From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 1A63A1381F3 for ; Tue, 21 May 2013 16:14:07 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 6933DE08A1; Tue, 21 May 2013 16:13:57 +0000 (UTC) Received: from mail-ee0-f50.google.com (mail-ee0-f50.google.com [74.125.83.50]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 0CAC4E0841 for ; Tue, 21 May 2013 16:13:55 +0000 (UTC) Received: by mail-ee0-f50.google.com with SMTP id c41so542266eek.23 for ; Tue, 21 May 2013 09:13:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=7Vm6EF/jVNwlHcb7YzyN5XH7G/3+F4ka7nH+3jEixn0=; b=pd/nGhswE5MJiUggpPBd3ulqzowmYgqcwriLsc/PYCLyz+kXKHOThGIWPcaK1RV/63 GgUWMcfmBDSuIJMp7CiTyTrHaTPKk8G6zjJ+JKyM6d6Wit0/PPJciZpb6xZDUvIdsyog 13rytLoaOq+pV6z8cUOA8pBu2lvwCRp8tM0Yn4S1+JmxglzZtq8R/lgIraiBVfoS97YD KctcZWaja3/VStZeMj79nt5zNEdUhhaf20qTTTlSScZSeJUThVDGjbQZZRC3WcAY+c8S qdvtDp655qG7usjkEcsEpnN+MQgIGquw3h4Sqdf2fNZMw4bwI3T5sHJFsWRITE+pzbKV iVSA== X-Received: by 10.15.55.132 with SMTP id v4mr8127291eew.19.1369152834567; Tue, 21 May 2013 09:13:54 -0700 (PDT) Received: from [172.20.0.41] (196-210-102-103.dynamic.isadsl.co.za. [196.210.102.103]) by mx.google.com with ESMTPSA id s8sm4514598eeo.4.2013.05.21.09.13.52 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 21 May 2013 09:13:53 -0700 (PDT) Message-ID: <519B9D1F.3050802@gmail.com> Date: Tue, 21 May 2013 18:13:19 +0200 From: Alan McKinnon User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130518 Thunderbird/17.0.6 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] IPTables - Going Stateless References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Archives-Salt: f4c423de-567e-454f-8919-9c9ea72733b9 X-Archives-Hash: cc0b462fbe1d7bc5c27c09955d199621 On 21/05/2013 17:07, Nick Khamis wrote: > Hello Everyone, > > We recently moved our stateful firewall inside, and would like to > strip down the firewall at our router connected to the outside world. > The problem I am experiencing is getting things to work properly > without connection tracking. Now why, oh why, do you want to do that? A world of pain awaits you. Stateless firewalls are a colossal mindfuck that will drive you crazy. So unless you have a very very good reason for doing this I recommedn you seriously revisit your choice. iptables really does not consume that much resources (and if you truly are low on resources then you need to get a bigger router, because after all it is a router and I assume in production) I hope I am not in breach of mailing list > rules however, a stripped down configuration is as follows: > > #!/bin/bash > IPTABLES='/sbin/iptables' > > #Set interface values > INTIF1='eth0' > > #flush rules and delete chains > $IPTABLES -F > $IPTABLES -X > > #echo -e " - Accepting input lo traffic" > $IPTABLES -A INPUT -i lo -j ACCEPT > > #echo -e " - Accepting output lo traffic" > $IPTABLES -A OUTPUT -o lo -j ACCEPT > > #echo -e " - Defined Chains" > $IPTABLES -N TCP > $IPTABLES -N UDP > > #echo -e " - Accepting SSH Traffic" > $IPTABLES -A TCP -p tcp -m tcp -s 192.168.2.0/24 -d 192.168.2.5 > --dport 22 -j ACCEPT > $IPTABLES -A TCP -p tcp -m tcp -s 0.0.0.0/0 -d 192.168.2.5 --dport 22 -j DROP > > #echo -e " - Accepting input TCP and UDP traffic to open ports" > $IPTABLES -A INPUT -i $INTIF1 -p tcp --syn -j TCP > $IPTABLES -A INPUT -i $INTIF1 -p udp -j UDP > > #echo -e " - Accepting output TCP and UDP traffic to open ports" > $IPTABLES -A OUTPUT -o $INTIF1 -p tcp --syn -j TCP > $IPTABLES -A OUTPUT -o $INTIF1 -p udp -j UDP > > #echo -e " - Dropping input TCP and UDP traffic to closed ports" > # $IPTABLES -A INPUT -i $INTIF1 -p tcp -j REJECT --reject-with tcp-rst > # $IPTABLES -A INPUT -i $INTIF1 -p udp -j REJECT --reject-with > icmp-port-unreachable > > #echo -e " - Dropping output TCP and UDP traffic to closed ports" > # $IPTABLES -A OUTPUT -o $INTIF1 -p tcp -j REJECT --reject-with tcp-rst > # $IPTABLES -A OUTPUT -o $INTIF1 -p udp -j REJECT --reject-with > icmp-port-unreachable > > #echo -e " - Dropping input traffic to remaining protocols sent > to closed ports" > # $IPTABLES -A INPUT -i $INTIF1 -j REJECT --reject-with icmp-proto-unreachable > > #echo -e " - Dropping output traffic to remaining protocols sent > to closed ports" > # $IPTABLES -A OUTPUT -o $INTIF1 -j REJECT --reject-with icmp-proto-unreachable > > > Everything works fine with the REJECT rules commented out, but when > included SSH access is blocked out. Not sure why, isn't the sequence > correct (i.e., the ACCPET entries before the DROP and REJECT)? > > Also, any pointers or heads up when going stateless would be greatly > appreciated. > > Kind Regards, > > Nick > -- Alan McKinnon alan.mckinnon@gmail.com