[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: your mail


On Thu, Jun 28, 2001 at 12:02:44PM +0200, Raffael Ferenc wrote:
> On Thu, Jun 28, 2001 at 08:50:49AM +0200, Michael Wood wrote:
> > e.g. Assuming you're using kernel 2.2.x here's a very simple and
> > very open firewall configuration:
> > 
> > # define constants
> > 
> > # set the default policy
> > ipchains -P input ACCEPT
> > ipchains -P forward ACCEPT
> > ipchains -P output ACCEPT
> I suggest ACCEPT as the default policy may become extremely
> dangerous if the firewall script doesn't run completely. I'd
> say that default policy should be DENY or REJECT, and the

Well, as I said, they guy has a router with NO firewalling at
the moment, so this script was just "a very simple and very
open" firewall script.  i.e. it's not really meant to do
anything other than stop one person from using anything other
than e-mail as long as they don't change their IP address or

Your point about leaving the firewall completely open if the
script doesn't finish is a good one.  (It would be nonsense if
the policy was DENY or REJECT, though :)

I would normally recommend that the policy be DENY or REJECT,
but in this case it's much easier to leave it as ACCEPT and add
a rule or two to block the abuser than try to find out exactly
all the protocols that need to be allowed and allow them all
individually or get him to install proxies for everything.

So, if the default policy is going to be ACCEPT, I suppose you
should do this:

	Set policy to DENY
	Clear old rules
	Delete old chains
	Set up rules you want
	Set policy to ACCEPT

If the policy is going to be DENY (or REJECT) just leave out the
last bit (i.e. don't set policy to ACCEPT.)

This way, if the script doesn't finish, the default will be

> following few lines should be placed before the default
> policies.
> > # clear old rules
> > ipchains -F
> > ipchains -X

No, unless your policy is ACCEPT.

If your policy is going to be DENY (but isn't yet) and you clear
all the rules, you have a completely open firewall until you do
set the policy, so there's a small window when you don't have a
firewall (unless you never run the script with the interfaces
already up.)

> Just another remark: there's a -l option in ipchains. It is a
> good idea to log specific attempts (unprivport attacks). This
> would look like this:
> ipchains -A input -p tcp -s any/0 1024:65535 -d $YOURSERVER 1024:65535 -j DENY -l

True.  But if you want to monitor things like this you'll most
likely want a much better firewall script than the one I
suggested :)

Michael Wood        | Tel: +27 21 762 0276 | http://www.kingsley.co.za/
wood@kingsley.co.za | Fax: +27 21 761 9930 | Kingsley Technologies

Reply to: