/eth1/log_martians
echo "0" >/proc/sys/net/ipv4/conf/default/log_martians
echo "0" >/proc/sys/net/ipv4/conf/lo/log_martians

#All access loopback interface;
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT

#All access Internal Network;
$IPTABLES -A INPUT -i eth1 -j ACCEPT
$IPTABLES -A OUTPUT -o eth1 -j ACCEPT

# Block and log all fragmented pakkets;
$IPTABLES -A INPUT -i eth0 -f -j LOG --log-prefix "FRAGMENT!"
$IPTABLES -A INPUT -i eth0 -f -j DROP

# Block all internal NIC traffic on external NIC;
$IPTABLES -A INPUT -i eth0 -s $LOOPBACK -j LOG --log-prefix "SPOOFING!"
$IPTABLES -A INPUT -i eth0 -s $CLASS_A -j LOG --log-prefix "CLASS A ADDRESS!"
$IPTABLES -A INPUT -i eth0 -s $CLASS_B -j LOG --log-prefix "CLASS B ADDRESS!"
$IPTABLES -A INPUT -i eth0 -s $CLASS_C -j LOG --log-prefix "CLASS C ADDRESS!"
$IPTABLES -A INPUT -i eth0 -s $LOOPBACK -j DROP
$IPTABLES -A INPUT -i eth0 -s $CLASS_A -j DROP
$IPTABLES -A INPUT -i eth0 -s $CLASS_B -j DROP
$IPTABLES -A INPUT -i eth0 -s $CLASS_C -j DROP

# masquerade
## Alles met afkomst van of bestemming lokale netwerk heeft forwarden

if [ $MASQ=yes ] ; then
$IPTABLES -A POSTROUTING -t nat -o eth0 -j MASQUERADE
$IPTABLES -A FORWARD -i eth1 -o eth0 -s $LAN -d $LAN -j ACCEPT
$IPTABLES -A FORWARD -o eth1 -i eth0 -d $LAN -s ! $LAN -j ACCEPT
fi

#accepteer bepaalde ICMP pakketten
# Een aantal typen ICMP pakketten accepteren

$IPTABLES -A INPUT -i eth0 -p icmp \
--icmp-type 0 -s $ANYWHERE -d $IPADDR \
-m limit --limit 2/s -j ACCEPT

$IPTABLES -A INPUT -i eth0 -p icmp \
--icmp-type 3 -s $ANYWHERE -d $IPADDR \
-m limit --limit 2/s -j ACCEPT

$IPTABLES -A INPUT -i eth0 -p icmp \
--icmp-type 5 -s $ANYWHERE -d $IPADDR \
-m limit --limit 2/s -j ACCEPT

$IPTABLES -A INPUT -i eth0 -p icmp \
--icmp-type 8 -s $ANYWHERE -d $IPADDR \
-m limit --limit 2/s -j ACCEPT

$IPTABLES -A INPUT -i eth0 -p icmp \
--icmp-type 11 -s $ANYWHERE -d $IPADDR \
-m limit --limit 10/s -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p icmp \
--icmp-type 3 -s $IPADDR -d $ANYWHERE \
-m limit --limit 2/s -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p icmp \
--icmp-type 8 -s $IPADDR -d $ANYWHERE \
-m limit --limit 2/s -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p icmp \
--icmp-type 0 -s $IPADDR -d $ANYWHERE \
-m limit --limit 2/s -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p icmp \
--icmp-type 11 -s $IPADDR -d $ANYWHERE \
-m limit --limit 10/s -j ACCEPT

# TCP connecties gestart vanuit lokale netwerk accepteren
## accepteer TCP connecties vlgs SYS, ACK+SYN, ACK principe

$IPTABLES -A OUTPUT -o eth0 -p tcp \
-m state --state ESTABLISHED,RELATED \
-s $IPADDR -d $ANYWHERE -j ACCEPT

