Changeset 14c0be2f


Ignore:
Timestamp:
10/25/2019 06:28:45 AM (4 years ago)
Author:
DJ Lucas <dj@…>
Branches:
10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 9.1, kea, ken/inkscape-core-mods, lazarus, lxqt, plabs/python-mods, qt5new, trunk, upgradedb, xry111/intltool, xry111/soup3, xry111/test-20220226, xry111/xf86-video-removal
Children:
3d5a675
Parents:
6914a417
Message:

Add nftables-0.9.2. Fixes #4620.
Add firewalld-0.7.2.
Add libnftnl-1.1.4.
Add libmnl-1.0.4.
Add decorator-4.4.0.
Add python-slip-0.6.5.
Update to blfs-bootscripts-20191025.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@22301 af4574ff-66df-0310-9fd7-8a98e5e911e0

Files:
6 added
8 edited

Legend:

Unmodified
Added
Removed

  • general.ent

    r6914a417 r14c0be2f  
    11<!-- $LastChangedBy$ $Date$ -->
    22
    3 <!ENTITY day          "24">                   <!-- Always 2 digits -->
     3<!ENTITY day          "25">                   <!-- Always 2 digits -->
    44<!ENTITY month        "10">                   <!-- Always 2 digits -->
    55<!ENTITY year         "2019">
    … …  
    77<!ENTITY copyholder   "The BLFS Development Team">
    88<!ENTITY version      "&year;-&month;-&day;">
    9 <!ENTITY releasedate  "October 24th, &year;">
     9<!ENTITY releasedate  "October 25th, &year;">
    1010<!ENTITY pubdate      "&year;-&month;-&day;"> <!-- metadata req. by TLDP -->
    1111<!ENTITY blfs-version "svn">                  <!-- svn|[release #] -->
    … …  
    8383<!-- End LFS versions -->
    8484
    85 <!ENTITY blfs-bootscripts-version     "20190908">
     85<!ENTITY blfs-bootscripts-version     "20191025">
    8686<!ENTITY systemd-units-version        "20180105">
    8787

  • general/prog/python-modules.xml

    r6914a417 r14c0be2f  
    3737      <listitem>
    3838        <para>
     39          <xref linkend="decorator"/>
     40        </para>
     41      </listitem>
     42      <listitem>
     43        <para>
    3944          <xref linkend="docutils"/>
    4045        </para>
    … …  
    117122      <listitem>
    118123        <para>
     124          <xref linkend="python-slip"/>
     125        </para>
     126      </listitem>
     127      <listitem>
     128        <para>
    119129          <xref linkend="scour"/>
    120130        </para>
    … …  
    137147
    138148  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
     149    href="decorator.xml"/>
     150
     151  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
    139152    href="docutils.xml"/>
    140153
    … …  
    193206
    194207  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
     208    href="python-slip.xml"/>
     209
     210  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
    195211    href="pyyaml.xml"/>
    196212

  • introduction/welcome/changelog.xml

    r6914a417 r14c0be2f  
    4343       -->
    4444    <listitem>
     45      <para>October 25th, 2019</para>
     46      <itemizedlist>
     47        <listitem>
     48          <para>[dj] - Add nftables-0.9.2. Fixes
     49          <ulink url="&blfs-ticket-root;4620">#4620</ulink>.</para>
     50        </listitem>
     51        <listitem>
     52          <para>[dj] - Add firewalld-0.7.2.</para>
     53        </listitem>
     54        <listitem>
     55          <para>[dj] - Add libnftnl-1.1.4.</para>
     56        </listitem>
     57        <listitem>
     58          <para>[dj] - Add libmnl-1.0.4.</para>
     59        </listitem>
     60        <listitem>
     61          <para>[dj] - Add decorator-4.4.0.</para>
     62        </listitem>
     63        <listitem>
     64          <para>[dj] - Add python-slip-0.6.5.</para>
     65        </listitem>
     66        <listitem>
     67          <para>[dj] - Update to blfs-bootscripts-20191025.</para>
     68        </listitem>
     69      </itemizedlist>
     70    </listitem>
     71
     72    <listitem>
    4573      <para>October 24th, 2019</para>
    4674      <itemizedlist>

  • networking/netlibs/netlibs.xml

    r6914a417 r14c0be2f  
    2929  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="ldns.xml"/>
    3030  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="libevent.xml"/>
     31  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="libmnl.xml"/>
     32  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="libnftnl.xml"/>
    3133  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="libnl.xml"/>
    3234  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="libnsl.xml"/>

  • packages.ent

    r6914a417 r14c0be2f  
    1212<!ENTITY cyrus-sasl-version           "2.1.27">
    1313<!ENTITY gnupg2-version               "2.2.17">
     14<!ENTITY firewalld-version            "0.7.2">
    1415<!ENTITY gnutls-version               "3.6.10">
    1516<!ENTITY gpgme-version                "1.13.1">
    … …  
    2425<!ENTITY mitkrb-major-version         "1.17">
    2526<!ENTITY mitkrb-version               "1.17">
     27<!ENTITY nftables-version             "0.9.2">
    2628<!ENTITY nettle-version               "3.5.1">
    2729
    … …  
    516518<!ENTITY dbus-python-version          "1.2.12">
    517519<!-- <!ENTITY funcsigs-version             "1.0.2"> -->
     520<!ENTITY decorator-version            "4.4.0">
    518521<!ENTITY Jinja2-version               "2.10.3">
    519522<!-- libxml2 for Python2 shares the version of libxml2 -->
    … …  
    534537<!ENTITY scour-version                "0.37">
    535538<!ENTITY six-version                  "1.12.0">
     539<!ENTITY python-slip-version          "0.6.5">
    536540<!-- <!ENTITY setuptools-version           "30.2.0"> -->
    537541
    … …  
    578582<!ENTITY ldns-version                 "1.7.1">
    579583<!ENTITY libevent-version             "2.1.11">
     584<!ENTITY libmnl-version               "1.0.4">
     585<!ENTITY libnftnl-version             "1.1.4">
    580586<!ENTITY libnl-version                "3.5.0">
    581587<!ENTITY libnl-dl-version             "3_5_0">

  • postlfs/security/firewalling.xml

    r6914a417 r14c0be2f  
    1616  <title>Setting Up a Network Firewall</title>
    1717
    18   <para>Before you read this part of the chapter, you should have
    19   already installed iptables as described in the previous section.</para>
    20 
    2118  <sect2 id="fw-intro" xreflabel="Firewalling Introduction">
    2219    <title>Introduction to Firewall Creation</title>
    2320
    24     <para>The general purpose of a firewall is to protect a computer or
    25     a network against malicious access.</para>
    26 
    27     <para>In a perfect world, every daemon or service on every machine
    28     is perfectly configured and immune to flaws such as buffer overflows
    29     or other problems regarding its security. Furthermore, you trust
    30     every user accessing your services. In this world, you do not need
    31     to have a firewall.</para>
    32 
    33     <para>In the real world however, daemons may be misconfigured and
    34     exploits against essential services are freely available. You may
    35     wish to choose which services are accessible by certain machines or
    36     you may wish to limit which machines or applications are allowed
    37     external access. Alternatively, you may simply not trust some of
    38     your applications or users. You are probably connected to the
    39     Internet. In this world, a firewall is essential.</para>
    40 
    41     <para>Don't assume however, that having a firewall makes careful
    42     configuration redundant, or that it makes any negligent
    43     misconfiguration harmless. It doesn't prevent anyone from exploiting
    44     a service you intentionally offer but haven't recently updated or
    45     patched after an exploit went public.  Despite having a firewall, you
    46     need to keep applications and daemons on your system properly
    47     configured and up to date.  A firewall is not a cure all, but should
    48     be an essential part of your overall security strategy.</para>
     21    <para>
     22      The purpose of a firewall is to protect a computer or a network against
     23      malicious access. In a perfect world every daemon or service, on every
     24      machine, is perfectly configured and immune to security flaws, and all
     25      users are trusted implicitly to use the equipment as intended. However,
     26      this is rarely, if ever, the case. Daemons may be misconfigured, or
     27      updates may not have been applied for known exploits against essential
     28      services. Additionally, you may wish to choose which services are
     29      accessible by certain machines or users, or you may wish to limit which
     30      machines or applications are allowed external access. Alternatively, you
     31      simply may not trust some of your applications or users. For these
     32      reasons, a carefully designed firewall should be an essential part of
     33      system security.
     34    </para>
     35
     36    <para>
     37      While a firewall can greatly limit the scope of the above issues, do not
     38      assume that having a firewall makes careful configuration redundant, or
     39      that any negligent misconfiguration is harmless. A firewall does not
     40      prevent the exploitation of any service you offer outside of it. Despite
     41      having a firewall, you need to keep applications and daemons properly
     42      configured and up to date.
     43    </para>
    4944
    5045  </sect2>
    … …  
    5348    <title>Meaning of the Word "Firewall"</title>
    5449
    55     <para>The word firewall can have several different meanings.</para>
    56 
    57     <sect3>
    58       <title><xref linkend="fw-persFw"/></title>
    59 
    60       <para>This is a hardware device or software program commercially sold (or
    61       offered via freeware) by companies such as Symantec which claims that
    62       it secures a home or desktop computer connected to the Internet. This
    63       type of firewall is highly relevant for users who do not know how their
    64       computers might be accessed via the Internet or how to disable
    65       that access, especially if they are always online and connected
    66       via broadband links.</para>
    67 
    68     </sect3>
    69 
    70     <sect3>
    71       <title><xref linkend="fw-masqRouter"/></title>
    72 
    73       <para>This is a system placed between the Internet and an intranet.
    74       To minimize the risk of compromising the firewall itself, it should
    75       generally have only one role&mdash;that of protecting the intranet.
    76       Although not completely risk free, the tasks of doing the routing and
    77       IP masquerading (rewriting IP headers of the packets it routes from
    78       clients with private IP addresses onto the Internet so that they seem
    79       to come from the firewall itself) are commonly considered relatively
    80       secure.</para>
    81 
    82     </sect3>
    83 
    84     <sect3>
    85       <title><xref linkend="fw-busybox"/></title>
    86 
    87       <para>This is often an old computer you may have retired and nearly
    88       forgotten, performing masquerading or routing functions, but offering
    89       non-firewall services such as a web-cache or mail.  This may be used
    90       for home networks, but is not to be considered as secure as a firewall
    91       only machine because the combination of server and router/firewall on
    92       one machine raises the complexity of the setup.</para>
    93 
    94     </sect3>
    95 
    96     <sect3>
    97       <title>Firewall with a Demilitarized Zone [Not Further
    98       Described Here]</title>
    99 
    100       <para>This box performs masquerading or routing, but grants public
    101       access to some branch of your network which, because of public IPs
    102       and a physically separated structure, is essentially a separate
    103       network with direct Internet access. The servers on this network are
    104       those which must be easily accessible from both the Internet and
    105       intranet. The firewall protects both networks. This type of firewall
    106       has a minimum of three network interfaces.</para>
     50    <para>
     51      The word firewall can have several different meanings.
     52    </para>
     53
     54    <sect3>
     55      <title>Personal Firewall</title>
     56
     57      <para>
     58        This is a hardware device or software program, intended to secure a
     59        home or desktop computer connected to the Internet. This type of
     60        firewall is highly relevant for users who do not know how their
     61        computers might be accessed via the Internet or how to disable
     62        that access, especially if they are always online and connected
     63        via broadband links.
     64      </para>
     65
     66      <para>
     67        An example configuration for a personal firewall is provided at
     68        <xref linkend="fw-persFw-ipt"/>.
     69      </para>
     70
     71    </sect3>
     72
     73    <sect3>
     74      <title>Masquerading Router</title>
     75
     76      <para>
     77        This is a system placed between the Internet and an intranet.
     78        To minimize the risk of compromising the firewall itself, it should
     79        generally have only one role&mdash;that of protecting the intranet.
     80        Although not completely risk-free, the tasks of doing the routing and
     81        IP masquerading (rewriting IP headers of the packets it routes from
     82        clients with private IP addresses onto the Internet so that they seem
     83        to come from the firewall itself) are commonly considered relatively
     84        secure.
     85      </para>
     86
     87      <para>
     88        Example configurations for a masquerading firewall are provided at
     89        <xref linkend="fw-masqRouter-ipt"/> and
     90        <xref linkend="fw-masqRouter-nft"/>.
     91      </para>
     92
     93    </sect3>
     94
     95    <sect3>
     96      <title>BusyBox</title>
     97
     98      <para>
     99        This is often an old computer you may have retired and nearly
     100        forgotten, performing masquerading or routing functions, but offering
     101        non-firewall services such as a web-cache or mail. This may be used
     102        for home networks, but is not to be considered as secure as a firewall
     103        only machine because the combination of server and router/firewall on
     104        one machine raises the complexity of the setup.
     105      </para>
     106
     107      <para>
     108        An example configuration for a BusyBox is provided at
     109        <xref linkend="fw-busybox-ipt"/>.
     110      </para>
     111
     112    </sect3>
     113
     114    <sect3>
     115      <title>Firewall with a Demilitarized Zone</title>
     116
     117      <para>
     118        This type of firewall performs masquerading or routing, but grants
     119        public access to some branch of your network that is physically
     120        separated from your regular intranet and is essentially a separate
     121        network with direct Internet access. The servers on this network are
     122        those which must be easily accessible from both the Internet and
     123        intranet. The firewall protects both networks. This type of firewall
     124        has a minimum of three network interfaces.
     125      </para>
    107126
    108127    </sect3>
    … …  
    111130      <title>Packetfilter</title>
    112131
    113       <para>This type of firewall does routing or masquerading, but does
    114       not maintain a state table of ongoing communication streams. It is
    115       fast, but quite limited in its ability to block undesired packets
    116       without blocking desired packets.</para>
    117 
    118     </sect3>
    119 
    120   </sect2>
    121 
    122   <sect2 id="fw-writing" xreflabel="writing the firewalling-setup-scripts">
    123     <title>Now You Can Start to Build your Firewall</title>
     132      <para>
     133        This type of firewall does routing or masquerading but does
     134        not maintain a state table of ongoing communication streams. It is
     135        fast but quite limited in its ability to block undesired packets
     136        without blocking desired packets.
     137      </para>
     138
     139    </sect3>
     140
     141  </sect2>
     142
     143  <sect2>
     144    <title>Conclusion</title>
    124145
    125146    <caution>
    126       <para>This introduction on how to setup a firewall is not a
    127       complete guide to securing systems. Firewalling is a complex
    128       issue that requires careful configuration. The scripts quoted
    129       here are simply intended to give examples of how a firewall
    130       works. They are not intended to fit into any particular
    131       configuration and may not provide complete protection from
    132       an attack.</para>
    133 
    134       <para>Customization of these scripts for your specific situation
    135       will be necessary for an optimal configuration, but you should
    136       make a serious study of the iptables documentation and creating
    137       firewalls in general before hacking away. Have a look at the
    138       list of <xref linkend="fw-library"/> at the end of this section for
    139       more details. There you will find a list of URLs that contain quite
    140       comprehensive information about building your own firewall.</para>
     147      <para>
     148        The example configurations provided for <xref linkend="iptables"/> and
     149        <xref linkend="nftables"/> are not intended to be a complete guide to
     150        securing systems. Firewalling is a complex issue that requires careful
     151        configuration. The configurations provided by BLFS are intended only to
     152        give examples of how a firewall works. They are not intended to fit any
     153        particular configuration and may not provide complete protection from
     154        an attack.
     155      </para>
    141156    </caution>
    142157
    143     <para revision="sysv">The firewall configuration script installed in the
    144     iptables section differs from the standard configuration script. It only
    145     has two of the standard targets: start and status. The other targets are
    146     clear and lock. For instance if you issue:</para>
    147 
    148 <screen role="root" revision="sysv"><userinput>/etc/rc.d/init.d/iptables start</userinput></screen>
    149 
    150     <para revision="sysv">the firewall will be restarted just as it is upon
    151     system startup. The status target will present a list of all currently
    152     implemented rules. The clear target turns off all firewall rules and the
    153     lock target will block all packets in and out of the computer with the
    154     exception of the loopback interface.</para>
    155 
    156     <para revision="sysv">The main startup firewall is located in the file
    157     <filename>/etc/rc.d/rc.iptables</filename>. The sections below provide
    158     three different approaches that can be used for a system.</para>
    159 
    160     <para revision="systemd">The main startup firewall is located in the file
    161     <filename>/etc/systemd/scripts/iptables</filename>. The sections below
    162     provide three different approaches that can be used for a system.</para>
    163 
    164     <note>
    165       <para>You should always run your firewall rules from a script.
    166       This ensures consistency and a record of what was done. It also
    167       allows retention of comments that are essential for understanding
    168       the rules long after they were written.</para>
    169     </note>
    170 
    171     <sect3 id="fw-persFw" xreflabel="Personal Firewall">
    172       <title>Personal Firewall</title>
    173 
    174       <para>A Personal Firewall is designed to let you access all the
    175       services offered on the Internet, but keep your box secure and
    176       your data private.</para>
    177 
    178       <para>Below is a slightly modified version of Rusty Russell's
    179       recommendation from the <ulink
    180       url="http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html">
    181       Linux 2.4 Packet Filtering HOWTO</ulink>. It is still applicable
    182       to the Linux 2.6 kernels.</para>
    183 
    184 <screen role="root" revision="sysv"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
    185 <literal>#!/bin/sh
    186 
    187 # Begin rc.iptables
    188 
    189 # Insert connection-tracking modules
    190 # (not needed if built into the kernel)
    191 modprobe nf_conntrack
    192 modprobe xt_LOG
    193 
    194 # Enable broadcast echo Protection
    195 echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
    196 
    197 # Disable Source Routed Packets
    198 echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
    199 echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route
    200 
    201 # Enable TCP SYN Cookie Protection
    202 echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
    203 
    204 # Disable ICMP Redirect Acceptance
    205 echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects
    206 
    207 # Do not send Redirect Messages
    208 echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
    209 echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
    210 
    211 # Drop Spoofed Packets coming in on an interface, where responses
    212 # would result in the reply going out a different interface.
    213 echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
    214 echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
    215 
    216 # Log packets with impossible addresses.
    217 echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
    218 echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians
    219 
    220 # be verbose on dynamic ip-addresses  (not needed in case of static IP)
    221 echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
    222 
    223 # disable Explicit Congestion Notification
    224 # too many routers are still ignorant
    225 echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
    226 
    227 # Set a known state
    228 iptables -P INPUT   DROP
    229 iptables -P FORWARD DROP
    230 iptables -P OUTPUT  DROP
    231 
    232 # These lines are here in case rules are already in place and the
    233 # script is ever rerun on the fly. We want to remove all rules and
    234 # pre-existing user defined chains before we implement new rules.
    235 iptables -F
    236 iptables -X
    237 iptables -Z
    238 
    239 iptables -t nat -F
    240 
    241 # Allow local-only connections
    242 iptables -A INPUT  -i lo -j ACCEPT
    243 
    244 # Free output on any interface to any ip for any service
    245 # (equal to -P ACCEPT)
    246 iptables -A OUTPUT -j ACCEPT
    247 
    248 # Permit answers on already established connections
    249 # and permit new connections related to established ones
    250 # (e.g. port mode ftp)
    251 iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    252 
    253 # Log everything else. What's Windows' latest exploitable vulnerability?
    254 iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
    255 
    256 # End $rc_base/rc.iptables</literal>
    257 EOF
    258 chmod 700 /etc/rc.d/rc.iptables</userinput></screen>
    259 
    260 
    261 <screen role="root" revision="systemd"><?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts
    262 
    263 cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
    264 <literal>#!/bin/sh
    265 
    266 # Begin /etc/systemd/scripts/iptables
    267 
    268 # Insert connection-tracking modules
    269 # (not needed if built into the kernel)
    270 modprobe nf_conntrack
    271 modprobe xt_LOG
    272 
    273 # Enable broadcast echo Protection
    274 echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
    275 
    276 # Disable Source Routed Packets
    277 echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
    278 echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route
    279 
    280 # Enable TCP SYN Cookie Protection
    281 echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
    282 
    283 # Disable ICMP Redirect Acceptance
    284 echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects
    285 
    286 # Do not send Redirect Messages
    287 echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
    288 echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
    289 
    290 # Drop Spoofed Packets coming in on an interface, where responses
    291 # would result in the reply going out a different interface.
    292 echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
    293 echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
    294 
    295 # Log packets with impossible addresses.
    296 echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
    297 echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians
    298 
    299 # be verbose on dynamic ip-addresses  (not needed in case of static IP)
    300 echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
    301 
    302 # disable Explicit Congestion Notification
    303 # too many routers are still ignorant
    304 echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
    305 
    306 # Set a known state
    307 iptables -P INPUT   DROP
    308 iptables -P FORWARD DROP
    309 iptables -P OUTPUT  DROP
    310 
    311 # These lines are here in case rules are already in place and the
    312 # script is ever rerun on the fly. We want to remove all rules and
    313 # pre-existing user defined chains before we implement new rules.
    314 iptables -F
    315 iptables -X
    316 iptables -Z
    317 
    318 iptables -t nat -F
    319 
    320 # Allow local-only connections
    321 iptables -A INPUT  -i lo -j ACCEPT
    322 
    323 # Free output on any interface to any ip for any service
    324 # (equal to -P ACCEPT)
    325 iptables -A OUTPUT -j ACCEPT
    326 
    327 # Permit answers on already established connections
    328 # and permit new connections related to established ones
    329 # (e.g. port mode ftp)
    330 iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    331 
    332 # Log everything else. What's Windows' latest exploitable vulnerability?
    333 iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
    334 
    335 # End /etc/systemd/scripts/iptables</literal>
    336 EOF
    337 chmod 700 /etc/systemd/scripts/iptables</userinput></screen>
    338 
    339       <para>This script is quite simple, it drops all traffic coming
    340       into your computer that wasn't initiated from your computer, but
    341       as long as you are simply surfing the Internet you are unlikely
    342       to exceed its limits.</para>
    343 
    344       <para>If you frequently encounter certain delays at accessing
    345       FTP servers, take a look at <xref linkend="fw-BB-4"/>.</para>
    346 
    347       <para>Even if you have daemons or services running on your system,
    348       these will be inaccessible everywhere but from your computer itself.
    349       If you want to allow access to services on your machine, such as
    350       <command>ssh</command> or <command>ping</command>, take a look at
    351       <xref linkend="fw-busybox"/>.</para>
    352 
    353     </sect3>
    354 
    355     <sect3 id="fw-masqRouter" xreflabel="Masquerading Router">
    356       <title>Masquerading Router</title>
    357 
    358       <para>A true Firewall has two interfaces, one connected to an
    359       intranet, in this example <emphasis role="strong">eth0</emphasis>,
    360       and one connected to the Internet, here <emphasis
    361       role="strong">ppp0</emphasis>. To provide the maximum security
    362       for the firewall itself, make sure that there are no unnecessary
    363       servers running on it such as <application>X11</application> et
    364       al. As a general principle, the firewall itself should not access
    365       any untrusted service (think of a remote server giving answers that
    366       makes a daemon on your system crash, or even worse, that implements
    367       a worm via a buffer-overflow).</para>
    368 
    369 <screen role="root" revision="sysv"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
    370 <literal>#!/bin/sh
    371 
    372 # Begin rc.iptables
    373 
    374 echo
    375 echo "You're using the example configuration for a setup of a firewall"
    376 echo "from Beyond Linux From Scratch."
    377 echo "This example is far from being complete, it is only meant"
    378 echo "to be a reference."
    379 echo "Firewall security is a complex issue, that exceeds the scope"
    380 echo "of the configuration rules below."
    381 echo "You can find additional information"
    382 echo "about firewalls in Chapter 4 of the BLFS book."
    383 echo "http://www.&lfs-domainname;/blfs"
    384 echo
    385 
    386 # Insert iptables modules (not needed if built into the kernel).
    387 
    388 modprobe nf_conntrack
    389 modprobe nf_conntrack_ftp
    390 modprobe xt_conntrack
    391 modprobe xt_LOG
    392 modprobe xt_state
    393 
    394 # Enable broadcast echo Protection
    395 echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
    396 
    397 # Disable Source Routed Packets
    398 echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
    399 
    400 # Enable TCP SYN Cookie Protection
    401 echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
    402 
    403 # Disable ICMP Redirect Acceptance
    404 echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects
    405 
    406 # Don't send Redirect Messages
    407 echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
    408 
    409 # Drop Spoofed Packets coming in on an interface where responses
    410 # would result in the reply going out a different interface.
    411 echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
    412 
    413 # Log packets with impossible addresses.
    414 echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
    415 
    416 # Be verbose on dynamic ip-addresses  (not needed in case of static IP)
    417 echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
    418 
    419 # Disable Explicit Congestion Notification
    420 # Too many routers are still ignorant
    421 echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
    422 
    423 # Set a known state
    424 iptables -P INPUT   DROP
    425 iptables -P FORWARD DROP
    426 iptables -P OUTPUT  DROP
    427 
    428 # These lines are here in case rules are already in place and the
    429 # script is ever rerun on the fly. We want to remove all rules and
    430 # pre-existing user defined chains before we implement new rules.
    431 iptables -F
    432 iptables -X
    433 iptables -Z
    434 
    435 iptables -t nat -F
    436 
    437 # Allow local connections
    438 iptables -A INPUT  -i lo -j ACCEPT
    439 iptables -A OUTPUT -o lo -j ACCEPT
    440 
    441 # Allow forwarding if the initiated on the intranet
    442 iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    443 iptables -A FORWARD ! -i ppp+ -m conntrack --ctstate NEW       -j ACCEPT
    444 
    445 # Do masquerading
    446 # (not needed if intranet is not using private ip-addresses)
    447 iptables -t nat -A POSTROUTING -o ppp+ -j MASQUERADE
    448 
    449 # Log everything for debugging
    450 # (last of all rules, but before policy rules)
    451 iptables -A INPUT   -j LOG --log-prefix "FIREWALL:INPUT "
    452 iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
    453 iptables -A OUTPUT  -j LOG --log-prefix "FIREWALL:OUTPUT "
    454 
    455 # Enable IP Forwarding
    456 echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal>
    457 EOF
    458 chmod 700 /etc/rc.d/rc.iptables</userinput></screen>
    459 
    460 <screen role="root" revision="systemd"><?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts
    461 
    462 cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
    463 <literal>#!/bin/sh
    464 
    465 # Begin /etc/systemd/scripts/iptables
    466 
    467 echo
    468 echo "You're using the example configuration for a setup of a firewall"
    469 echo "from Beyond Linux From Scratch."
    470 echo "This example is far from being complete, it is only meant"
    471 echo "to be a reference."
    472 echo "Firewall security is a complex issue, that exceeds the scope"
    473 echo "of the configuration rules below."
    474 
    475 echo "You can find additional information"
    476 echo "about firewalls in Chapter 4 of the BLFS book."
    477 echo "http://www.&lfs-domainname;/blfs"
    478 echo
    479 
    480 # Insert iptables modules (not needed if built into the kernel).
    481 
    482 modprobe nf_conntrack
    483 modprobe nf_conntrack_ftp
    484 modprobe xt_conntrack
    485 modprobe xt_LOG
    486 modprobe xt_state
    487 
    488 # Enable broadcast echo Protection
    489 echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
    490 
    491 # Disable Source Routed Packets
    492 echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
    493 
    494 # Enable TCP SYN Cookie Protection
    495 echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
    496 
    497 # Disable ICMP Redirect Acceptance
    498 echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects
    499 
    500 # Don't send Redirect Messages
    501 echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
    502 
    503 # Drop Spoofed Packets coming in on an interface where responses
    504 # would result in the reply going out a different interface.
    505 echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
    506 
    507 # Log packets with impossible addresses.
    508 echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
    509 
    510 # Be verbose on dynamic ip-addresses  (not needed in case of static IP)
    511 echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
    512 
    513 # Disable Explicit Congestion Notification
    514 # Too many routers are still ignorant
    515 echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
    516 
    517 # Set a known state
    518 iptables -P INPUT   DROP
    519 iptables -P FORWARD DROP
    520 iptables -P OUTPUT  DROP
    521 
    522 # These lines are here in case rules are already in place and the
    523 # script is ever rerun on the fly. We want to remove all rules and
    524 # pre-existing user defined chains before we implement new rules.
    525 iptables -F
    526 iptables -X
    527 iptables -Z
    528 
    529 iptables -t nat -F
    530 
    531 # Allow local connections
    532 iptables -A INPUT  -i lo -j ACCEPT
    533 iptables -A OUTPUT -o lo -j ACCEPT
    534 
    535 # Allow forwarding if the initiated on the intranet
    536 iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    537 iptables -A FORWARD ! -i ppp+ -m conntrack --ctstate NEW       -j ACCEPT
    538 
    539 # Do masquerading
    540 # (not needed if intranet is not using private ip-addresses)
    541 iptables -t nat -A POSTROUTING -o ppp+ -j MASQUERADE
    542 
    543 # Log everything for debugging
    544 # (last of all rules, but before policy rules)
    545 iptables -A INPUT   -j LOG --log-prefix "FIREWALL:INPUT "
    546 iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
    547 iptables -A OUTPUT  -j LOG --log-prefix "FIREWALL:OUTPUT "
    548 
    549 # Enable IP Forwarding
    550 echo 1 &gt; /proc/sys/net/ipv4/ip_forward
    551 
    552 # End /etc/systemd/scripts/iptables</literal>
    553 EOF
    554 chmod 700 /etc/systemd/scripts/iptables</userinput></screen>
    555 
    556       <para>With this script your intranet should be reasonably secure
    557       against external attacks. No one should be able to setup a new
    558       connection to any internal service and, if it's masqueraded,
    559       makes your intranet invisible to the Internet. Furthermore, your
    560       firewall should be relatively safe because there are no services
    561       running that a cracker could attack.</para>
    562 
    563       <note>
    564         <para>If the interface you're connecting to the Internet
    565         doesn't connect via PPP, you will need to change
    566         <replaceable>&lt;ppp+&gt;</replaceable> to the name of the interface
    567         (e.g., <emphasis role="strong">eth1</emphasis>) which you are
    568         using.</para>
    569       </note>
    570 
    571     </sect3>
    572 
    573     <sect3 id="fw-busybox" xreflabel="BusyBox">
    574       <title>BusyBox</title>
    575 
    576       <para>This scenario isn't too different from the <xref
    577       linkend="fw-masqRouter"/>, but additionally offers some
    578       services to your intranet. Examples of this can be when
    579       you want to administer your firewall from another host on
    580       your intranet or use it as a proxy or a name server.</para>
    581 
    582       <note>
    583         <para>Outlining a true concept of how to protect a server that
    584         offers services on the Internet goes far beyond the scope of
    585         this document. See the references at the end of this section
    586         for more information.</para>
    587       </note>
    588 
    589       <para>Be cautious. Every service you have enabled makes your
    590       setup more complex and your firewall less secure. You are
    591       exposed to the risks of misconfigured services or running
    592       a service with an exploitable bug. A firewall should generally
    593       not run any extra services.  See the introduction to the
    594       <xref linkend="fw-masqRouter"/> for some more details.</para>
    595 
    596       <para>If you want to add services such as internal Samba or
    597       name servers that do not need to access the Internet themselves,
    598       the additional statements are quite simple and should still be
    599       acceptable from a security standpoint. Just add the following lines
    600       into the script <emphasis>before</emphasis> the logging rules.</para>
    601 
    602 <screen><literal>iptables -A INPUT  -i ! ppp+  -j ACCEPT
    603 iptables -A OUTPUT -o ! ppp+  -j ACCEPT</literal></screen>
    604 
    605       <para>If daemons, such as squid, have to access the Internet
    606       themselves, you could open OUTPUT generally and restrict
    607       INPUT.</para>
    608 
    609 <screen><literal>iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    610 iptables -A OUTPUT -j ACCEPT</literal></screen>
    611 
    612       <para>However, it is generally not advisable to leave OUTPUT
    613       unrestricted. You lose any control over trojans who would like
    614       to "call home", and a bit of redundancy in case you've
    615       (mis-)configured a service so that it broadcasts its existence
    616       to the world.</para>
    617 
    618       <para>To accomplish this, you should restrict INPUT and OUTPUT
    619       on all ports except those that it's absolutely necessary to have
    620       open. Which ports you have to open depends on your needs: mostly
    621       you will find them by looking for failed accesses in your log
    622       files.</para>
    623 
    624       <itemizedlist spacing="compact" role='iptables'>
    625         <title>Have a Look at the Following Examples:</title>
    626         <listitem>
    627           <para>Squid is caching the web:</para>
    628 
    629 <screen><literal>iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
    630 iptables -A INPUT  -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED \
    631   -j ACCEPT</literal></screen>
    632 
    633         </listitem>
    634         <listitem>
    635           <para>Your caching name server (e.g., named) does its
    636           lookups via UDP:</para>
    637 
    638 <screen><literal>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT</literal></screen>
    639 
    640         </listitem>
    641         <listitem>
    642           <para>You want to be able to ping your computer to
    643           ensure it's still alive:</para>
    644 
    645 <screen><literal>iptables -A INPUT  -p icmp -m icmp --icmp-type echo-request -j ACCEPT
    646 iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply   -j ACCEPT</literal></screen>
    647 
    648         </listitem>
    649         <listitem>
    650           <para id='fw-BB-4' xreflabel="BusyBox example number 4">If
    651           you are frequently accessing FTP servers or enjoy chatting, you might
    652           notice certain delays because some implementations of these daemons
    653           have the feature of querying an identd on your system to obtain
    654           usernames. Although there's really little harm in this, having an
    655           identd running is not recommended because many security experts feel
    656           the service gives out too much additional information.</para>
    657 
    658           <para>To avoid these delays you could reject the requests
    659           with a 'tcp-reset':</para>
    660 
    661 <screen><literal>iptables -A INPUT  -p tcp --dport 113 -j REJECT --reject-with tcp-reset</literal></screen>
    662 
    663         </listitem>
    664         <listitem>
    665           <para>To log and drop invalid packets (packets
    666           that came in after netfilter's timeout or some types of
    667           network scans) insert these rules at the top of the chain:</para>
    668 
    669 <screen><literal>iptables -I INPUT 0 -p tcp -m conntrack --ctstate INVALID \
    670   -j LOG --log-prefix "FIREWALL:INVALID "
    671 iptables -I INPUT 1 -p tcp -m conntrack --ctstate INVALID -j DROP</literal></screen>
    672 
    673         </listitem>
    674         <listitem>
    675           <para>Anything coming from the outside should not have a
    676           private address, this is a common attack called IP-spoofing:</para>
    677 
    678 <screen><literal>iptables -A INPUT -i ppp+ -s 10.0.0.0/8     -j DROP
    679 iptables -A INPUT -i ppp+ -s 172.16.0.0/12  -j DROP
    680 iptables -A INPUT -i ppp+ -s 192.168.0.0/16 -j DROP</literal></screen>
    681 
    682           <para>There are other addresses that you may also want to
    683           drop: 0.0.0.0/8, 127.0.0.0/8, 224.0.0.0/3 (multicast and
    684           experimental), 169.254.0.0/16 (Link Local Networks), and
    685           192.0.2.0/24 (IANA defined test network).</para>
    686         </listitem>
    687         <listitem>
    688           <para>If your firewall is a DHCP client, you need to allow
    689           those packets:</para>
    690 
    691 <screen><literal>iptables -A INPUT  -i ppp0 -p udp -s 0.0.0.0 --sport 67 \
    692    -d 255.255.255.255 --dport 68 -j ACCEPT</literal></screen>
    693 
    694         </listitem>
    695         <listitem>
    696           <para>To simplify debugging and be fair to anyone who'd like
    697           to access a service you have disabled, purposely or by mistake,
    698           you could REJECT those packets that are dropped.</para>
    699 
    700           <para>Obviously this must be done directly after logging as the very
    701           last lines before the packets are dropped by policy:</para>
    702 
    703 <screen><literal>iptables -A INPUT -j REJECT</literal></screen>
    704 
    705         </listitem>
    706       </itemizedlist>
    707 
    708       <para>These are only examples to show you some of the capabilities
    709       of the firewall code in Linux. Have a look at the man page of iptables.
    710       There you will find much more information. The port numbers needed for
    711       this can be found in <filename>/etc/services</filename>, in case you
    712       didn't find them by trial and error in your log file.</para>
    713 
    714     </sect3>
    715 
    716   </sect2>
    717 
    718   <sect2 id="fw-finale" xreflabel="Conclusion">
    719     <title>Conclusion</title>
    720 
    721     <para>Finally, there is one fact you must not forget: The effort spent
    722     attacking a system corresponds to the value the cracker expects to gain
    723     from it. If you are responsible for valuable information, you need to
    724     spend the time to protect it properly.</para>
    725 
    726   </sect2>
    727 
    728   <sect2 id="postlfs-security-fw-extra" xreflabel="Extra Information">
     158    <para>
     159      BLFS provides two utilities to manage the kernel Netfilter interface,
     160      <xref linkend="iptables"/> and <xref linkend="nftables"/>.
     161    </para>
     162
     163    <para>
     164      <xref linkend="iptables"/> has been around since early 2.4 kernels, and
     165      has been the standard since. If you plan not to use a configuration
     166      utility, this is likely the set of tools that will be most familiar to
     167      existing admins.
     168    </para>
     169
     170    <para>
     171      <xref linkend="nftables"/> is the successor to <xref linkend="iptables"/>
     172      and provies all of the same functionality with a single userspace tool,
     173      <command>nft</command>, that uses similar syntax to BSD's
     174      <application>pf</application> utility, and may be easier for new users or
     175      admins already familiar with that platform.
     176    </para>
     177
     178    <para>
     179      While both can be used in tandem, that is an advanced configuration and
     180      you should decide on one or the other. Both pages include very simple
     181      example configurations, and customization of the provided configurations
     182      for your specific environment will be necessary if you elect to use
     183      either without a configuration tool.
     184    </para>
     185
     186    <para>
     187      Additionally, a firewall management tool, <xref linkend="firewalld"/>, is
     188      provided to greatly ease firewall configuration for both simple and
     189      complex environments, and can be used with either tool. You should not
     190      use the example configurations if you intend to use
     191      <application>firewalld</application> to manage your firewall rules.
     192    </para>
     193
     194    <para>
     195      If you elect to configure manually, have a look at the
     196      list of further reading below for more details. Here you will find a
     197      list of URLs that contain comprehensive information about building
     198      firewalls and further securing your system.
     199    </para>
     200
     201  </sect2>
     202
     203  <sect2 id="fw-extra-info">
    729204    <title>Extra Information</title>
    730205
    731     <sect3 id="fw-library" xreflabel="links for further reading">
    732       <title>Where to Start with Further Reading on Firewalls</title>
     206    <sect3>
     207      <title>Further Reading on Firewalls</title>
    733208
    734209      <blockquote>
    735210        <literallayout>
    736 <ulink url="http://www.netfilter.org/">www.netfilter.org - Homepage of the netfilter/iptables project</ulink>
     211<ulink url="http://www.netfilter.org/">www.netfilter.org - Homepage of the netfilter/iptables/nftables projects</ulink>
    737212<ulink url="http://www.netfilter.org/documentation/FAQ/netfilter-faq.html">Netfilter related FAQ</ulink>
    738213<ulink url="http://www.netfilter.org/documentation/index.html#HOWTO">Netfilter related HOWTO's</ulink>
     214<ulink url="https://wiki.nftables.org/wiki-nftables/index.php/Main_Page">nftables HOWTO</ulink>
    739215<ulink url="http://en.tldp.org/LDP/nag2/x-087-2-firewall.html">en.tldp.org/LDP/nag2/x-087-2-firewall.html</ulink>
    740216<ulink url="http://en.tldp.org/HOWTO/Security-HOWTO.html">en.tldp.org/HOWTO/Security-HOWTO.html</ulink>
    … …  
    753229      </blockquote>
    754230
    755       <!-- The following are all dead links from the section above. They are
    756            moved out of the section so the literallayout won't produce blank
    757            lines in the rendered text
    758 
    759 <ulink url="http://www-106.ibm.com/developerworks/security/library/s-fire.html">www.ibm.com/developerworks/security/library/s-fire.html</ulink>
    760 <ulink url="http://www-106.ibm.com/developerworks/security/library/s-fire2.html">www.ibm.com/developerworks/security/library/s-fire2.html</ulink>
    761 <ulink url="http://www.interhack.net/pubs/fw-faq/">www.interhack.net/pubs/fw-faq/</ulink>
    762 <ulink url="http://www.linuxgazette.com/issue65/stumpel.html">www.linuxgazette.com/issue65/stumpel.html</ulink>
    763 <ulink url="http://www.linux-firewall-tools.com/linux/">www.linux-firewall-tools.com/linux/</ulink>
    764 <ulink url="http://logi.cc/linux/athome-firewall.php3">logi.cc/linux/athome-firewall.php3</ulink>
    765 <ulink url="http://www.robertgraham.com/pubs/firewall-seen.html">www.robertgraham.com/pubs/firewall-seen.html</ulink>
    766 
    767       -->
    768 
    769231    </sect3>
    770232

  • postlfs/security/iptables.xml

    r6914a417 r14c0be2f  
    1313]>
    1414
    15 <sect1 id="iptables" xreflabel="Iptables-&iptables-version;">
     15<sect1 id="iptables" xreflabel="iptables-&iptables-version;">
    1616  <?dbhtml filename="iptables.html"?>
    1717
    … …  
    2121  </sect1info>
    2222
    23   <title>Iptables-&iptables-version;</title>
     23  <title>iptables-&iptables-version;</title>
    2424
    2525  <indexterm zone="iptables">
    26     <primary sortas="a-Iptables">Iptables</primary>
     26    <primary sortas="a-iptables">iptables</primary>
    2727  </indexterm>
    2828
    2929  <sect2 role="package">
    30     <title>Introduction to Iptables</title>
    31 
    32     <para>
    33       The next part of this chapter deals with firewalls. The principal
    34       firewall tool for Linux is <application>Iptables</application>. You will
    35       need to install <application>Iptables</application> if you intend on using
    36       any form of a firewall.
     30    <title>Introduction to iptables</title>
     31
     32    <para>
     33      <application>iptables</application> is a userspace command line program
     34      used to configure Linux 2.4 and later kernel packet filtering ruleset.
    3735    </para>
    3836
    … …  
    7371    </itemizedlist>
    7472
    75     <bridgehead renderas="sect3">Iptables Dependencies</bridgehead>
     73    <bridgehead renderas="sect3">iptables Dependencies</bridgehead>
    7674
    7775    <bridgehead renderas="sect4">Optional</bridgehead>
    7876    <para role="optional">
    79       <ulink url="http://www.netfilter.org/projects/nftables/index.html">nftables</ulink>
     77      <xref linkend="nftables"/>
    8078    </para>
    8179
    … …  
    9088
    9189    <para>
    92       A firewall in Linux is accomplished through a portion of the
    93       kernel called netfilter. The interface to netfilter is
    94       <application>Iptables</application>. To use it, the appropriate
    95       kernel configuration parameters are found in:
     90      A firewall in Linux is accomplished through the netfilter interface. To
     91      use <application>iptables</application> to configure netfilter, the
     92      following kernel configuration parameters are required:
    9693    </para>
    9794
    9895<screen><literal>[*] Networking support  ---&gt;                                    [CONFIG_NET]
    9996      Networking Options  ---&gt;
    100         [*] Network packet filtering framework (Netfilter) ---&gt; [CONFIG_NETFILTER]</literal></screen>
     97        [*] Network packet filtering framework (Netfilter) ---&gt; [CONFIG_NETFILTER]
     98          Core Netfilter Configuration ---&gt;</literal></screen>
     99
     100    <para>
     101      Include any connection tracking protocols that will be used, as well as
     102      any protocols that you wish to use for match suppport under the
     103      "Core Netfilter Configuration" section.
     104    </para>
    101105
    102106    <indexterm zone="iptables iptables-kernel">
    103       <primary sortas="d-iptables">Iptables</primary>
     107      <primary sortas="d-iptables">iptables</primary>
    104108    </indexterm>
    105109
    … …  
    107111
    108112    <sect2 role="installation">
    109       <title>Installation of Iptables</title>
     113      <title>Installation of iptables</title>
    110114
    111115    <note>
    … …  
    119123        at the <application>Linux</application> source code. Note that if you
    120124        upgrade the kernel version, you may also need to recompile
    121         <application>Iptables</application> and that the BLFS team has not tested
    122         using the raw kernel headers.
    123       </para>
    124 
    125       <para>
    126         For some non-x86 architectures, the raw kernel headers may be
    127         required. In that case, modify the <parameter>KERNEL_DIR=</parameter>
    128         parameter to point at the <application>Linux</application> source
    129         code.
     125        <application>iptables</application> and that the BLFS team has not
     126        tested using the raw kernel headers.
    130127      </para>
    131128    </note>
    132129
    133130    <para>
    134       Install <application>Iptables</application> by running the following
     131      Install <application>iptables</application> by running the following
    135132      commands:
    136133    </para>
    … …  
    143140make</userinput></screen>
    144141
    145     <para>This package does not come with a test suite.</para>
    146 
    147     <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
     142    <para>
     143      This package does not come with a test suite.
     144    </para>
     145
     146    <para>
     147      Now, as the <systemitem class="username">root</systemitem> user:
     148    </para>
    148149
    149150<screen role="root"><userinput>make install &amp;&amp;
    … …  
    163164    <para>
    164165      <parameter>--disable-nftables</parameter>: This switch disables building
    165       nftables compat. Omit this switch if you have installed nftables.
     166      nftables compat. Omit this switch if you have installed
     167      <xref linkend="nftables"/>.
    166168    </para>
    167169
    … …  
    174176    <para>
    175177      <parameter>--with-xtlibdir=/lib/xtables</parameter>: Ensure all
    176       <application>Iptables</application> modules are installed in the
     178      <application>iptables</application> modules are installed in the
    177179      <filename class="directory">/lib/xtables</filename> directory.
    178180    </para>
    … …  
    191193
    192194  <sect2 role="configuration">
    193     <title>Configuring Iptables</title>
    194 
    195     <para>
    196       Introductory instructions for configuring your firewall are
    197       presented in the next section: <xref linkend="fw-firewall"/>
    198     </para>
     195    <title>Configuring iptables</title>
     196
     197    <note>
     198      <para>
     199        If you intend to use <xref linkend="firewalld"/> to configure your
     200        firewall rules, you should not use the example configurations provided
     201        here, nor should you enable the
     202        <phrase revision="sysv">bootscript</phrase>
     203        <phrase revision="systemd">systemd unit</phrase>.
     204      </para>
     205    </note>
     206
     207    <note>
     208      <para>
     209        In the follwoing example configurations, <emphasis
     210        role="strong">LAN1</emphasis> is used for the internal LAN interface,
     211        and <emphasis role="strong">WAN1</emphasis> is used for the external
     212        interace connected to the internet. You will need to replace these
     213        values with appropriate interface names for your system.
     214      </para>
     215    </note>
     216
     217    <sect3 id="fw-persFw-ipt"
     218    xreflabel="Creating a Personal Firewall With iptables">
     219      <title>Personal Firewall</title>
     220
     221      <para>
     222        A Personal Firewall is designed to let you access all the
     223        services offered on the Internet, but keep your box secure and
     224        your data private.
     225      </para>
     226
     227      <para>
     228        Below is a slightly modified version of Rusty Russell's
     229        recommendation from the <ulink
     230        url="http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html">
     231        Linux 2.4 Packet Filtering HOWTO</ulink>. It is still applicable
     232        to the Linux 3.x kernels.
     233      </para>
     234
     235<screen role="root" revision="sysv"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
     236<literal>#!/bin/sh
     237
     238# Begin rc.iptables
     239
     240# Insert connection-tracking modules
     241# (not needed if built into the kernel)
     242modprobe nf_conntrack
     243modprobe xt_LOG
     244
     245# Enable broadcast echo Protection
     246echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
     247
     248# Disable Source Routed Packets
     249echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
     250echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route
     251
     252# Enable TCP SYN Cookie Protection
     253echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
     254
     255# Disable ICMP Redirect Acceptance
     256echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects
     257
     258# Do not send Redirect Messages
     259echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
     260echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
     261
     262# Drop Spoofed Packets coming in on an interface, where responses
     263# would result in the reply going out a different interface.
     264echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
     265echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
     266
     267# Log packets with impossible addresses.
     268echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
     269echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians
     270
     271# be verbose on dynamic ip-addresses  (not needed in case of static IP)
     272echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
     273
     274# disable Explicit Congestion Notification
     275# too many routers are still ignorant
     276echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
     277
     278# Set a known state
     279iptables -P INPUT   DROP
     280iptables -P FORWARD DROP
     281iptables -P OUTPUT  DROP
     282
     283# These lines are here in case rules are already in place and the
     284# script is ever rerun on the fly. We want to remove all rules and
     285# pre-existing user defined chains before we implement new rules.
     286iptables -F
     287iptables -X
     288iptables -Z
     289
     290iptables -t nat -F
     291
     292# Allow local-only connections
     293iptables -A INPUT  -i lo -j ACCEPT
     294
     295# Free output on any interface to any ip for any service
     296# (equal to -P ACCEPT)
     297iptables -A OUTPUT -j ACCEPT
     298
     299# Permit answers on already established connections
     300# and permit new connections related to established ones
     301# (e.g. port mode ftp)
     302iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
     303
     304# Log everything else. What's Windows' latest exploitable vulnerability?
     305iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
     306
     307# End $rc_base/rc.iptables</literal>
     308EOF
     309chmod 700 /etc/rc.d/rc.iptables</userinput></screen>
     310
     311<screen role="root" revision="systemd"><?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts
     312
     313cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
     314<literal>#!/bin/sh
     315
     316# Begin /etc/systemd/scripts/iptables
     317
     318# Insert connection-tracking modules
     319# (not needed if built into the kernel)
     320modprobe nf_conntrack
     321modprobe xt_LOG
     322
     323# Enable broadcast echo Protection
     324echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
     325
     326# Disable Source Routed Packets
     327echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
     328echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route
     329
     330# Enable TCP SYN Cookie Protection
     331echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
     332
     333# Disable ICMP Redirect Acceptance
     334echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects
     335
     336# Do not send Redirect Messages
     337echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
     338echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
     339
     340# Drop Spoofed Packets coming in on an interface, where responses
     341# would result in the reply going out a different interface.
     342echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
     343echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
     344
     345# Log packets with impossible addresses.
     346echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
     347echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians
     348
     349# be verbose on dynamic ip-addresses  (not needed in case of static IP)
     350echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
     351
     352# disable Explicit Congestion Notification
     353# too many routers are still ignorant
     354echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
     355
     356# Set a known state
     357iptables -P INPUT   DROP
     358iptables -P FORWARD DROP
     359iptables -P OUTPUT  DROP
     360
     361# These lines are here in case rules are already in place and the
     362# script is ever rerun on the fly. We want to remove all rules and
     363# pre-existing user defined chains before we implement new rules.
     364iptables -F
     365iptables -X
     366iptables -Z
     367
     368iptables -t nat -F
     369
     370# Allow local-only connections
     371iptables -A INPUT  -i lo -j ACCEPT
     372
     373# Free output on any interface to any ip for any service
     374# (equal to -P ACCEPT)
     375iptables -A OUTPUT -j ACCEPT
     376
     377# Permit answers on already established connections
     378# and permit new connections related to established ones
     379# (e.g. port mode ftp)
     380iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
     381
     382# Log everything else. What's Windows' latest exploitable vulnerability?
     383iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
     384
     385# End /etc/systemd/scripts/iptables</literal>
     386EOF
     387chmod 700 /etc/systemd/scripts/iptables</userinput></screen>
     388
     389      <para>
     390        This script is quite simple, it drops all traffic coming
     391        into your computer that wasn't initiated from your computer, but
     392        as long as you are simply surfing the Internet you are unlikely
     393        to exceed its limits.
     394      </para>
     395
     396      <para>
     397        If you frequently encounter certain delays at accessing
     398        FTP servers, take a look at <xref linkend="fw-BB-4-ipt"/>.
     399      </para>
     400
     401      <para>
     402        Even if you have daemons or services running on your system,
     403        these will be inaccessible everywhere but from your computer itself.
     404        If you want to allow access to services on your machine, such as
     405        <command>ssh</command> or <command>ping</command>, take a look at
     406        <xref linkend="fw-busybox-ipt"/>.
     407      </para>
     408
     409    </sect3>
     410
     411    <sect3 id="fw-masqRouter-ipt"
     412     xreflabel="Creating a Masquerading Router With iptables">
     413      <title>Masquerading Router</title>
     414
     415      <para>
     416        A network Firewall has two interfaces, one connected to an
     417        intranet, in this example <emphasis role="strong">LAN1</emphasis>,
     418        and one connected to the Internet, here <emphasis
     419        role="strong">WAN1</emphasis>. To provide the maximum security
     420        for the firewall itself, make sure that there are no unnecessary
     421        servers running on it such as <application>X11</application> et al.
     422        As a general principle, the firewall itself should not access
     423        any untrusted service (think of a remote server giving answers that
     424        makes a daemon on your system crash, or even worse, that implements
     425        a worm via a buffer-overflow).
     426      </para>
     427
     428<screen role="root" revision="sysv"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
     429<literal>#!/bin/sh
     430
     431# Begin rc.iptables
     432
     433echo
     434echo "You're using the example configuration for a setup of a firewall"
     435echo "from Beyond Linux From Scratch."
     436echo "This example is far from being complete, it is only meant"
     437echo "to be a reference."
     438echo "Firewall security is a complex issue, that exceeds the scope"
     439echo "of the configuration rules below."
     440echo "You can find additional information"
     441echo "about firewalls in Chapter 4 of the BLFS book."
     442echo "http://www.&lfs-domainname;/blfs"
     443echo
     444
     445# Insert iptables modules (not needed if built into the kernel).
     446
     447modprobe nf_conntrack
     448modprobe nf_conntrack_ftp
     449modprobe xt_conntrack
     450modprobe xt_LOG
     451modprobe xt_state
     452
     453# Enable broadcast echo Protection
     454echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
     455
     456# Disable Source Routed Packets
     457echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
     458
     459# Enable TCP SYN Cookie Protection
     460echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
     461
     462# Disable ICMP Redirect Acceptance
     463echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects
     464
     465# Don't send Redirect Messages
     466echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
     467
     468# Drop Spoofed Packets coming in on an interface where responses
     469# would result in the reply going out a different interface.
     470echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
     471
     472# Log packets with impossible addresses.
     473echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
     474
     475# Be verbose on dynamic ip-addresses  (not needed in case of static IP)
     476echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
     477
     478# Disable Explicit Congestion Notification
     479# Too many routers are still ignorant
     480echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
     481
     482# Set a known state
     483iptables -P INPUT   DROP
     484iptables -P FORWARD DROP
     485iptables -P OUTPUT  DROP
     486
     487# These lines are here in case rules are already in place and the
     488# script is ever rerun on the fly. We want to remove all rules and
     489# pre-existing user defined chains before we implement new rules.
     490iptables -F
     491iptables -X
     492iptables -Z
     493
     494iptables -t nat -F
     495
     496# Allow local connections
     497iptables -A INPUT  -i lo -j ACCEPT
     498iptables -A OUTPUT -o lo -j ACCEPT
     499
     500# Allow forwarding if the initiated on the intranet
     501iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
     502iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW       -j ACCEPT
     503
     504# Do masquerading
     505# (not needed if intranet is not using private ip-addresses)
     506iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE
     507
     508# Log everything for debugging
     509# (last of all rules, but before policy rules)
     510iptables -A INPUT   -j LOG --log-prefix "FIREWALL:INPUT "
     511iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
     512iptables -A OUTPUT  -j LOG --log-prefix "FIREWALL:OUTPUT "
     513
     514# Enable IP Forwarding
     515echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal>
     516EOF
     517chmod 700 /etc/rc.d/rc.iptables</userinput></screen>
     518
     519<screen role="root" revision="systemd"><?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts
     520
     521cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
     522<literal>#!/bin/sh
     523
     524# Begin /etc/systemd/scripts/iptables
     525
     526echo
     527echo "You're using the example configuration for a setup of a firewall"
     528echo "from Beyond Linux From Scratch."
     529echo "This example is far from being complete, it is only meant"
     530echo "to be a reference."
     531echo "Firewall security is a complex issue, that exceeds the scope"
     532echo "of the configuration rules below."
     533
     534echo "You can find additional information"
     535echo "about firewalls in Chapter 4 of the BLFS book."
     536echo "http://www.&lfs-domainname;/blfs"
     537echo
     538
     539# Insert iptables modules (not needed if built into the kernel).
     540
     541modprobe nf_conntrack
     542modprobe nf_conntrack_ftp
     543modprobe xt_conntrack
     544modprobe xt_LOG
     545modprobe xt_state
     546
     547# Enable broadcast echo Protection
     548echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
     549
     550# Disable Source Routed Packets
     551echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
     552
     553# Enable TCP SYN Cookie Protection
     554echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
     555
     556# Disable ICMP Redirect Acceptance
     557echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects
     558
     559# Don't send Redirect Messages
     560echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
     561
     562# Drop Spoofed Packets coming in on an interface where responses
     563# would result in the reply going out a different interface.
     564echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
     565
     566# Log packets with impossible addresses.
     567echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
     568
     569# Be verbose on dynamic ip-addresses  (not needed in case of static IP)
     570echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
     571
     572# Disable Explicit Congestion Notification
     573# Too many routers are still ignorant
     574echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
     575
     576# Set a known state
     577iptables -P INPUT   DROP
     578iptables -P FORWARD DROP
     579iptables -P OUTPUT  DROP
     580
     581# These lines are here in case rules are already in place and the
     582# script is ever rerun on the fly. We want to remove all rules and
     583# pre-existing user defined chains before we implement new rules.
     584iptables -F
     585iptables -X
     586iptables -Z
     587
     588iptables -t nat -F
     589
     590# Allow local connections
     591iptables -A INPUT  -i lo -j ACCEPT
     592iptables -A OUTPUT -o lo -j ACCEPT
     593
     594# Allow forwarding if the initiated on the intranet
     595iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
     596iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW       -j ACCEPT
     597
     598# Do masquerading
     599# (not needed if intranet is not using private ip-addresses)
     600iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE
     601
     602# Log everything for debugging
     603# (last of all rules, but before policy rules)
     604iptables -A INPUT   -j LOG --log-prefix "FIREWALL:INPUT "
     605iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
     606iptables -A OUTPUT  -j LOG --log-prefix "FIREWALL:OUTPUT "
     607
     608# Enable IP Forwarding
     609echo 1 &gt; /proc/sys/net/ipv4/ip_forward
     610
     611# The following sections allow inbound packets for specific examples
     612# Uncomment the example lines and adjust as necessary
     613
     614# Allow ping on the external interface
     615#iptables -A INPUT  -p icmp -m icmp --icmp-type echo-request -j ACCEPT
     616#iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply   -j ACCEPT
     617
     618# Reject ident packets with TCP reset to avoid delays with FTP or IRC
     619#iptables -A INPUT  -p tcp --dport 113 -j REJECT --reject-with tcp-reset
     620
     621# Allow HTTP and HTTPS to 192.168.0.2
     622#iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 80 -j DNAT --to 192.168.0.2
     623#iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 443 -j DNAT --to 192.168.0.2
     624#iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 80 -j ACCEPT
     625#iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 443 -j ACCEPT
     626
     627# End /etc/systemd/scripts/iptables</literal>
     628EOF
     629chmod 700 /etc/systemd/scripts/iptables</userinput></screen>
     630
     631      <para>
     632        With this script your intranet should be reasonably secure
     633        against external attacks. No one should be able to setup a new
     634        connection to any internal service and, if it's masqueraded,
     635        makes your intranet invisible to the Internet. Furthermore, your
     636        firewall should be relatively safe because there are no services
     637        running that a cracker could attack.
     638      </para>
     639
     640    </sect3>
     641 
     642    <sect3 id="fw-busybox-ipt" xreflabel="Creating a BusyBox With iptables">
     643      <title>BusyBox</title>
     644
     645      <para>
     646        This scenario isn't too different from the <xref
     647        linkend="fw-masqRouter-ipt"/>, but additionally offers some
     648        services to your intranet. Examples of this can be when
     649        you want to administer your firewall from another host on
     650        your intranet or use it as a proxy or a name server.
     651      </para>
     652
     653      <note>
     654        <para>
     655          Outlining specifically how to protect a server that
     656          offers services on the Internet goes far beyond the scope of
     657          this document. See the references in <xref linkend="fw-extra-info"/>
     658          for more information.
     659        </para>
     660      </note>
     661
     662      <para>
     663        Be cautious. Every service you have enabled makes your
     664        setup more complex and your firewall less secure. You are
     665        exposed to the risks of misconfigured services or running
     666        a service with an exploitable bug. A firewall should generally
     667        not run any extra services.  See the introduction to the
     668        <xref linkend="fw-masqRouter-ipt"/> for some more details.
     669      </para>
     670
     671      <para>
     672        If you want to add services such as internal Samba or
     673        name servers that do not need to access the Internet themselves,
     674        the additional statements are quite simple and should still be
     675        acceptable from a security standpoint. Just add the following lines
     676        into the script <emphasis>before</emphasis> the logging rules.
     677      </para>
     678
     679<screen><literal>iptables -A INPUT  -i ! WAN1  -j ACCEPT
     680iptables -A OUTPUT -o ! WAN1  -j ACCEPT</literal></screen>
     681
     682      <para>
     683        If daemons, such as squid, have to access the Internet
     684        themselves, you could open OUTPUT generally and restrict
     685        INPUT.
     686      </para>
     687
     688<screen><literal>iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
     689iptables -A OUTPUT -j ACCEPT</literal></screen>
     690
     691      <para>
     692        However, it is generally not advisable to leave OUTPUT
     693        unrestricted. You lose any control over trojans who would like
     694        to "call home", and a bit of redundancy in case you've
     695        (mis-)configured a service so that it broadcasts its existence
     696        to the world.
     697      </para>
     698
     699      <para>
     700        To accomplish this, you should restrict INPUT and OUTPUT
     701        on all ports except those that it's absolutely necessary to have
     702        open. Which ports you have to open depends on your needs: mostly
     703        you will find them by looking for failed accesses in your log
     704        files.
     705      </para>
     706
     707      <itemizedlist spacing="compact" role='iptables'>
     708        <title>Have a Look at the Following Examples:</title>
     709        <listitem>
     710          <para>
     711            Squid is caching the web:
     712          </para>
     713
     714<screen><literal>iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
     715iptables -A INPUT  -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED \
     716  -j ACCEPT</literal></screen>
     717
     718        </listitem>
     719        <listitem>
     720          <para>
     721            Your caching name server (e.g., named) does its lookups via UDP:
     722          </para>
     723
     724<screen><literal>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT</literal></screen>
     725
     726        </listitem>
     727        <listitem>
     728          <para>
     729            You want to be able to ping your computer to ensure it's still
     730            alive:
     731          </para>
     732
     733<screen><literal>iptables -A INPUT  -p icmp -m icmp --icmp-type echo-request -j ACCEPT
     734iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply   -j ACCEPT</literal></screen>
     735
     736        </listitem>
     737        <listitem>
     738          <para id='fw-BB-4-ipt' xreflabel="BusyBox with iptable example number 4">
     739            If you are frequently accessing FTP servers or enjoy chatting, you
     740            might notice delays because some implementations of these daemons
     741            query an identd daemon on your system to obtain usernames. Although
     742            there's really little harm in this, having an identd running is not
     743            recommended because many security experts feel the service gives
     744            out too much additional information.
     745          </para>
     746
     747          <para>
     748            To avoid these delays you could reject the requests with a
     749            'tcp-reset' response:
     750          </para>
     751
     752<screen><literal>iptables -A INPUT  -p tcp --dport 113 -j REJECT --reject-with tcp-reset</literal></screen>
     753
     754        </listitem>
     755        <listitem>
     756          <para>
     757            To log and drop invalid packets (packets
     758            that came in after netfilter's timeout or some types of
     759            network scans) insert these rules at the top of the chain:
     760          </para>
     761
     762<screen><literal>iptables -I INPUT 0 -p tcp -m conntrack --ctstate INVALID \
     763  -j LOG --log-prefix "FIREWALL:INVALID "
     764iptables -I INPUT 1 -p tcp -m conntrack --ctstate INVALID -j DROP</literal></screen>
     765
     766        </listitem>
     767        <listitem>
     768          <para>
     769            Anything coming from the outside should not have a
     770            private address, this is a common attack called IP-spoofing:
     771          </para>
     772
     773<screen><literal>iptables -A INPUT -i WAN1 -s 10.0.0.0/8     -j DROP
     774iptables -A INPUT -i WAN1 -s 172.16.0.0/12  -j DROP
     775iptables -A INPUT -i WAN1 -s 192.168.0.0/16 -j DROP</literal></screen>
     776
     777          <para>
     778            There are other addresses that you may also want to drop:
     779            0.0.0.0/8, 127.0.0.0/8, 224.0.0.0/3 (multicast and
     780            experimental), 169.254.0.0/16 (Link Local Networks), and
     781            192.0.2.0/24 (IANA defined test network).
     782          </para>
     783        </listitem>
     784        <listitem>
     785          <para>
     786            If your firewall is a DHCP client, you need to allow those packets:
     787          </para>
     788
     789<screen><literal>iptables -A INPUT  -i WAN1 -p udp -s 0.0.0.0 --sport 67 \
     790   -d 255.255.255.255 --dport 68 -j ACCEPT</literal></screen>
     791
     792        </listitem>
     793        <listitem>
     794          <para>
     795            To simplify debugging and be fair to anyone who'd like
     796            to access a service you have disabled, purposely or by mistake,
     797            you could REJECT those packets that are dropped.
     798          </para>
     799
     800          <para>
     801            Obviously this must be done directly after logging as the very
     802            last lines before the packets are dropped by policy:
     803          </para>
     804
     805<screen><literal>iptables -A INPUT -j REJECT</literal></screen>
     806
     807        </listitem>
     808      </itemizedlist>
     809
     810      <para>
     811        These are only examples to show you some of the capabilities
     812        of the firewall code in Linux. Have a look at the man page of iptables.
     813        There you will find much more information. The port numbers needed for
     814        this can be found in <filename>/etc/services</filename>, in case you
     815        didn't find them by trial and error in your log file.
     816      </para>
     817
     818    </sect3>
    199819
    200820    <sect3  id="iptables-init">

  • postlfs/security/security.xml

    r6914a417 r14c0be2f  
    5454  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="gpgme.xml"/>
    5555  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="haveged.xml"/>
    56   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="iptables.xml"/>
    57   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="firewalling.xml"/>
    5856  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="libcap.xml"/>
    5957  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="linux-pam.xml"/>
    … …  
    7775  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="tripwire.xml"/>
    7876  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="volume_key.xml"/>
     77  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="firewalling.xml"/>
     78  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="iptables.xml"/>
     79  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="nftables.xml"/>
     80  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="firewalld.xml"/>
    7981
    8082</chapter>
Note: See TracChangeset for help on using the changeset viewer.