Saturday, 23. May 2009, 06:39:48
Here it is a basic IPTABLES configuration for Slackware and Zenwalk distros:
from:
http://zonemikel.com/wordpress/# eth conf
# http access/port 80
iptables -A INPUT -i eth+ -p tcp -m tcp --dport 80 -j ACCEPT
# ssh access/port 22
iptables -A INPUT -i eth+ -p tcp -m tcp --dport 22 -j ACCEPT
# no access to other ports
iptables -A INPUT -j DROP
# wifi conf
iptables -N NETTWO # create table
iptables -A NETTWO -p tcp -m tcp --dport 80 -j ACCEPT # is it port 80 ?
iptables -A NETTWO -j LOG --log-prefix '[NETTWO DROP] : ' #if no log/drop
iptables -A NETTWO -j DROP
#first line of my input table, if eth1 jmp nettwo
iptables -i eth1 -j NETTWO
# create two chains, one for fw other is trusted (for clean script?)
iptables -N FIREWALL
iptables -N TRUSTED
# allow established and related incoming connections only
iptables -A FIREWALL -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow self communication
iptables -A FIREWALL -i lo -j ACCEPT
iptables -A FIREWALL -o lo -j ACCEPT
# send all package to the trusted chain
iptables -A FIREWALL -j TRUSTED
# drop all other packets
iptables -A FIREWALL -j DROP
# enable port forwarding
iptables -A FORWARD -j ACCEPT
# hide computers behind the firewall
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
Then, Manual script to start/stop firewall. It should be located at /etc/rc.d/
# case statement to call the correct function, exept status which is in the case
case $1 in
start)
start
;;
stop)
stop
;;
restart)
stop
start
;;
status)
iptables -L
iptables -t nat -L
RETVAL=0
;;
lockdown)
stop
lockdown
;;
*)
echo "Usage: Firewall (start|stop|restart|status)"
esac
exit
# stop the firewall (everything is open !)
stop() {
echo "Remvoing all Iptables rules: "
echo "Everything on the network will be open !!!"
# set the default policy
iptables -P INPUT ACCEPT# accept all incoming packets
iptables -P FORWARD ACCEPT# forward all packets to other puters (flood)
iptables -P OUTPUT ACCEPT# accept all outgoing packets and send them
# set default policy for the NAT table
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
# delete all old rules
iptables -F # flush
iptables -t nat -F# flust nat table
# delete all chains
iptables -X
iptables -t nat -X
# setup port forwarding
echo "Enabling forwarding from eth0 to everyone"
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
echo "All tables flushed, all connections accepted/forwarded"
RETVAL=0
}
-2501