8. $BJd0d(B

   
$ netstat -tua
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 *:printer               *:*                     LISTEN     
tcp        0      0 bigcat:8000             *:*                     LISTEN     
tcp        0      0 *:time                  *:*                     LISTEN     
tcp        0      0 *:x11                   *:*                     LISTEN
tcp        0      0 *:http                  *:*                     LISTEN     
tcp        0      0 bigcat:domain           *:*                     LISTEN     
tcp        0      0 bigcat:domain           *:*                     LISTEN     
tcp        0      0 *:ssh                   *:*                     LISTEN     
tcp        0      0 *:631                   *:*                     LISTEN     
tcp        0      0 *:smtp                  *:*                     LISTEN     
tcp        0      1 dsl-78-199-139.s:1174   64.152.100.93:nntp      SYN_SENT   
tcp        0      1 dsl-78-199-139.s:1175   64.152.100.93:nntp      SYN_SENT   
tcp        0      1 dsl-78-199-139.s:1173   64.152.100.93:nntp      SYN_SENT   
tcp        0      0 dsl-78-199-139.s:1172   207.153.203.114:http    ESTABLISHED
tcp        1      0 dsl-78-199-139.s:1199   www.xodiax.com:http     CLOSE_WAIT 
tcp        0      0 dsl-78-199-139.sd:http  63.236.92.144:34197     TIME_WAIT
tcp      400      0 bigcat:1152             bigcat:8000             CLOSE_WAIT 
tcp     6648      0 bigcat:1162             bigcat:8000             CLOSE_WAIT 
tcp      553      0 bigcat:1164             bigcat:8000             CLOSE_WAIT 
udp        0      0 *:32768                 *:*                                
udp        0      0 bigcat:domain           *:*                                
udp        0      0 bigcat:domain           *:*                                
udp        0      0 *:631                   *:*                               

 

$ netstat -taun
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address      State
tcp        0      0 0.0.0.0:515             0.0.0.0:*            LISTEN     
tcp        0      0 127.0.0.1:8000          0.0.0.0:*            LISTEN     
tcp        0      0 0.0.0.0:37              0.0.0.0:*            LISTEN     
tcp        0      0 0.0.0.0:6000            0.0.0.0:*            LISTEN
tcp        0      0 0.0.0.0:80              0.0.0.0:*            LISTEN     
tcp        0      0 192.168.1.1:53          0.0.0.0:*            LISTEN     
tcp        0      0 127.0.0.1:53            0.0.0.0:*            LISTEN     
tcp        0      0 0.0.0.0:22              0.0.0.0:*            LISTEN     
tcp        0      0 0.0.0.0:631             0.0.0.0:*            LISTEN     
tcp        0      0 0.0.0.0:25              0.0.0.0:*            LISTEN     
tcp        0      1 169.254.179.139:1174    64.152.100.93:119    SYN_SENT   
tcp        0      1 169.254.179.139:1175    64.152.100.93:119    SYN_SENT   
tcp        0      1 169.254.179.139:1173    64.152.100.93:119    SYN_SENT   
tcp        0      0 169.254.179.139:1172    207.153.203.114:80   ESTABLISHED
tcp        1      0 169.254.179.139:1199    216.26.129.136:80    CLOSE_WAIT 
tcp        0      0 169.254.179.139:80      63.236.92.144:34197  TIME_WAIT 
tcp      400      0 127.0.0.1:1152          127.0.0.1:8000       CLOSE_WAIT 
tcp     6648      0 127.0.0.1:1162          127.0.0.1:8000       CLOSE_WAIT 
tcp      553      0 127.0.0.1:1164          127.0.0.1:8000       CLOSE_WAIT 
udp        0      0 0.0.0.0:32768           0.0.0.0:*                    
udp        0      0 192.168.1.1:53          0.0.0.0:*                      
udp        0      0 127.0.0.1:53            0.0.0.0:*                     
udp        0      0 0.0.0.0:631             0.0.0.0:*          
   
 

 tcp        0      0 0.0.0.0:515            0.0.0.0:*          LISTEN     

 

 tcp        0      0 127.0.0.1:8000         0.0.0.0:*          LISTEN     

 

 tcp        0      0 0.0.0.0:37             0.0.0.0:*           LISTEN     
 tcp        0      0 0.0.0.0:6000           0.0.0.0:*           LISTEN
 tcp        0      0 0.0.0.0:80             0.0.0.0:*           LISTEN     

 

 tcp        0      0 192.168.1.1:53         0.0.0.0:*           LISTEN     
 tcp        0      0 127.0.0.1:53           0.0.0.0:*           LISTEN     

 

 tcp        0      0 0.0.0.0:22             0.0.0.0:*           LISTEN     
 tcp        0      0 0.0.0.0:631            0.0.0.0:*           LISTEN     
 tcp        0      0 0.0.0.0:25             0.0.0.0:*           LISTEN     

