From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 5FE3A1381FA for ; Mon, 31 Dec 2012 03:23:28 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 9079B21C006; Mon, 31 Dec 2012 03:23:14 +0000 (UTC) Received: from ironport2-out.teksavvy.com (ironport2-out.teksavvy.com [206.248.154.182]) by pigeon.gentoo.org (Postfix) with ESMTP id A1C8021C021 for ; Mon, 31 Dec 2012 03:22:04 +0000 (UTC) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AgsKAG6Zu09MCqA5/2dsb2JhbABEsnYDgRiBCIIWAQUnExwzCzQSFCU3iA66CYtihABiA4hChHyHXIVfiDqBWIMH X-IronPort-AV: E=Sophos;i="4.75,637,1330923600"; d="scan'208";a="210959026" Received: from 76-10-160-57.dsl.teksavvy.com (HELO waltdnes.org) ([76.10.160.57]) by ironport2-out.teksavvy.com with SMTP; 30 Dec 2012 22:22:02 -0500 Received: by waltdnes.org (sSMTP sendmail emulation); Sun, 30 Dec 2012 22:21:50 -0500 From: "Walter Dnes" Date: Sun, 30 Dec 2012 22:21:50 -0500 To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] IPTABLES syntax change? Message-ID: <20121231032150.GA2032@waltdnes.org> References: <20121227004732.GB5854@waltdnes.org> <50DBA7D0.4060800@orlitzky.com> <87zk0zivjk.fsf@einstein.gmurray.org.uk> <20121227231150.GA9864@waltdnes.org> <50DCDEAF.9020002@orlitzky.com> <20121228035937.GA2949@waltdnes.org> <50DD370F.4070509@orlitzky.com> Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <50DD370F.4070509@orlitzky.com> User-Agent: Mutt/1.5.21 (2010-09-15) X-Archives-Salt: bf170714-f1fd-480a-9245-afd5bf58273a X-Archives-Hash: 012f48a21771d21e72565f20046f2866 OK, here is version 2. I had "an excellent adventure" along the way. * At the very last line (COMMIT), iptables-restore said it failed, but no clue whatsoever as to why. * I copied the rules file to a scratch-file, and converted it to a bash script that called iptables each time. * This method showed errors when using "-m multiport" * "multiport" is apparently not part of the core of iptables. It's an extra kernel option that has to be invoked explicity. * cd /usr/src/linux make menuconfig [*] Networking support ---> Networking options ---> [*] Network packet filtering framework (Netfilter) ---> Here's where it gets tricky. You *MUST* first enable... [*] Advanced netfilter configuration ...and then go into... Core Netfilter Configuration ---> ...and select... <*> "multiport" Multiple port match support Rebuild kernel and reboot. Now for the iptables rules, version 2 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :BAD_DPORT - [0:0] :BAD_SPORT - [0:0] :DROP_LOG - [0:0] :FECESBOOK - [0:0] :ICMP_IN - [0:0] :ICMP_OUT - [0:0] :PRIVATE_LOG - [0:0] :UNSOLICITED - [0:0] [0:0] -A BAD_DPORT -j LOG --log-prefix "BAD_DPORT:" --log-level 6 [0:0] -A BAD_DPORT -j DROP [0:0] -A BAD_SPORT -j LOG --log-prefix "BAD_SPORT:" --log-level 6 [0:0] -A BAD_SPORT -j DROP [0:0] -A DROP_LOG -j LOG --log-level 6 [0:0] -A DROP_LOG -j DROP [0:0] -A FECESBOOK -j LOG --log-prefix "FECESBOOK:" --log-level 6 [0:0] -A FECESBOOK -j DROP [0:0] -A ICMP_IN -p icmp -m icmp --icmp-type 0 -j ACCEPT [0:0] -A ICMP_IN -p icmp -m icmp --icmp-type 3 -j ACCEPT [0:0] -A ICMP_IN -p icmp -m icmp --icmp-type 4 -j ACCEPT [0:0] -A ICMP_IN -p icmp -m icmp --icmp-type 11 -j ACCEPT [0:0] -A ICMP_IN -p icmp -m icmp --icmp-type 12 -j ACCEPT [0:0] -A ICMP_IN -j LOG --log-prefix "IN_BAD_ICMP:" --log-level 6 [0:0] -A ICMP_IN -j DROP [0:0] -A ICMP_OUT -p icmp -m icmp --icmp-type 3 -j ACCEPT [0:0] -A ICMP_OUT -p icmp -m icmp --icmp-type 8 -j ACCEPT [0:0] -A ICMP_OUT -p icmp -m icmp --icmp-type 30 -j ACCEPT [0:0] -A ICMP_OUT -j LOG --log-prefix "OUT_BAD_ICMP:" --log-level 6 [0:0] -A ICMP_OUT -j DROP [0:0] -A INPUT -s 192.168.123.248/29 -i eth0 -j ACCEPT [0:0] -A INPUT -s 169.254.0.0/16 -i eth0 -j ACCEPT [0:0] -A INPUT -i lo -j ACCEPT [0:0] -A INPUT -m conntrack --ctstate INVALID,NEW -j UNSOLICITED [0:0] -A INPUT -p tcp -m multiport --dports 0:1023,6000:6063 -j BAD_DPORT [0:0] -A INPUT -p udp -m multiport --dports 0:1023,6000:6063 -j BAD_DPORT [0:0] -A INPUT -s 69.63.176.0/20 -j FECESBOOK [0:0] -A INPUT -s 69.220.144.0/20 -j FECESBOOK [0:0] -A INPUT -s 69.63.176.0/20 -j FECESBOOK [0:0] -A INPUT -s 69.171.224.0/19 -j FECESBOOK [0:0] -A INPUT -s 200.58.112.0/20 -j FECESBOOK [0:0] -A INPUT -s 213.155.64.0/19 -j FECESBOOK [0:0] -A INPUT -s 10.0.0.0/8 -j PRIVATE_LOG [0:0] -A INPUT -s 127.0.0.0/8 -j PRIVATE_LOG [0:0] -A INPUT -s 172.16.0.0/12 -j PRIVATE_LOG [0:0] -A INPUT -s 192.168.0.0/16 -j PRIVATE_LOG [0:0] -A INPUT -p icmp -j ICMP_IN [0:0] -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT [0:0] -A OUTPUT -d 192.168.123.248/29 -o eth0 -j ACCEPT [0:0] -A OUTPUT -o lo -j ACCEPT [0:0] -A OUTPUT -p tcp -m multiport --sports 0:1023,6000:6063 -j BAD_SPORT [0:0] -A OUTPUT -p udp -m multiport --sports 0:1023,6000:6063 -j BAD_SPORT [0:0] -A OUTPUT -d 69.63.176.0/20 -j FECESBOOK [0:0] -A OUTPUT -d 69.220.144.0/20 -j FECESBOOK [0:0] -A OUTPUT -d 69.63.176.0/20 -j FECESBOOK [0:0] -A OUTPUT -d 69.171.224.0/19 -j FECESBOOK [0:0] -A OUTPUT -d 200.58.112.0/20 -j FECESBOOK [0:0] -A OUTPUT -d 213.155.64.0/19 -j FECESBOOK [0:0] -A PRIVATE_LOG -j LOG --log-prefix "IN_BAD_ADDR:" --log-level 6 [0:0] -A PRIVATE_LOG -j DROP [0:0] -A UNSOLICITED -j LOG --log-prefix "UNSOLICITED:" --log-level 6 [0:0] -A UNSOLICITED -j DROP COMMIT -- Walter Dnes I don't run "desktop environments"; I run useful applications