#Here you go. I haven't tried the syntax.
INTERNAL_INTERFACE='eth0'
EXTERNAL_INTERFACE='eth1'
EXTERNAL_IP=`ifconfig $EXTERNAL_INTERFACE | awk '/inet/ { print $2 }' |
awk -F ":" '{ print $2 }'`
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -F
iptables -t nat -F
Iptables -t mangle -F
#ESTABLISHED,RELATED
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#SSH
iptables -A INPUT -p tcp -s 192.168.10.0/24 --sport 512: --dport 22 -j
ACCEPT
#Telnet (Only use if you must, ssh is better)
iptables -A INPUT -p tcp -s 192.168.10.0/24 --sport 1024: --dport 23 -j
ACCEPT
#SMTP
iptables -A INPUT -p tcp -s 192.168.10.0/24 --sport 1024: --dport 25 -j
ACCEPT
#POP3
iptables -A INPUT -p tcp -s 192.168.10.0/24 --sport 1024: --dport 110 -j
ACCEPT
#FTP
iptables -A INPUT -p tcp -s 192.168.10.0/24 --sport 1024: --dport 21 -j
ACCEPT
#Web
iptables -A INPUT -p tcp -s 192.168.10.0/24 --sport 1024: -m multiport
--dports 80,443 -j ACCEPT
#Ping
iptables -A INPUT -p ICMP -s 192.168.10.0/24 --icmp-type echo-request -j
ACCEPT
#Surfing from the firewall
iptables -A OUTPUT -p tcp --dports 80,443 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
#Internet sharing
iptables -t nat -A POSTROUTING -o $EXTERNAL_INTERFACE -j SNAT --to
$EXTERNAL_IP
iptables -A FORWARD -i $INTERNAL_INTERFACE -o $EXTERNAL_INTERFACE -p tcp
-s 192.168.10.1 --dport 80 -j ACCEPT
iptables -A FORWARD -i $INTERNAL_INTERFACE -o $EXTERNAL_INTERFACE -p tcp
-s 192.168.10.3 --dport 80 -j ACCEPT
iptables -A FORWARD -i $INTERNAL_INTERFACE -o $EXTERNAL_INTERFACE -p tcp
-s 192.168.10.1 --dport 443 -j ACCEPT
iptables -A FORWARD -i $INTERNAL_INTERFACE -o $EXTERNAL_INTERFACE -p tcp
-s 192.168.10.3 --dport 443 -j ACCEPT
iptables -A FORWARD -i $INTERNAL_INTERFACE -o $EXTERNAL_INTERFACE -s
192.168.10.0/24 --dport ! 80 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#/Klintan
> -----Original Message-----
> From: netfilter-admin@xxxxxxxxxxxxxxxxxxx
> [mailto:netfilter-admin@xxxxxxxxxxxxxxxxxxx] On Behalf Of Payal Rathod
> Sent: Monday, April 14, 2003 4:00 PM
> To: netfilter@xxxxxxxxxxxxxxxxxxx
> Subject: firewall rules
>
>
> Hi,
> I have made a few firewall rules, almost stolen from
> IP-Masquerading HOWTO. Can you please check them and tell
> about any loopholes. I have a lan of 15 computers and a
> central linux server. Users can telnet, ping, http, ssh,
> pop3, smtp in this linux box if only they belong to the lan.
> Also, users of the lan have internet access to everything
> except www, how do I mention it? Only ip 192.168.10.1,
> 192.168.10.3, 192.168.10.10 have www net access also. Rest no.
>
> So as not to waste bandwidth I have put the rules on my site
> at www.geocities.com/rpayal99/firewall-b1.txt Please have a
> look at them and suggest changes. For security I have just
> made a small change to external IP, but the rest of all the
> rules are kept as they are.
>
> With warm regards,
> -Payal
>
>
>
> --
> "Visit GNU/Linux Success Stories"
> www.geocities.com/rpayal99
> Guest-Book Section Updated.
>
>
>