 

 tcp        0      1 169.254.179.139:1174    64.152.100.93:119    SYN_SENT   
 tcp        0      1 169.254.179.139:1175    64.152.100.93:119    SYN_SENT    
 tcp        0      1 169.254.179.139:1173    64.152.100.93:119    SYN_SENT   
 tcp        0      0 169.254.179.139:1172    207.153.203.114:80   ESTABLISHED
 tcp        1      0 169.254.179.139:1199    216.26.129.136:80    CLOSE_WAIT 
 tcp        0      0 169.254.179.139:80      63.236.92.144:34197  TIME_WAIT 
 tcp      400      0 127.0.0.1:1152          127.0.0.1:8000       CLOSE_WAIT 
 tcp     6648      0 127.0.0.1:1162          127.0.0.1:8000       CLOSE_WAIT 
 tcp      553      0 127.0.0.1:1164          127.0.0.1:8000       CLOSE_WAIT 

 

 udp        0      0 0.0.0.0:32768          0.0.0.0:*                    
 udp        0      0 192.168.1.1:53         0.0.0.0:*                      
 udp        0      0 127.0.0.1:53           0.0.0.0:*                     
 udp        0      0 0.0.0.0:631            0.0.0.0:*          

 

#!/bin/sh
#
# ipchains.sh
#
# An example of a simple ipchains configuration. This script 
# can enable 'masquerading' and will open user definable ports.
# $BC1=c$J(B ipchains $B@_Dj$NNc!#$3$N%9%/%j%W%H$O!V%^%9%+%l!<%G%#%s%0!W(B
# $B$,2DG=$G!"%f!<%6Dj5A%]!<%H$r3+$/!#(B
###################################################################
# Begin variable declarations and user configuration options ######
# $BJQ?t@k8@$H%f!<%6@_Dj%*%W%7%g%s(B
# Set the location of ipchains (default).
# ipchains $B!J%G%U%)%k%H!K$N>l=j$r@_Dj!#(B
IPCHAINS=/sbin/ipchains

# Local Interfaces
# $B%m!<%+%k%$%s%?!<%U%'!<%9(B
# This is the WAN interface, that is our link to the outside world.
# $B$3$l$O(B WAN $B%$%s%?!<%U%'!<%9!"30$N@$3&$K2f!9$r$D$J$2$k!#(B
# For pppd and pppoe users.
# pppd $B$H(B pppoe $B%f!<%6$N$?$a!#(B
# WAN_IFACE="ppp0"
WAN_IFACE="eth0"
#
# Local Area Network (LAN) interface.
# $B%m!<%+%k%(%j%"%M%C%H%o!<%/(B(LAN)$B%$%s%?!<%U%'!<%9(B
#LAN_IFACE="eth0"
LAN_IFACE="eth1"

# Our private LAN address(es), for masquerading.
# $B2f!9$N%W%i%$%Y!<%H(B LAN $B%"%I%l%9!J$?$A!K!"%^%9%+%l!<%G%#%s%0$N$?$a$N!#(B
LAN_NET="192.168.1.0/24"

# For static IP, set it here! 
# $B%9%?%F%#%C%/(B IP $B$N$?$a!#$3$3$G@_Dj$;$h!*(B
#WAN_IP="1.2.3.4"

# Set a list of public server port numbers here...not too many!
# These will be open to the world, so use caution. The example is
# sshd, and HTTP (www). Any services included here should be the
# latest version available from your vendor. Comment out to disable
# all PUBLIC services.
# $B$3$3$G%Q%V%j%C%/%5!<%P$N%]!<%HHV9f$N%j%9%H$r@_Dj!#B?$9$.$J$$$h$&$K!*(B
# $B$3$l$i$O@$3&$K8~$1$F3+$+$l$k$N$G!"MWCm0U!#$3$NNc$O(B sshd, HTTP(www).
# $B$3$3$N$I$N%5!<%t%#%9$b%t%'%s%@$N:G?7%P!<%8%g%s$K$9$Y$-!#(B
# $BA4$F$N%Q%V%j%C%/%5!<%t%#%9$rIT2DG=$K$9$k$?$a$K$O%3%a%s%H%"%&%H$;$h!#(B
#PUBLIC_PORTS="22 80 443"
PUBLIC_PORTS="22"

# If we want to do port forwarding, this is the host 
# that will be forwarded to.
# $B$b$7%]!<%H%U%)%o!<%G%#%s%0$7$?$$$J$i!"$3$l$,%U%)%o!<%I$5$l$k@h$N%[%9%H(B
#FORWARD_HOST="192.168.1.3"

# A list of ports that are to be forwarded. 
# $B%U%)%o!<%I$5$l$k$Y$-%]!<%H$N%j%9%H(B
#FORWARD_PORTS="25  80"

# If you get your public IP address via DHCP, set this.
# $B$b$7(B DHCP $B$rDL$8$F%Q%V%j%C%/$J(B IP $B%"%I%l%9$r@_Dj$9$k$J$i!"$3$3$G!#(B
DHCP_SERVER=66.21.184.66

