Nejaky odbornik na konfiguraci Debian Firewallu? (diskuse)

[#Tom]

Firewall (a celé iptables) se nastavují ve všech distribucích stejně. Nebo v Debianu jinak?

[Jáchym Čepický]

není -- nevzdávejte se a nainstalujte shorewall -- výborné textové rozhraní k iptables -- polopatistické návody tamtéž.

[anon123]

Diky vyzkousim, ale i tak schanim nejakeho profika.

[Dan Ohnesorg]

No ja nevim, jestli tomu rozumim, tak chcete povolit prijem posty. Nedovedu si predstavit na co je u toho potreba nejaky etxra odbornik. Proste je potreba povolit prichozi provoz na port 25 a hotovo. Tam celkem neni co resit.

Nejsnazsi je to asi udelat pres ten shorewall, sice vygeneruje jeste nejaka dalsi vesmes zbytecna pravidla, ale diky tomu, ze ma velmi formalni zapis konfigurace je snadne ho spravovat ve vice lidech, protoze kazdy na prvni pohled vidi co a jak je nastaveno.

[anon123]

Tak jste to asi spatne pochopil. Ja mluvim o vytvoreni firewallu. Ne domaciho jakoby firewallu. Firewall se vsim vsudy neni sranda. Clovek by mel dobre rozumet security.

[anon123]

Myslim, ze to nejsou jen iptables. Jsou i jine veci co se musi udelat, aby se zamezilo ostatnim vecem. To bych chtel take vysvetlit.

Na OpenBSD vychazime treba z tohoto. Ale delaji se dalsi upravy jak na tomto konfiguraku tak i v OpenBSD dalsim nastaveni v rc atd. Urcite se da vytvorit neco lepsiho, ale prave proto bych chtel odborny dozor.

[root@fern-fw1 /etc]# cat pf.conf
#       $OpenBSD: pf.conf,v 1.2 2005/06/26 22:58:31 smart Exp $
#
# See pf.conf(5) for syntax and examples

#pass out quick all
#pass in quick all


#--------------------------------------------------------------------------
#
# Liberally adapted from the pf man page, the OpenBSD "Network How-To",
# and my own rulesets.
#--------------------------------------------------------------------------

#--------------------------------------------------------------------------
# Definitions
Ext = "em0"            # External interface
Int = "bge0"             # Internal interface
Loop = "lo0"            # Loopback interface
IntNet="192.168.102.0/24" # Internal network

#Remote users

Trusted = "{ xxx.xxx.xxx.xxx }"
TrustedTCP = "{ ssh, 3389 }"

NoRoute = "{ 127.0.0.1/8, 172.16.0.0/12, 10.0.0.0/8, 255.255.255.255/32 }"

InServicesTCP = "{ smtp, pop3, http, https }"
InServicesUDP = "{ domain, 500 }"
OutServicesTCP = "{ http, https, smtp, pop3, whois, domain, ssh, telnet, ftp, ftp-data, nntp, auth, ntp }"
OutServicesUDP = "{ ntp, domain }"

XMMS = "{ 6000, 7500, 8000, 8004, 8044, 8034, 8052, 8038, 8010, 8400, 8014, 8026, 8048, \
          8002, 8024, 8028, 8080 }"
RealAudio = "{ 554, 7070, 8080 }"




#--------------------------------------------------------------------------
#--------------------------------------------------------------------------
# Clean up fragmented and abnormal packets
# By default in pf, packets which contain IP options are blocked. Good.
#scrub in on { $Ext, $Int } all
scrub all no-df
#--------------------------------------------------------------------------

#-------
# New Location of NAT rules for 3.2
#-------

nat on $Ext from $IntNet to any -> $Ext
rdr on $Ext proto tcp from any to $Ext port 3389 -> 192.168.102.3 port 3389

#Redirect the controlIT traffic
rdr on $Ext proto tcp from any to xxx.xxx.xxx.xxx/32 port 799 -> 192.168.169.1 port 799

pass in quick proto esp from any to any
pass out quick proto esp from any to any
pass in quick on enc0 from any to any
pass out quick on enc0 from any to any
pass in quick on $Ext proto udp from any port = 500 to any port = 500
pass out quick on $Ext proto udp from any port = 500 to any port = 500


#-------------------------------------------------------------------------
# Defaults
# block and log everything
block             out log on $Ext           all
block             in  log on $Ext           all
block return-rst  out log on $Ext proto tcp all
block return-rst  in  log on $Ext proto tcp all
block return-icmp out log on $Ext proto udp all
block return-icmp in  log on $Ext proto udp all

block in  quick inet6 all
block out quick inet6 all
#-------------------------------------------------------------------------

#--------------------------------------------------------------------------
# loopback packets left unmolested
pass in quick on $Loop all
pass out quick on $Loop all
#--------------------------------------------------------------------------
pass in quick on $Int all
pass out quick on $Int all
#--------------------------------------------------------------------------

#-------------------------------------------------------------------------
# Immediate blocks
# fuzz any 'nmap' attempt
block in log quick on $Ext inet proto tcp from any to any flags FUP/FUP
block in log quick on $Ext inet proto tcp from any to any flags SF/SFRA
block in log quick on $Ext inet proto tcp from any to any flags /SFRA

# don't allow anyone to spoof non-routeable addresses
block in log quick on $Ext from $NoRoute to any
block out log quick on $Ext from any to $NoRoute

# silently drop broadcasts (cable modem noise)
block in quick on $Ext from any to 255.255.255.255
#-------------------------------------------------------------------------




#-------------------------------------------------------------------------
# PASS rules

# ALL  -- we don't normally do that. For debugging only.
#pass out quick on $Ext all keep state

# pass in data mode connections for ftp-proxy running on this host.
#pass in quick on $Ext inet proto tcp from any to any port > 49151 flags S/SA keep state

# ICMP
pass out     quick on $Ext inet proto icmp all icmp-type 8 code 0 keep state
pass in  log quick on $Ext inet proto icmp all icmp-type 8 code 0 keep state

# Services we provide to the outside world
pass in quick on $Ext inet proto udp from any to any port $InServicesUDP keep state
pass in quick on $Ext inet proto tcp from any to any port $InServicesTCP flags S/SA keep state
pass in quick on $Ext inet proto tcp from $Trusted to any port $TrustedTCP flags S/SA keep state

# Standard services we want to access in the world
pass out quick on $Ext inet proto udp from any to any keep state
pass out quick on $Ext inet proto tcp from any to any flags S/SA keep state

# Special services
pass out quick on $Ext inet proto tcp from any to any port $XMMS flags S/SA modulate state
pass out quick on $Ext inet proto tcp from any to any port $RealAudio flags S/SA modulate state

[anon123]

Jinak je to trosku prasacky psany

[Jiří (BoodOk) Kadeřávek]

Dej sem telefonni cislo.

[Jiří (BoodOk) Kadeřávek]

Sorry, nevsiml jsem si posledni vety.

[anon123]

Email je kanour@softhome.net

Muzeme se i domluvit pres skype "linuxgo"