Re: [TCLUG:7419] firewall configuration

["Clayton T. Fandre" <cfandre@maddog.mn-linux.org>]

David Guy Brizan wrote:
> Hmm. Maybe I configured my rules badly or I don't understand the whole
> business of ipchains, but I think if you are trying to create a firewall
> out of your Linux box -- not just a router or ip masquerading machine --
> you must open those ports (above 61000) on input. (According to the
> IPCHAINS-HOWTO, ipchains checks the input chain *before* it decides
> whether a packet should be masqueraded or demasqueraded.) But maybe I
> misunderstand the HOWTO.

OK. Maybe I was unclear when I said the default policy was deny. The
default policy for the forward chain ruleset is deny. The default policy
for the input and output rulesets are ACCEPT. Therefore all packets will
be able to enter and leave the system, (ip masq system only) but
anything that is suppose to be forwarded will go through the masq rules.
There is a security risk there since anyone can get to the ip masq
system, but that is why I suggested using PortSentry.

Basically no packets will be able to get into your internal network
because they must all pass through the forward rules, which states that
only internal IP's can pass. (which will be masqueraded). The return
connections are already established with ip masq so you don't need to
worry about that.

As for the 61000 ports, you don't need to open that up if your ip masq
machine is also your firewall. If it isn't, (ie. you have another
firewall farther outside your ip masq machine) you must open up your
firewall to allow ports 61000-65000 OUT only. I never had to do this. I
am just telling you what I read.

> 
> Are you using ipchains as a firewall / router: filtering input and
> masquerading other machines? Are you seeing packets automatically
> de-masqueraded in spite of rules on your input chain? If so, would you
> share your rules with me (or a secure enough subset)? I'd love a better
> set of rules than I have now!
> 

I am using the simple ip masq rules, and here is my output of ipchains
-L:

Chain input (policy ACCEPT):
Chain forward (policy DENY):
target     prot opt     source                destination          
ports
MASQ       all  ------  192.168.0.0/24        anywhere              n/a
Chain output (policy ACCEPT):

Clay


-- 
Clay Fandre
cfandre@maddog.mn-linux.org
Twin Cities Linux Users Group
http://www.mn-linux.org