PDA

View Full Version : Iptables + bridge e noie

LimiT-MaTz
29-12-2005, 15:18
Ciao a tutti,
sono pronto ad apprestarmi a scrivere l'ennesimo post-monologo.

Allora vediamo di spiegarci:

Ho una rete locale con tot macchine (192.168.1.***).
Sto costruendo un router serverino access point. sul router ci sono 2 ethernet e 1 wifi (madwifi WPA).

ho creato un bridge tra la ath0 e la eth0 e gli ho assegnato IP: 192.168.1.1

ora prendo in mio notebook mi connetto in wifi (WPA) perfetto (mi viene assegnato un ip 192.168.1.140)

a questo punto provo a connettermi alla macchina 192.168.1.2 (in cui sono abilitati tot servizi ecc ecc) ok mi connetto perfettamente. ok funziona.
Il bridge sembra fare il suo sporco lavoro (bene bene).
Ora decido di ritare su il mio scriptino per iptables (provvisorio: devo ancora sistemarlo per bene ma lo ufilizzero' come base)

#|/bin/bash

#
# Firewall: eth1 [internet], eth0 [lan],ath0 [lanwifi] ===> br0 = eth0 + ath0
#

export LAN=br0
export WAN=eth1

/sbin/iptables -F
/sbin/iptables -F INPUT
/sbin/iptables -F OUTPUT
/sbin/iptables -F FORWARD
/sbin/iptables -X
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD DROP

### Abilito Protezione KernelSpace via Proc FileSystem

echo 1024 > /proc/sys/net/ipv4/tcp_max_syn_backlog
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
for a in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $a
done
echo 0 > /proc/sys/net/ipv4/tcp_ecn
#Fragmented packets management
echo 262144 > /proc/sys/net/ipv4/ipfrag_high_thresh
echo 196608 > /proc/sys/net/ipv4/ipfrag_low_thresh
echo 25 > /proc/sys/net/ipv4/ipfrag_time
echo "1" > /proc/sys/net/ipv4/ip_forward

### Definisco delle Catene Personali
# silent: drop dei pacchetti "innoqui" [NO LOG]
# tcpflag: drop pacchetti con flag strane [LOG]
# firewall: drop pacchetti rifiutati [LOG]
# service: drop dei pacchetti su demoni non utilizzati [LOG]

/sbin/iptables -N silent
/sbin/iptables -A silent -j DROP

/sbin/iptables -N tcpflag
/sbin/iptables -A tcpflag -m limit --limit 15/minute -j LOG --log-prefix tcpflag:
/sbin/iptables -A tcpflag -j DROP

/sbin/iptables -N firewall
/sbin/iptables -A firewall -m limit --limit 15/minute -j LOG --log-prefix firewall:
/sbin/iptables -A firewall -j DROP

/sbin/iptables -N service
/sbin/iptables -A service -m limit --limit 15/minute -j LOG --log-prefix service:
/sbin/iptables -A service -j DROP

### Tcpflags Dangerouse[ PORTSCAN - BADFLAG - INVALID ]

/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-flags ALL FIN,URG,PSH -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-flags ALL ALL -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-flags ALL NONE -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-flags SYN,RST SYN,RST -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-flags SYN,FIN SYN,FIN -j tcpflag

/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-option 64 -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-option 128 -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 0 -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p udp --dport 0 -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --sport 0 -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p udp --sport 0 -j tcpflag

/sbin/iptables -A INPUT -m state --state INVALID -j DROP
/sbin/iptables -A FORWARD -m state --state INVALID -j DROP


### pacchetti ICMP buoni

/sbin/iptables -A INPUT -i ${WAN} -p icmp --icmp-type 0 -j ACCEPT
/sbin/iptables -A INPUT -i ${WAN} -p icmp --icmp-type 3 -j ACCEPT
/sbin/iptables -A INPUT -i ${WAN} -p icmp --icmp-type 11 -j ACCEPT
/sbin/iptables -A INPUT -i ${WAN} -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT

### service monitoring
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 21 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 22 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 23 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 25 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 80 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 137 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 138 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 139 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 631 -j service

### abilito la LAN a connettersi al router
/sbin/iptables -I INPUT -i ${LAN} -j ACCEPT

### abilito LO interface
/sbin/iptables -A INPUT -i lo -j ACCEPT

### Forwarding Rules
/sbin/iptables -I FORWARD -i ${LAN} -d 192.168.1.0/255.255.255.0 -j DROP
/sbin/iptables -A FORWARD -i ${LAN} -p udp --sport 137:138 --dport 137:138 -j DROP
/sbin/iptables -A FORWARD -i ${LAN} -s 192.168.1.0/255.255.255.0 -j ACCEPT
/sbin/iptables -A FORWARD -i ${WAN} -d 192.168.1.0/255.255.255.0 -j ACCEPT


/sbin/iptables -t nat -A POSTROUTING -o ${WAN} -s 192.168.1.0/255.255.255.0 -j MASQUERADE

/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -s 10.0.138.21 -j silent
/sbin/iptables -A INPUT -j firewall


tiro su lo script ed ecco che i vari client riescono a navigare su internet a questo punto provo a connettermi alla macchina 192.168.1.2 (quella con tot servizi) e .... non riesco + a connettermi.

