It's a shell script
#!/bin/bash
IPTABLES="/sbin/iptables"
# Load required modules
/sbin/insmod ip_tables
/sbin/insmod ip_conntrack
/sbin/insmod iptable_nat
/sbin/insmod ipt_MASQUERADE
# Then flush all rules
/sbin/iptables -F
/sbin/iptables -t nat -F
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
# In the NAT table (-t nat), Append a rule (-A) after routing
# (POSTROUTING) for all packets going out ppp0 (-o ppp0) which says to
# MASQUERADE the connection (-j MASQUERADE).
/sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
# Below means 'route 192.168.1.x'
/sbin/iptables -A FORWARD -d 192.168.0.0/24 -j ACCEPT
/sbin/iptables -A FORWARD -s ! 192.168.0.0/24 -j DROP
# Disallow NEW and INVALID incoming or forwarded packets from ppp0.
/sbin/iptables -A INPUT -i eth1 -m state --state NEW,INVALID -j DROP
/sbin/iptables -A FORWARD -i eth1 -m state --state NEW,INVALID -j DROP
# port 113 is evil ;)
/sbin/iptables -A INPUT --protocol udp --source-port 113 -j DROP
/sbin/iptables -A INPUT --protocol udp --destination-port 113 -j DROP
/sbin/iptables -A INPUT -i eth0 -p tcp -s 192.168.0.0/24 --dport 137:139 -j
ACCEPT
/sbin/iptables -A INPUT -i eth0 -p udp -s 192.168.0.0/24 --dport 137:139 -j
ACCEPT
/sbin/iptables -A INPUT --protocol tcp --source-port 22 -j ACCEPT
#/sbin/iptables -A INPUT --protocol udp --destination-port 22 -j ACCEPT
/sbin/iptables -A INPUT --protocol tcp --source-port 111 -j DROP
/sbin/iptables -A INPUT --protocol tcp --source-port 139 -j DROP
/sbin/iptables -A INPUT --protocol udp --source-port 138 -j DROP
/sbin/iptables -A INPUT --protocol udp --source-port 137 -j DROP
/sbin/iptables -A FORWARD -i eth1 -p tcp --dport 137:139 -j DROP
#/sbin/iptables -A FORWARD -i eth1 -p udp --dport 137:139 -j DROP
#/sbin/iptables -A OUTPUT -p tcp --dport 137:139 -j DROP
#/sbin/iptables -A OUTPUT -p udp --dport 137:139 -j DROP
#$IPTABLES -A INPUT -i lo -j ACCEPT
# Turn on IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Route incoming ppp0 at port 80, to 192.168.1.18:80
#/sbin/iptables -A PREROUTING -t nat -p tcp -i eth1 --dport 80 -j DNAT --to
192.168.0.18:80
# Route incoming ppp0 at port 21, to 192.168.1.18:21
#/sbin/iptables -A PREROUTING -t nat -p tcp -i eth1 --dport 21 -j DNAT --to
192.168.0.18:21
#Now, our firewall chain
#We use the limit commands to cap the rate at which it alerts to 15
#log messages per minute
$IPTABLES -N firewall
$IPTABLES -A firewall -m limit --limit 3/minute --limit-burst 3 -j LOG
--log-level notice --log-prefix "Netfilter in: "
$IPTABLES -A firewall -j DROP
#Now, our dropwall chain, for the final catchall filter
$IPTABLES -N dropwall
$IPTABLES -A dropwall -m limit --limit 3/minute --limit-burst 3 -j LOG
--log-level notice --log-prefix "Netfilter in: "
$IPTABLES -A dropwall -j DROP
#Our "hey, them's some bad tcp flags!" chain
$IPTABLES -N badflags
$IPTABLES -A badflags -m limit --limit 3/minute --limit-burst 3 -j LOG
--log-level notice --log-prefix "Netfilter in: "
$IPTABLES -A badflags -j DROP
#And our silent logging chain
$IPTABLES -N silent
$IPTABLES -A silent -j DROP
#Drop those nasty packets!
#These are all TCP flag combinations that should never, ever occur in the
#wild. All of these are illegal combinations that are used to attack a box
#in various ways, so we just drop them and log them here.
$IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j badflags
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j badflags
$IPTABLES -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j badflags
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j badflags
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j badflags
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j badflags
#Drop icmp, but only after letting certain types through
$IPTABLES -A INPUT -p icmp --icmp-type 0 -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type 3 -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type 11 -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
$IPTABLES -A INPUT -p icmp -j firewall
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -j dropwall
#$IPTABLES -A INPUT -s 192.168.0.2 -d 0/0 -p all -j ACCEPT
#$IPTABLES -A INPUT -s 192.168.0.3 -d 0/0 -p all -j ACCEPT
/etc/rc.d/init.d/iptables start
/sbin/iptables-save > /etc/sysconfig/iptables
----- Original Message -----
From: "linux power" <linuxpower@operamail.com>
Date: Thu, 15 May 2003 23:24:35 +0100
To: samba@lists.samba.org
Subject: [Samba] My iptables (RH 7.2) firewall attached
>
> Soory the attachment in my reply didn't show, but here it is.
>
> --
> ____________________________________________
> http://www.operamail.com
> Get OperaMail Premium today - USD 29.99/year
>
>
> Powered by Outblaze
>
> --
> To unsubscribe from this list go to the following URL and read the
instructions: http://lists.samba.org/mailman/listinfo/samba
--
____________________________________________
http://www.operamail.com
Get OperaMail Premium today - USD 29.99/year
Powered by Outblaze