$IPTABLES -A INPUT -i eth0 -p tcp \
-m state --state ESTABLISHED,RELATED \
-s $ANYWHERE -d $IPADDR -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p tcp \
--tcp-flags ACK,SYN SYN \
-s $IPADDR -d $ANYWHERE -j ACCEPT

## auth aanvragen accepteren (voorkomt timeouts)

#$IPTABLES -A INPUT -i eth0 -p tcp \
#-s $ANYWHERE -d $IPADDR \
#--source-port $UNPRIVPORTS --destination-port 113 -j ACCEPT

# UDP
## dns aanvragen vanuit lokale netwerk toestaan

$IPTABLES -A INPUT -i eth0 -p udp \
-s $ANYWHERE -d $IPADDR \
--source-port 53 --destination-port $UNPRIVPORTS -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p udp \
-s $IPADDR -d $ANYWHERE \
--source-port $UNPRIVPORTS --destination-port 53 -j ACCEPT

## traceroute toestaan

#$IPTABLES -A INPUT -i eth0 -p udp \
-s $ANYWHERE -d $IPADDR \
--source-port 32769:65535 --destination-port 33434:33523 -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p udp \
-s $IPADDR -d $ANYWHERE \
--source-port 32769:65535 --destination-port 33434:33523 -j ACCEPT

## time toestaan

$IPTABLES -A INPUT -i eth0 -p udp \
-s $ANYWHERE -d $IPADDR \
--source-port 37 --destination-port $UNPRIVPORTS -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p udp \
-s $IPADDR -d $ANYWHERE \
--source-port $UNPRIVPORTS --destination-port 37 -j ACCEPT

# andere UDP poorten hier toevoegen

# zelf servers draaien
## http server openstellen voor buitenwereld

if [ $HTTP_SERVER=yes ] ; then
$IPTABLES -A INPUT -i eth0 -p tcp \
-s $ANYWHERE -d $IPADDR \
--source-port $UNPRIVPORTS --destination-port 80 -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p tcp \
-s $IPADDR -d $ANYWHERE \
--source-port 80 --destination-port $UNPRIVPORTS -j ACCEPT
fi

## nameserver openstellen voor buitenwereld
#if [ $NAME_SERVER = yes ] ; then
#$IPTABLES -A INPUT -i eth0 -p tcp \
#-s $ANYWHERE -d $IPADDR \
#--source-port $UNPRIVPORTS --destination-port 53 -j ACCEPT

#$IPTABLES -A OUTPUT -o eth0 -p tcp \
#-s $IPADDR -d $ANYWHERE \
#--source-port 53 --destination-port $UNPRIVPORTS -j ACCEPT
#fi

## ssh server openstellen voor buitenwereld
if [ $SSH_SERVER=yes ] ; then
$IPTABLES -A INPUT -i eth1 -p tcp \
-s $ANYWHERE -d $IPADDR \
--source-port 1020:1023 --destination-port 22 -j ACCEPT

$IPTABLES -A OUTPUT -o eth1 -p tcp \
-s $IPADDR -d $ANYWHERE \
--source-port 22 --destination-port 1020:1023 -j ACCEPT
fi

## telnet server openstellen voor buitenwereld
#if [ $TELNET_SERVER = yes ] ; then
#$IPTABLES -A INPUT -i eth0 -p tcp \
#-s $ANYWHERE -d $IPADDR \
#--source-port $UNPRIVPORTS --destination-port 25 -j ACCEPT

#$IPTABLES -A OUTPUT -o eth0 -p tcp \
#-s $IPADDR -d $ANYWHERE \
#--source-port 25 --destination-port $UNPRIVPORTS -j ACCEPT
#fi

## smtp server openstellen voor buitenwereld
#if [ $SMTP_SERVER = yes ] ; then
#$IPTABLES -A INPUT -i eth0 -p tcp \
#-s $ANYWHERE -d $IPADDR \
#--source-port $UNPRIVPORTS --destination-port 25 -j ACCEPT

#$IPTABLES -A OUTPUT -o eth0 -p tcp \
#-s $IPADDR -d $ANYWHERE \
#--source-port 25 --destination-port $UNPRIVPORTS -j ACCEPT
#fi

