On Tuesday 2005-August-30 11:24, Luqman Munawar wrote:
> I have read the "iptables tutorial2 by Oskar Andreasson and tried to
> write a reasonable ruleset for my network scenario. Not really
> something special but being behind a firewall of university, I hope
> it is acceptable as an additional security measure.
In general I would not expect very much protection from something under
the control of university IT departments. OTOH you're apparently on a
NAT'ed RFC 1918 IP, so your only real security concern are attackers
from within the university. That could be a major concern.
> Q1) Can you people be nice enough to give your ideas about how/where
> to improve it.
Packet Filtering HOWTO: INPUT: accept all --state RELATED,ESTABLISHED
traffic, accept services you want open, default policy DROP. OUTPUT
default policy ACCEPT. FORWARD policy DROP, and no rules unless you're
acting as a router. Why complicate things?
> Q2) I have introduced variables instead of actual ip-addresses, but
> these variables are not being handled correctly.
>
> I receive following error:
>
> Bad argument `Y_IP="192.168..126.31'
Did you read that error? What do you think about it?
> Error occurred at line: 8
> Try `iptables-restore -h' or 'iptables-restore --help' for more
> information.
>
>
> The rule set is as following:
>
> fisw31:~/ToDo# cat /root/ToDo/iptables-save-new
> # Generated by iptables-save v1.2.11 on Fri Jul 22 18:20:59 2005
> *filter
>
> :INPUT DROP [808:130818]
> :FORWARD DROP [0:0]
> :OUTPUT DROP [408:29492]
>
> MY_IP="192.168..126.31"
For one thing, that is not a proper representation of an IP address. I
see what appears to be an extra "." in the middle. For another thing,
iptables-restore(8) is not sh(1), and it cannot read shell variable
syntax.
You could do what you're trying to do with a bash "here document" to
generate your rules and pipe them to the stdin of iptables-restore(8).
Your main area of confusion is in thinking that your iptables rules
file was a shell script.
> #Allow connection to/from port 80(http),443(https),22(ssh)
> -A INPUT -d $MY_IP -p tcp -m tcp --dport 80 -j ACCEPT
> -A INPUT -d $MY_IP -p tcp -m tcp --dport 443 -j ACCEPT
> -A INPUT -d $MY_IP -p tcp -m tcp --dport 22 -j ACCEPT
Other than aforementioned syntax problems, okay ...
> -A OUTPUT -s $MY_IP -p tcp -m tcp --dport 80 -j ACCEPT
> -A OUTPUT -s $MY_IP -p tcp -m tcp --dport 443 -j ACCEPT
> -A OUTPUT -s $MY_IP -p tcp -m tcp --dport 22 -j ACCEPT
... but these rules do not allow replies back out. Think about the
difference between --dport and --sport! (Yes, there are --sport rules
further down.)
I've lectured about OUTPUT filtering here before. My bottom line on
that: anyone who needs to ask questions here probably should not be
doing OUTPUT filtering.
--
mail to this address is discarded unless "/dev/rob0"
or "not-spam" is in Subject: header
