martin f krafft <madduck@xxxxxxxxxxx> writes: > Ideally, however, --syn is no longer needed if you do > > -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT > -A INPUT -m state --state INVALID -j DROP > -A INPUT -m state --state NEW -j in-new > > -A in-new -p tcp --dport 22 -j ACCEPT > [...] > > -A INPUT -j log-and-drop > > I /think/ this is the correct way to write iptables rules, but > please correct me if I am wrong, anyone! Ok, I use your suggestion. > Now make sure that your hosts don't honour redirects. I actually > don't think passing *all* ICMPv6 is a good idea. Do read the RFC > (see followup thread). I read the RFC (whose example script contains typos). "Just for fun", I applied the recommandations, and ended up with the following. Note the ruleset for ICMPv6... This is getting scary, isn't it ? These certainly need some cleanup, but you get it. # Generated by ip6tables-save v1.3.6 on Fri Apr 4 19:54:58 2008 *filter :INPUT ACCEPT [1:200] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [5:360] :IN-NEW - [0:0] :icmpv6-filter - [0:0] :icmpv6-filter-from-internal - [0:0] :icmpv6-filter-to-internal - [0:0] :icmpv6-filter-to-internal-s - [0:0] -A INPUT -s ::/0 -d ::/0 -i lo -j ACCEPT -A INPUT -s ::/0 -d ::/0 -p ipv6-icmp -j ACCEPT -A INPUT -s ::/0 -d ::/0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -s ::/0 -d ::/0 -m state --state INVALID -j DROP -A INPUT -s ::/0 -d ::/0 -m state --state NEW -j IN-NEW -A INPUT -s ::/0 -d ::/0 -j DROP -A FORWARD -s ::/0 -d ::/0 -p ipv6-icmp -j icmpv6-filter -A FORWARD -s ::/0 -d 2001:6f8:3f1::/48 -i sixxs -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 2001:6f8:3f1::/48 -d ::/0 -i eth0 -o sixxs -j ACCEPT -A FORWARD -s ::/0 -d ::/0 -j DROP -A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 22 -j ACCEPT -A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 25 -j ACCEPT -A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 80 -j ACCEPT -A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 443 -j ACCEPT -A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 465 -j ACCEPT -A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 993 -j ACCEPT -A IN-NEW -s ::/0 -d ::/0 -j DROP -A icmpv6-filter -s ::/0 -d fe80::/10 -p ipv6-icmp -j DROP -A icmpv6-filter -s fe80::/10 -d ::/0 -p ipv6-icmp -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 137 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 135 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 136 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 133 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 134 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 130 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 131 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 132 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 143 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 138 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 139 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 140 -j DROP -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -j ACCEPT -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m state --state RELATED,ESTABLISHED -m icmp6 --icmpv6-type 129 -j ACCEPT -A icmpv6-filter -s 2001:6f8:3f1::/48 -d ::/0 -j icmpv6-filter-from-internal -A icmpv6-filter -s ::/0 -d 2001:6f8:3f1::/48 -j icmpv6-filter-to-internal -A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -j DROP -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 128 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 1 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 2 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 3/0 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 3/1 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/2 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 145 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 147 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/2 -j ACCEPT -A icmpv6-filter-from-internal -s ::/0 -d ::/0 -j DROP -A icmpv6-filter-to-internal -s ::/0 -d ::/0 -m state --state RELATED,ESTABLISHED -j icmpv6-filter-to-internal-s -A icmpv6-filter-to-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 128 -j ACCEPT -A icmpv6-filter-to-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 144 -j ACCEPT -A icmpv6-filter-to-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 146 -j ACCEPT -A icmpv6-filter-to-internal -s ::/0 -d ::/0 -j DROP -A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 1 -j ACCEPT -A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 2 -j ACCEPT -A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 3/0 -j ACCEPT -A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 3/1 -j ACCEPT -A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -j ACCEPT -A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/2 -j ACCEPT -A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -j DROP COMMIT # Completed on Fri Apr 4 19:54:58 2008 -- Nicolas -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
