Mainos / Advertisement:

Ero sivun ”Iptables/en” versioiden välillä

Kohteesta Taisto
Siirry navigaatioon Siirry hakuun
(Ak: Uusi sivu: Save IPv6 firewall settings in file)
(Ak: Uusi sivu: http://linux.fi/wiki/Iptables (Finnish))
 
(19 välissä olevaa versiota samalta käyttäjältä ei näytetä)
Rivi 102: Rivi 102:
  
  
=== Automaattinen palomuuriasetuksen lataus tiedostosta käynnistäessä ===
+
=== Automatic firewall settings restoration from file on startup ===
  
Iptables-persisten paketti on Wheezyssä, Jessiessä se löytyy nimellä netfilter-persistent.
+
Iptables-persistent packet can be found in Wheezy, in Jessie it can be found by the name netfilter-persistent.
  
Asenna pakettihallinnasta.
+
Install from packet manager.
  
 
   [[apt-get]] install iptables-persistent
 
   [[apt-get]] install iptables-persistent
  
Palomuuria voi konfiguroida täältä. Vain tänne tallennetut latautuvat käynnistyksen yhteydessä:
+
You can configure the firewall here. Only the changes made here will be loaded on bootup.
  
 
   nano /etc/iptables/rules.v4
 
   nano /etc/iptables/rules.v4
Rivi 116: Rivi 116:
 
   nano /etc/iptables/rules.v6
 
   nano /etc/iptables/rules.v6
  
Tallenna käytössä oleva palomuuri tiedostoon
+
Save currently used firewall to file
  
 
   service iptables-persistent save
 
   service iptables-persistent save
  
Lataa tiedostosta
+
Restore from file
  
 
   service iptables-persistent reload
 
   service iptables-persistent reload
Rivi 126: Rivi 126:
 
== IPv6 ==
 
== IPv6 ==
  
Ip6tables on Linuxilla palomuuri IPv6 verkkoon.
+
Ip6tables is the firewall for an IPv6 network.
  
Tässä on esimerkki palomuuriasetus jokaiselle.  
+
Here is a simple firewall configuration for general use.  
  
 
<pre>
 
<pre>
#Sallitaan paikallinen liikenne
+
#Allow local traffic
 
-A INPUT -i lo -j ACCEPT
 
-A INPUT -i lo -j ACCEPT
 
-A OUTPUT -o lo -j ACCEPT
 
-A OUTPUT -o lo -j ACCEPT
  
#Estä RH0 pakettien liikennöinti
+
#Block RH0 packet traffic
 
-A INPUT -m rt --rt-type 0 -j DROP
 
-A INPUT -m rt --rt-type 0 -j DROP
 
-A FORWARD -m rt --rt-type 0 -j DROP
 
-A FORWARD -m rt --rt-type 0 -j DROP
 
-A OUTPUT -m rt --rt-type 0 -j DROP
 
-A OUTPUT -m rt --rt-type 0 -j DROP
  
#Salli paikallisen verkon liikenne
+
#Allow local network traffic
 
-A INPUT -s fe80::/10 -j ACCEPT
 
-A INPUT -s fe80::/10 -j ACCEPT
 
-A OUTPUT -s fe80::/10 -j ACCEPT
 
-A OUTPUT -s fe80::/10 -j ACCEPT
Rivi 149: Rivi 149:
 
-A OUTPUT -p icmpv6 -j ACCEPT
 
-A OUTPUT -p icmpv6 -j ACCEPT
  
#Estetään SSH portti IPv6:lla. On suositeltavaa sallia tietyistä IPv6 osoitteista tai verkoista.
+
#Block the SSH port when using IPv6. It is recommended to make exceptions for certain addresses or networks, though.
 
-A INPUT -p tcp -m tcp --dport 22 -j DROP
 
-A INPUT -p tcp -m tcp --dport 22 -j DROP
  
Rivi 158: Rivi 158:
 
== NAT ==
 
== NAT ==
  
Määritä Linuxille kaksi verkkokorttia jossa molemmissa IP-osoitteet. Sisäverkon kortissa (eth0) tulee olla kiinteä IP-osoite. Tämä toimii verkon gateway:na. Julkisella kortilla (eth1) voi olla dynaaminen IP-osoite.
+
Define two NICs for Linux both with IP-addresses. The internal NIC (eth0) must have a static IP address. It functions as the networks gateway. The WAN NIC (eth1) can have a dynamic IP-address.
  
Salli IPv4 forwarders:
+
Allow IPv4 forwarders:
  
 
   nano /etc/sysctl.conf
 
   nano /etc/sysctl.conf
  
poistamalla risuaita:
+
Remove the number sign:
  
 
   net.ipv4.ip_forward=1
 
   net.ipv4.ip_forward=1
  
Ota muutokset käyttöön komennolla
+
Enable modifications with the command
  
 
   sysctl -p /etc/sysctl.conf
 
   sysctl -p /etc/sysctl.conf
  
Kirjoita seuraava rivi iptables sääntöihin. Suosittelemme käyttämään iptables-persistet pakettia.
+
Write the following line to your iptables rules. We suggest using the iptables-persistent packet.
  
 
  -A POSTROUTING -o eth1 -j MASQUERADE
 
  -A POSTROUTING -o eth1 -j MASQUERADE
  
Sisä interface sallitaan forwardoiminen eth0:sta eth1 interfaceen kunhan tila on related / established . Muuten liikenne estetään.
+
Internal interface allows forwarding from eth0 to eth1 when the state is related / established. Otherwise traffic is blocked.
  
 
  -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
 
  -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
 
  -A FORWARD -i eth0 -i eth1 -m state --state INVALID -j DROP
 
  -A FORWARD -i eth0 -i eth1 -m state --state INVALID -j DROP
  
== Lähde ==
+
== Sources ==
  
 
http://www.thomas-krenn.com/en/wiki/Saving_Iptables_Firewall_Rules_Permanently
 
http://www.thomas-krenn.com/en/wiki/Saving_Iptables_Firewall_Rules_Permanently
  
http://linux.fi/wiki/Iptables
+
http://linux.fi/wiki/Iptables (Finnish)

Nykyinen versio 28. elokuuta 2015 kello 06.50

Muut kielet:
English • ‎suomi

Iptables is a packet filter. It can be used in the same fashion as routers and firewalls.

Usage

We show the firewall rules

 iptables -L

Show blocked articles

 iptables -L -n

A more in-detail list

 iptables -L -v

You can add rules to Iptables with commands or by writing in a file. It is recommended to write the rules in a file, since when Linux shuts down it will clear all the rules made with commands, but not the ones written in a file. Saving command rules can be made possible with the iptables-persistent packet.

Adding rules with commands. For instance, allow local traffic:

 iptables -A INPUT -i lo -j ACCEPT

Basic firewall rules

This firewall is useful for general application. Copy this into a file and run the restoration command.

  *filter
  :INPUT DROP [0:0]
  :FORWARD ACCEPT [0:0]
  :OUTPUT ACCEPT [0:0]
  
  # Allow local traffic
  -A INPUT -i lo -j ACCEPT
  # First packet is a SYN bit. If not, block traffic.
  -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
  
  # Block broken packets
  -A INPUT -f -j DROP
  
  # Block XMAS packets
  -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
  
  # Block "NULL" packets
  -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
  
  # Throttle TCP RST (TCP RESET). 
  -A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/second --limit-burst 2 -j ACCEPT
  
  # Block all invalid packets
  -A INPUT -m state --state INVALID -j DROP
  -A FORWARD -m state --state INVALID -j DROP
  -A OUTPUT -m state --state INVALID -j DROP
  
  # Block forged packets
  -A INPUT -s 169.254.0.0/16 -j DROP
  -A INPUT -s 127.0.0.0/8 -j DROP
  -A INPUT -s 224.0.0.0/4 -j DROP
  -A INPUT -d 224.0.0.0/4 -j DROP
  -A INPUT -s 240.0.0.0/5 -j DROP
  -A INPUT -d 240.0.0.0/5 -j DROP
  -A INPUT -s 0.0.0.0/8 -j DROP
  -A INPUT -d 0.0.0.0/8 -j DROP
  -A INPUT -d 239.255.255.0/24 -j DROP
  -A INPUT -d 255.255.255.255 -j DROP
  
  # Blocking an ICMP attack, limited amount of requests
  -A INPUT -p icmp --icmp-type address-mask-request -j DROP
  -A INPUT -p icmp --icmp-type timestamp-request -j DROP
  -A INPUT -p icmp --icmp-type router-solicitation -j DROP
  -A INPUT -p icmp -m limit --limit 2/second -j ACCEPT
  
  # Allow SSH
  -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
 
  # Block SYN-FLOOD packets
  -A INPUT -p tcp -m state --state NEW -m limit --limit 50/second --limit-burst 50 -j ACCEPT
  -A INPUT -p tcp -m state --state NEW -j DROP
  
  # Allow trusted connections and block INVALID packets
  -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
  -A INPUT -m state --state INVALID -j DROP
  
  COMMIT

Saving and applying firewall configurations in a file

Save firewall configurations

 iptables-save > /etc/iptables/rules.v4

Restore firewall settings from file

 iptables-restore < /etc/iptables/rules.v4

Save IPv6 firewall settings in file

 ip6tables-save > /etc/iptables/rules.v6


Automatic firewall settings restoration from file on startup

Iptables-persistent packet can be found in Wheezy, in Jessie it can be found by the name netfilter-persistent.

Install from packet manager.

 apt-get install iptables-persistent

You can configure the firewall here. Only the changes made here will be loaded on bootup.

 nano /etc/iptables/rules.v4
 nano /etc/iptables/rules.v6

Save currently used firewall to file

 service iptables-persistent save

Restore from file

 service iptables-persistent reload

IPv6

Ip6tables is the firewall for an IPv6 network.

Here is a simple firewall configuration for general use.

#Allow local traffic
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

#Block RH0 packet traffic
-A INPUT -m rt --rt-type 0 -j DROP
-A FORWARD -m rt --rt-type 0 -j DROP
-A OUTPUT -m rt --rt-type 0 -j DROP

#Allow local network traffic
-A INPUT -s fe80::/10 -j ACCEPT
-A OUTPUT -s fe80::/10 -j ACCEPT
-A INPUT -d ff00::/8 -j ACCEPT
-A OUTPUT -d ff00::/8 -j ACCEPT

-A INPUT -p icmpv6 -j ACCEPT
-A OUTPUT -p icmpv6 -j ACCEPT

#Block the SSH port when using IPv6. It is recommended to make exceptions for certain addresses or networks, though.
-A INPUT -p tcp -m tcp --dport 22 -j DROP

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state INVALID -j DROP

NAT

Define two NICs for Linux both with IP-addresses. The internal NIC (eth0) must have a static IP address. It functions as the networks gateway. The WAN NIC (eth1) can have a dynamic IP-address.

Allow IPv4 forwarders:

 nano /etc/sysctl.conf

Remove the number sign:

 net.ipv4.ip_forward=1

Enable modifications with the command

 sysctl -p /etc/sysctl.conf

Write the following line to your iptables rules. We suggest using the iptables-persistent packet.

-A POSTROUTING -o eth1 -j MASQUERADE

Internal interface allows forwarding from eth0 to eth1 when the state is related / established. Otherwise traffic is blocked.

-A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -i eth1 -m state --state INVALID -j DROP

Sources

http://www.thomas-krenn.com/en/wiki/Saving_Iptables_Firewall_Rules_Permanently

http://linux.fi/wiki/Iptables (Finnish)

Mainos / Advertisement: