Ignore:
Timestamp:
03/05/2020 08:54:16 PM (4 years ago)
Author:
Pierre Labastie <pieere@…>
Branches:
10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 12.1, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, lazarus, lxqt, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, trunk, upgradedb, xry111/intltool, xry111/llvm18, xry111/soup3, xry111/test-20220226, xry111/xf86-video-removal
Children:
f11d372a
Parents:
bbe17e2
Message:

Revert r22759, just removing the references nftables and firewalld

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@22807 af4574ff-66df-0310-9fd7-8a98e5e911e0

File:
1 edited

Legend:

Unmodified
Added
Removed

  • postlfs/security/iptables.xml

    rbbe17e2 r018c0cc3  
    7575    <bridgehead renderas="sect4">Optional</bridgehead>
    7676    <para role="optional">
    77  <!--     <xref linkend="nftables"/>, -->
     77<!--      <xref linkend="nftables"/>, -->
    7878      <xref linkend="libpcap"/> (required for nfsypproxy support),
    7979      <ulink url="https://github.com/tadamdam/bpf-utils">bpf-utils</ulink>
    8080      (required for Berkely Packet Filter support),
    8181      <ulink url="https://netfilter.org/projects/libnfnetlink/">libnfnetlink</ulink>
    82       (required for connlabel support), and
    83       <ulink url="https://netfilter.org/projects/libnetfilter_conntrack/">libnetfilter_conntrack"</ulink>
     82      (required for connlabel support),
     83      <ulink url="https://netfilter.org/projects/libnetfilter_conntrack/">libnetfilter_conntrack"</ulink>, and
    8484      (required for connlabel support)
     85      <ulink url="https://netfilter.org/projects/nftables/">nftables</ulink>
    8586    </para>
    8687
    … …  
    114115      Include any connection tracking protocols that will be used, as well as
    115116      any protocols that you wish to use for match support under the
    116       "Core Netfilter Configuration" section. <!--The above options are enough
    117       for running <xref linkend="fw-persFw-ipt"/> below.-->
     117      "Core Netfilter Configuration" section. The above options are enough
     118      for running <xref linkend="fw-persFw-ipt"/> below.
    118119    </para>
    119120
    … …  
    210211
    211212  </sect2>
    212 <!--
     213
    213214  <sect2 role="configuration">
    214215    <title>Configuring iptables</title>
    215 
     216<!--
    216217    <note>
    217218      <para>
    … …  
    223224      </para>
    224225    </note>
    225 
     226-->
    226227    <note>
    227228      <para>
    … …  
    319320# and permit new connections related to established ones
    320321# (e.g. port mode ftp)
    321 
    322 iptables -A INPUT -m conntrack - -ctstate ESTABLISHED,RELATED -j ACCEPT
     322iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    323323
    324324# Log everything else. What's Windows' latest exploitable vulnerability?
    325 iptables -A INPUT -j LOG - -log-prefix "FIREWALL:INPUT "
     325iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
    326326
    327327# End $rc_base/rc.iptables</literal>
    … …  
    398398# and permit new connections related to established ones
    399399# (e.g. port mode ftp)
    400 iptables -A INPUT -m conntrack - -ctstate ESTABLISHED,RELATED -j ACCEPT
     400iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    401401
    402402# Log everything else. What's Windows' latest exploitable vulnerability?
    403 iptables -A INPUT -j LOG - -log-prefix "FIREWALL:INPUT "
     403iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
    404404
    405405# End /etc/systemd/scripts/iptables</literal>
    … …  
    519519
    520520# Allow forwarding if the initiated on the intranet
    521 iptables -A FORWARD -m conntrack - -ctstate ESTABLISHED,RELATED -j ACCEPT
    522 iptables -A FORWARD ! -i WAN1 -m conntrack - -ctstate NEW       -j ACCEPT
     521iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
     522iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW       -j ACCEPT
    523523
    524524# Do masquerading
    … …  
    528528# Log everything for debugging
    529529# (last of all rules, but before policy rules)
    530 iptables -A INPUT   -j LOG - -log-prefix "FIREWALL:INPUT "
    531 iptables -A FORWARD -j LOG - -log-prefix "FIREWALL:FORWARD "
    532 iptables -A OUTPUT  -j LOG - -log-prefix "FIREWALL:OUTPUT "
     530iptables -A INPUT   -j LOG --log-prefix "FIREWALL:INPUT "
     531iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
     532iptables -A OUTPUT  -j LOG --log-prefix "FIREWALL:OUTPUT "
    533533
    534534# Enable IP Forwarding
    … …  
    613613
    614614# Allow forwarding if the initiated on the intranet
    615 iptables -A FORWARD -m conntrack - -ctstate ESTABLISHED,RELATED -j ACCEPT
    616 iptables -A FORWARD ! -i WAN1 -m conntrack - -ctstate NEW       -j ACCEPT
     615iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
     616iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW       -j ACCEPT