Il problema e' quindi lo script di iptables, non riesco a visualizzare l'errore

Sapreste aiutarmi?
Avete spunti e idee per lo script di iptables?

Grazie
LimiT-MaTz
29-12-2005, 15:39
si si e' destinato ad essere anchesso un topic monologo :)

allora
#|/bin/bash

#
# Firewall: eth1 [internet], eth0 [lan],ath0 [lanwifi] ===> br0 = eth0 + ath0
#

export LAN=br0
export WAN=eth1

/sbin/iptables -F
/sbin/iptables -F INPUT
/sbin/iptables -F OUTPUT
/sbin/iptables -F FORWARD
/sbin/iptables -X
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD DROP

### Abilito Protezione KernelSpace via Proc FileSystem

echo 1024 > /proc/sys/net/ipv4/tcp_max_syn_backlog
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
for a in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $a
done
echo 0 > /proc/sys/net/ipv4/tcp_ecn
#Fragmented packets management
echo 262144 > /proc/sys/net/ipv4/ipfrag_high_thresh
echo 196608 > /proc/sys/net/ipv4/ipfrag_low_thresh
echo 25 > /proc/sys/net/ipv4/ipfrag_time
echo "1" > /proc/sys/net/ipv4/ip_forward

### Definisco delle Catene Personali
# silent: drop dei pacchetti "innoqui" [NO LOG]
# tcpflag: drop pacchetti con flag strane [LOG]
# firewall: drop pacchetti rifiutati [LOG]
# service: drop dei pacchetti su demoni non utilizzati [LOG]

/sbin/iptables -N silent
/sbin/iptables -A silent -j DROP

/sbin/iptables -N tcpflag
/sbin/iptables -A tcpflag -m limit --limit 15/minute -j LOG --log-prefix tcpflag:
/sbin/iptables -A tcpflag -j DROP

/sbin/iptables -N firewall
/sbin/iptables -A firewall -m limit --limit 15/minute -j LOG --log-prefix firewall:
/sbin/iptables -A firewall -j DROP

/sbin/iptables -N service
/sbin/iptables -A service -m limit --limit 15/minute -j LOG --log-prefix service:
/sbin/iptables -A service -j DROP

### Tcpflags Dangerouse[ PORTSCAN - BADFLAG - INVALID ]

/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-flags ALL FIN,URG,PSH -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-flags ALL ALL -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-flags ALL NONE -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-flags SYN,RST SYN,RST -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-flags SYN,FIN SYN,FIN -j tcpflag

/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-option 64 -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --tcp-option 128 -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 0 -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p udp --dport 0 -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p tcp --sport 0 -j tcpflag
/sbin/iptables -A INPUT -i ${WAN} -p udp --sport 0 -j tcpflag

/sbin/iptables -A INPUT -m state --state INVALID -j DROP
/sbin/iptables -A FORWARD -m state --state INVALID -j DROP


### pacchetti ICMP buoni

/sbin/iptables -A INPUT -i ${WAN} -p icmp --icmp-type 0 -j ACCEPT
/sbin/iptables -A INPUT -i ${WAN} -p icmp --icmp-type 3 -j ACCEPT
/sbin/iptables -A INPUT -i ${WAN} -p icmp --icmp-type 11 -j ACCEPT
/sbin/iptables -A INPUT -i ${WAN} -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT

### service monitoring
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 21 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 22 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 23 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 25 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 80 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 137 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 138 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 139 -j service
/sbin/iptables -A INPUT -i ${WAN} -p tcp --dport 631 -j service

### abilito la LAN a connettersi al router
/sbin/iptables -I INPUT -i ${LAN} -j ACCEPT

### abilito LO interface
/sbin/iptables -A INPUT -i lo -j ACCEPT

### Forwarding Rules
#/sbin/iptables -I FORWARD -i ${LAN} -d 192.168.1.0/255.255.255.0 -j DROP
/sbin/iptables -A FORWARD -i ${LAN} -p udp --sport 137:138 --dport 137:138 -j DROP
/sbin/iptables -A FORWARD -i ${LAN} -s 192.168.1.0/255.255.255.0 -j ACCEPT
/sbin/iptables -A FORWARD -i ${WAN} -d 192.168.1.0/255.255.255.0 -j ACCEPT


/sbin/iptables -t nat -A POSTROUTING -o ${WAN} -s 192.168.1.0/255.255.255.0 -j MASQUERADE

/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -s 10.0.138.21 -j silent
/sbin/iptables -A INPUT -j firewall


commentando la regola
#/sbin/iptables -I FORWARD -i ${LAN} -d 192.168.1.0/255.255.255.0 -j DROP
si risolve

Ora il mio dubbio e' ma con queste impostazione non rischio di far svolazzare nella rete(web) una serie di pacchetti della lan locale?

Ogni consiglio relativo allo script per iptables e' piu' che gradito!

GRAZIE!!!