Text 7680, 124 rader
Skriven 2006-10-22 00:38:00 av Paul Rogers (1:105/360.0)
     Kommentar till en text av Martin Atkins
Ärende: Latest firewall script
==============================
 MA> Is the above your comment or the original script writer?

Mine.

 MA> I'm going to take it at face value and assume it is a work station
 MA> on a local network that has access to the outside world.

It is.

 PR>   NAMESERVER_2=209.102.124.15  # change as necessary
 MA> Fair enough if your local net is routing you to the outside world.

Actually, I guess I could change that to the router's address.
Bering provides a DNS relay with its firewall/router.  But it
goes to those same addresses.  I don't use a local DNS, all
static in /etc/hosts.

 MA> Nameservers are not my strong point as i only have a small home network
 MA> and the other machines routed to the outside world yet.

Those are DNS servers provided by my ISP.

 PR>   LOOPBACK="127.0.0.0/8"
 MA> Why define loopback this way? Loopback is for testing your own machine

That was how the original parts I borrowed from James Stephens
defined it--didn't see any overwhelming reason to change it.

 MA> and normally will only be 127.0.0.0. Iptables accepts "lo" and so
 MA> _normally_ does not require defining.

Right.  "Normally".  But IIANM all of 127 is defined as
loopback, and IIRC I've seen 127.0.0.1 used also.  This gets the
whole range.

 PR>   CLASS_A="10.0.0.0/8"
 PR>   CLASS_B="172.16.0.0/12"
 PR>   CLASS_C="192.168.0.0/16"
 PR>   CLASS_D_MULTICAST="224.0.0.0/4"
 PR>   CLASS_E_RESERVED_NET="240.0.0.0/5"

 MA> None of these are necessary. Since INPUT policy is DROP they never
 MA> get through.

They do.  I get probes from Class-C addresses coming from other
users on the ISP's routers frequently--some of the other
customers aren't clean.  (And they may not even know.)
Depending on how the ISP configures itself, I suppose I could
get any of the RFC1419 addresses.  I'd rather have the check
than not.

 PR>   EPHEM="1024:65535"   # ephemeral ports
 MA> If as /proc/sys/net/ipv4/ip_local_port_range or what is appropriate
 MA> for your distro.

I have some checks in it that might not be necessary, e.g.
fragments, depending on how the kernel parameters are set.  I
know some set those as part of the firewall setup.  I chose to
keep the two separate and dedicate this script to just the
iptables setup.  I'd rather waste a small amount of time having
the firewall check, in case kernel checking gets turned off.

 PR>   TR_SRC_PORTS="32769:65535"
 PR>   TR_DEST_PORTS="33434:33523"
 MA> This is a worry. $EPHEM is now defined so these ports are as far as i
 MA> know safe. There may be some reason for defining these ports but it is
 MA> not  obvious from this script

They're used later on to allow traceroutes.

 PR>   LOCAL_NET=$BASEIP.0/24
 MA> This doesn't make sense to me. $BASEIP has not been defined in this
 MA> script nor has $network_devices/ifconfig.eth0$network_devices
 MA> /ifconfig.eth0

It is on my LFS systems.  It's there as part of my installation
process.  It asks once for a base-IP, then just the LAN node
numbers for the workstation, the server, the router.  Saves
typing, or more properly mistyping.

 PR>   iptables -P FORWARD DROP
 PR>   iptables -P OUTPUT DROP
 MA> Unless you are intending to block yourself or a terminal on your

Making the default policy DROP makes sure nothing gets through
while I'm allowing things.  It's the right way to do it, even
since I start the firewall before I bring up eth0.  But some
distros aren't that careful, RHL[6,7] IIANM.

 MA> network from the communicating with the outside world then:-
 MA> iptables -P OUTPUT ACCEPT
 MA> Even if you do intend to restrict output from certain terminals there
 MA> are better ways of doing it.

Better in what sense?

 PR>   iptables -A INPUT  -i lo -s $IP       -j ACCEPT
 PR>   iptables -A OUTPUT -o lo -d $IP       -j ACCEPT
 MA> As far as i can see $IP has not been defined in this script. Even if

Remember those sourced files?  If yours isn't defined there you
could define it anywhere you like.

 MA> it was $IP cannot under normal circumstances request "lo" on a remote
 MA> machine.

I didn't think so either.  Then I found packets being dropped on
the loopback interface with my IP address rather than 127.0.0.0,
so I had to allow both.

 PR> #### PGR: BLACKLIST CHECKING
 MA> Why not cover all this with the input policy?

It works and it's the way I chose to do it.

Paul Rogers, paulgrogers@yahoo.com                       -o)
http://www.angelfire.com/or/paulrogers                   /\\
Rogers' Second Law: Everything you do communicates.     _\_V

... Upgrade -- (v.) Take out old bugs, put in new ones.
___ MultiMail/MS-DOS v0.35

---
 * Origin: The Bare Bones BBS (1:105/360)