    617617
    618618# Do masquerading
    … …  
    622622# Log everything for debugging
    623623# (last of all rules, but before policy rules)
    624 iptables -A INPUT   -j LOG - -log-prefix "FIREWALL:INPUT "
    625 iptables -A FORWARD -j LOG - -log-prefix "FIREWALL:FORWARD "
    626 iptables -A OUTPUT  -j LOG - -log-prefix "FIREWALL:OUTPUT "
     624iptables -A INPUT   -j LOG --log-prefix "FIREWALL:INPUT "
     625iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
     626iptables -A OUTPUT  -j LOG --log-prefix "FIREWALL:OUTPUT "
    627627
    628628# Enable IP Forwarding
    … …  
    633633
    634634# Allow ping on the external interface
    635 #iptables -A INPUT  -p icmp -m icmp - -icmp-type echo-request -j ACCEPT
    636 #iptables -A OUTPUT -p icmp -m icmp - -icmp-type echo-reply   -j ACCEPT
     635#iptables -A INPUT  -p icmp -m icmp --icmp-type echo-request -j ACCEPT
     636#iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply   -j ACCEPT
    637637
    638638# Reject ident packets with TCP reset to avoid delays with FTP or IRC
    639 #iptables -A INPUT  -p tcp - -dport 113 -j REJECT - -reject-with tcp-reset
     639#iptables -A INPUT  -p tcp --dport 113 -j REJECT --reject-with tcp-reset
    640640
    641641# Allow HTTP and HTTPS to 192.168.0.2
    642 #iptables -A PREROUTING -t nat -i WAN1 -p tcp - -dport 80 -j DNAT - -to 192.168.0.2
    643 #iptables -A PREROUTING -t nat -i WAN1 -p tcp - -dport 443 -j DNAT - -to 192.168.0.2
    644 #iptables -A FORWARD -p tcp -d 192.168.0.2 - -dport 80 -j ACCEPT
    645 #iptables -A FORWARD -p tcp -d 192.168.0.2 - -dport 443 -j ACCEPT
     642#iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 80 -j DNAT --to 192.168.0.2
     643#iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 443 -j DNAT --to 192.168.0.2
     644#iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 80 -j ACCEPT
     645#iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 443 -j ACCEPT
    646646
    647647# End /etc/systemd/scripts/iptables</literal>
    … …  
    706706      </para>
    707707
    708 <screen><literal>iptables -A INPUT -m conntrack - -ctstate ESTABLISHED,RELATED -j ACCEPT
     708<screen><literal>iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    709709iptables -A OUTPUT -j ACCEPT</literal></screen>
    710710
    … …  
    732732          </para>
    733733
    734 <screen><literal>iptables -A OUTPUT -p tcp - -dport 80 -j ACCEPT
    735 iptables -A INPUT  -p tcp - -sport 80 -m conntrack - -ctstate ESTABLISHED \
     734<screen><literal>iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
     735iptables -A INPUT  -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED \
    736736  -j ACCEPT</literal></screen>
    737737
    … …  
    742742          </para>
    743743
    744 <screen><literal>iptables -A OUTPUT -p udp - -dport 53 -j ACCEPT</literal></screen>
     744<screen><literal>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT</literal></screen>
    745745
    746746        </listitem>
    … …  
    751751          </para>
    752752
    753 <screen><literal>iptables -A INPUT  -p icmp -m icmp - -icmp-type echo-request -j ACCEPT
    754 iptables -A OUTPUT -p icmp -m icmp - -icmp-type echo-reply   -j ACCEPT</literal></screen>
     753<screen><literal>iptables -A INPUT  -p icmp -m icmp --icmp-type echo-request -j ACCEPT
     754iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply   -j ACCEPT</literal></screen>
    755755
    756756        </listitem>
    … …  
    770770          </para>
    771771
    772 <screen><literal>iptables -A INPUT  -p tcp - -dport 113 -j REJECT - -reject-with tcp-reset</literal></screen>
     772<screen><literal>iptables -A INPUT  -p tcp --dport 113 -j REJECT --reject-with tcp-reset</literal></screen>
    773773
    774774        </listitem>
    … …  
    780780          </para>
    781781
    782 <screen><literal>iptables -I INPUT 0 -p tcp -m conntrack - -ctstate INVALID \
    783   -j LOG - -log-prefix "FIREWALL:INVALID "
    784 iptables -I INPUT 1 -p tcp -m conntrack - -ctstate INVALID -j DROP</literal></screen>
     782<screen><literal>iptables -I INPUT 0 -p tcp -m conntrack --ctstate INVALID \
     783  -j LOG --log-prefix "FIREWALL:INVALID "
     784iptables -I INPUT 1 -p tcp -m conntrack --ctstate INVALID -j DROP</literal></screen>
    785785
    786786        </listitem>
    … …  
    807807          </para>
    808808
    809 <screen><literal>iptables -A INPUT  -i WAN1 -p udp -s 0.0.0.0 - -sport 67 \
    810    -d 255.255.255.255 - -dport 68 -j ACCEPT</literal></screen>
     809<screen><literal>iptables -A INPUT  -i WAN1 -p udp -s 0.0.0.0 --sport 67 \
     810   -d 255.255.255.255 --dport 68 -j ACCEPT</literal></screen>
    811811
    812812        </listitem>
    … …  
    863863
    864864  </sect2>
    865 -->
     865
    866866  <sect2 role="content">
    867867    <title>Contents</title>
Note: See TracChangeset for help on using the changeset viewer.