Ciao, ho scritto questo firewall:
#! /bin/bash
ipt=/usr/sbin/iptables
lanside=eth1
DMZ=eth2
iside=ppp0
server=192.168.2.1
modprobe iptable_filter
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_tables
modprobe ipt_mac
modprobe iptable_nat
modprobe ipt_MASQUERADE
modprobe ipt_limit
modprobe ip_queue
modprobe ipt_state
modprobe ipt_owner
modprobe ipt_REJECT
modprobe ipt_unclean
modprobe ipt_multiport
#ignora icmp echo indirizzati broadcast
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#previene gli attacchi di tipo syn flood
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
#permette lo scambio di pacchetto tra interfacce
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
#accetta il forwarding su tutte le interfacce
echo 1 > /proc/sys/net/ipv4/conf/all/forwarding
#controlli sul routing
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
#controlli sui pacchetti ICMP
echo 1 > /proc/sys/net/ipv4/conf/all/secure_redirects
echo 1 > /proc/sys/net/ipv4/conf/all/send_redirects
#non loggare pacchetti impazziti
echo 0 > /proc/sys/net/ipv4/conf/all/log_martians
#Abilitiamo il forward
echo "1" > /proc/sys/net/ipv4/ip_forward
$ipt -X
#cancella tutte le regole
$ipt -F INPUT
$ipt -F OUTPUT
$ipt -F FORWARD
#politicvhe di default
$ipt -P INPUT DROP
$ipt -P FORWARD DROP
$ipt -P OUTPUT DROP
#regole di natting
$ipt -t nat -A POSTROUTING -o $iside -j MASQUERADE
#$ipt -t nat -A PREROUTING -p tcp -dport 21 -i ppp0 -j DNAT --to-destionation $server
#$ipt -t nat -A PREROUTING -p tcp -dport 22 -i ppp0 -j DNAT --to-destionation $server
#$ipt -t nat -A PREROUTING -p tcp -dport 25 -i ppp0 -j DNAT --to-destionation $server
#$ipt -t nat -A PREROUTING -p tcp -dport 53 -i ppp0 -j DNAT --to-destionation $server
#$ipt -t nat -A PREROUTING -p tcp -dport 80 -i ppp0 -j DNAT --to-destionation $server
#$ipt -t nat -A PREROUTING -p tcp -dport 443 -i ppp0 -j DNAT --to-destionation $server
$ipt -A FORWARD -i $lanside -o $iside -j ACCEPT
$ipt -A FORWARD -i $iside -o $lanside -m state --state ESTABLISHED,RELATED -j ACCEPT
$ipt -A FORWARD -i $iside -o $lanside -j ACCEPT
$ipt -A INPUT -p tcp --dport 22 -s 192.168.1.2 -j ACCEPT
$ipt -A FORWARD -p tcp --dport 21 -i $iside -o $DMZ -j ACCEPT
$ipt -A FORWARD -p tcp --dport 22 -i $iside -o $DMZ -j ACCEPT
$ipt -A FORWARD -p tcp --dport 25 -i $iside -o $DMZ -j ACCEPT
$ipt -A FORWARD -p tcp --dport 53 -i $iside -o $DMZ -j ACCEPT
$ipt -A FORWARD -p tcp --dport 80 -i $iside -o $DMZ -j ACCEPT
$ipt -A FORWARD -p tcp --dport 443 -i $iside -o $DMZ -j ACCEPT
$ipt -A FORWARD -p tcp --dport 21 -i $lanside -o $DMZ -j ACCEPT
$ipt -A FORWARD -p tcp --dport 22 -i $lanside -o $DMZ -j ACCEPT
$ipt -A FORWARD -p tcp --dport 25 -i $lanside -o $DMZ -j ACCEPT
$ipt -A FORWARD -p tcp --dport 53 -i $lanside -o $DMZ -j ACCEPT
$ipt -A FORWARD -p tcp --dport 80 -i $lanside -o $DMZ -j ACCEPT
$ipt -A FORWARD -p tcp --dport 443 -i $lanside -o $DMZ -j ACCEPT
$ipt -A FORWARD -i $DMZ -m state --state ESTABLISHED -j ACCEPT
#accetta tutto sul loopback e sulla eth0. droppa pacchetti ping troppo grossi
$ipt -A INPUT -i ppp0 -p icmp --icmp-type 8 -m lenght 128:65535 -j drop
$ipt -A INPUT -s 127.0.0.1 -j ACCEPT
#Drop Spoofed Packets
$ipt -A INPUT -s 192.168.0.0/24 -i $iside -j DROP
$ipt -A INPUT -s 192.168.1.0/24 -i $iside -j DROP
$ipt -A INPUT -s 192.168.2.0/24 -i $iside -j DROP
# Drop icmp,ma ne permette soltanto alcuni e limita le echo request a 1 al secondo e al di sotto di 128 byte.
$ipt -A INPUT -p icmp --icmp-type 0 -j ACCEPT
$ipt -A INPUT -p icmp --icmp-type 3 -j ACCEPT
$ipt -A INPUT -p icmp --icmp-type 11 -j ACCEPT
$ipt -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
$ipt -A INPUT -i ppp0 -p icmp -m icmp --icmp-type 8 -m length --length 128:65535 -j DROP
echo "Firewall...... OK"
La mia rete è composta da 3 pc, il primo che ha il modem è collegato anche agli altri 2, uno che sarà un server linux ed uno un client windows...
La connessione adeso funziona perfettamente, solo che dal pc client non riesco ad accedere alla porta 22 del PC che ha questo firewall addosso. Ed inoltre non riesco neanche a pingarlo sia dall'esterno che dall'interno della rete...
Ultima cosa:
$ipt -A INPUT -i ppp0 -p icmp -m icmp --icmp-type 8 -m length --length 128:65535 -j DROP
mi da 2 errori su tutte e due le parole in cui ci sta length.
Qualcuno sa aiutarmi, Grazie Mille
Rispondi quotando