## ftp server openstellen voor buitenwereld
if [ $FTP_SERVER = yes ] ; then
$IPTABLES -A INPUT -i eth0 -p tcp \
-s $ANYWHERE -d $IPADDR -m state --state NEW,ESTABLISHED \
--source-port $UNPRIVPORTS --destination-port 21 -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p tcp \
-s $IPADDR -d $ANYWHERE -m state --state ESTABLISHED,RELATED \
--source-port 21 --destination-port $UNPRIVPORTS -j ACCEPT

# ftp server - active
$IPTABLES -A INPUT -i eth0 -p tcp \
-s $ANYWHERE -d $IPADDR -m state --state ESTABLISHED,RELATED ! --syn \
--destination-port 20 -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p tcp \
-s $IPADDR -d $ANYWHERE -m state --state ESTABLISHED,RELATED \
--source-port 20 -j ACCEPT

# ftp server - passive
$IPTABLES -A INPUT -i eth0 -p tcp \
-s $ANYWHERE -d $IPADDR -m state --state ESTABLISHED,RELATED \
--destination-port $UNPRIVPORTS -j ACCEPT

$IPTABLES -A OUTPUT -o eth0 -p tcp \
-s $IPADDR -d $ANYWHERE -m state --state ESTABLISHED,RELATED \
--source-port $UNPRIVPORTS -j ACCEPT
fi

# trash opvangen
# alles dat nu nog wordt opgevangen loggen
if [ $LOG = yes ] ; then
$IPTABLES -A INPUT -j LOG --log-prefix "filtered on INPUT "
$IPTABLES -A OUTPUT -j LOG --log-prefix "filtered on OUTPUT "
$IPTABLES -A FORWARD -j LOG --log-prefix "filtered on FORWARD "
fi

[Verwijderd]

Hmmmz... over onleesbare zooi gesproken... Zeker met een tooltje gegenereerd.
Ik kan er zo geen wijs uit worden. Mijn firewall script ziet er in ieder geval wat leesbaarder uit... mail maar ff prive als je die wilt hebben ([e-mail])

[Jelmer]

code:

# Generated by iptables-save v1.2.2 on Thu Mar 14 20:13:20 2002
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:block - [0:0]
-A INPUT -s 10.0.0.0/255.255.255.128 -i eth0 -j ACCEPT
-A INPUT -j block
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 1/sec -j ACCEPT
-A FORWARD -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j ACCEPT
-A FORWARD -p icmp -m limit --limit 1/sec -m icmp --icmp-type 8 -j ACCEPT
-A FORWARD -j block
-A block -m state --state RELATED,ESTABLISHED -j ACCEPT
-A block -i ! eth1 -m state --state NEW -j ACCEPT
######Hier staan de poorten neer die je wil doorlaten
-A block -p tcp -m tcp --dport 25 -j ACCEPT
-A block -p tcp -m tcp --dport 2064 -j ACCEPT
-A block -p tcp -m tcp --dport 22 -j ACCEPT
######
-A block -i eth1 -m limit --limit 3/hour -j LOG --log-prefix "Bad packet from internet:"
-A block -j DROP
COMMIT
# Completed on Thu Mar 14 20:13:20 2002
# Generated by iptables-save v1.2.2 on Thu Mar 14 20:13:20 2002
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth1 -j MASQUERADE
COMMIT
# Completed on Thu Mar 14 20:13:20 2002

Voer dit maar aan iptables-restore en klaar ben je. (bij mij is trouwens eth0 intern en eth1 internet)

Dit heb ik trouwens allemaal aan de hand van Howto's en manuals eigen gemaakt, ik adviseer jou hetzelfde te doen.

[Verwijderd]

THNX ik ga deze ook ff proberen..
Ik heb ook een andere config file gekregen, die heb ik nu draaien met wat aanpassingen.
zo nu kan ik ff kijken en de beste van deze twee in een eigen config file zetten.