# If you need identd for a mail server, set this.
# $B%a%$%k%5!<%P$N$?$a$K(B identd $B$,I,MW$J$i$3$3$G!#(B
MAIL_SERVER=

# A list of unwelcome hosts or nets. These will be denied access 
# to everything, even our 'PUBLIC' services. Provide your own list.
# $BK>$^$L5R$N%[%9%H$H%M%C%H$N%j%9%H!#$3$l$i$OA4$F$X$N%"%/%;%9!"(B
# $B2f!9$N%Q%V%j%C%/%5!<%t%#%9$5$($b!"5qH]$5$l$k(B
# $B<+J,<+?H$N%j%9%H$rMQ0U$;$h!#(B
#BLACKLIST="11.22.33.44 55.66.77.88"

# A list of "trusted" hosts and/or nets. These will have access to 
# ALL protocols, and ALL open ports. Be selective here.
# $B!V?.MQ$G$-$k!W%[%9%H$H(B/$B$^$?$O%M%C%H$N%j%9%H!#$3$l$i$OA4$F$N(B
# $B%W%m%H%3%k$HA4$F$N3+$$$?%]!<%H$K%"%/%;%9$G$-$k!#(B
# $B$3$l$O@:A*$7$F!#(B
#TRUSTED="1.2.3.4/8  5.6.7.8"

## end user configuration options #################################
## $B%(%s%I%f!<%6@_Dj%*%W%7%g%s(B
###################################################################

# The high ports used mostly for connections we initiate and return
# traffic.
# $B%H%i%U%#%C%/$r=i4|2=!"JV?.$N$?$a$N@\B3$Kl=j$+$i$NA4$F$N%"%I%l%9(B
ANYWHERE="0/0"

# Start building chains and rules #################################
# $B%A%'%$%s$H5,B'$N@_Dj$N;O$^$j(B
# Let's start clean and flush all chains to an empty state.
# $B$^$:A4$F$N%A%'%$%s$r6u$N>uBV$K!#(B
$IPCHAINS -F  

# Set the default policies of the built-in chains. If no match for any 
# of the rules below, these will be the defaults that ipchains uses.
# $BAH$_9~$_$N%A%'%$%s$N%G%U%)%k%H%]%j%7!<$r@_Dj!#0J2<$N%k!<%k$N$I$l$K$b(B
# $B0lCW$7$J$1$l$P!"$3$l$i$,(B ipchains $B$N;H$&%G%U%)%k%H$K$J$k!#(B
$IPCHAINS -P forward DENY
$IPCHAINS -P output ACCEPT
$IPCHAINS -P input DENY 

# Accept localhost/loopback traffic.
# localhost/loopback $B%H%i%U%#%C%/$re$,$C$F$$$J$/$F$b!"$3$3$K$*$$$F$$$k$N$G!"(B
# $B%G%U%)%k%H$N%]%j%7!<$,=`Hw$5$l$k!#(B
[ -z "$WAN_IP" ] &&\
  WAN_IP=`ifconfig $WAN_IFACE |grep inet |cut -d : -f 2 |cut -d \  -f 1`

# Bail out with error message if no IP available! Default policy is 
# already set, so all is not lost here.
# $B$I$N(B IP $B$b2DG=$G$J$$$J$i%(%i!<%a%C%;!<%8$H$H$b$KH4$1=P$k!#(B
# $B%G%U%)%k%H%]%j%7!<$O4{$K@_Dj$5$l$F$$$k$N$G!"$9$Y$F$,$3$3$G(B
# $B<:$o$l$k$o$1$G$O$J$$!#(B
[ -z "$WAN_IP" ] && echo "$WAN_IFACE not configured, aborting." && exit 1

WAN_MASK=`ifconfig $WAN_IFACE | grep Mask | cut -d : -f 4`
WAN_NET="$WAN_IP/$WAN_MASK"

## Reserved IPs:
#$B!!M=Ls(B IP:
# We should never see these private addresses coming in from outside 
# to our external interface.
# $B30It$+$i2f!9$N30It%$%s%?!<%U%'!<%9$X!"$3$l$i$N%W%i%$%Y!<%H%"%I%l%9$,(B
# $BF~$C$F$/$k$3$H$O7h$7$F$"$k$Y$-$G$O$J$$!#(B
$IPCHAINS -A input -l -i $WAN_IFACE -s 10.0.0.0/8     -j DENY
$IPCHAINS -A input -l -i $WAN_IFACE -s 172.16.0.0/12  -j DENY
$IPCHAINS -A input -l -i $WAN_IFACE -s 192.168.0.0/16 -j DENY
$IPCHAINS -A input -l -i $WAN_IFACE -s 127.0.0.0/8    -j DENY
$IPCHAINS -A input -l -i $WAN_IFACE -s 169.254.0.0/16 -j DENY
$IPCHAINS -A input -l -i $WAN_IFACE -s 224.0.0.0/4    -j DENY
$IPCHAINS -A input -l -i $WAN_IFACE -s 240.0.0.0/5    -j DENY
# Bogus routing
# $B56$b$N$N%k!<%F%#%s%0(B
$IPCHAINS -A input -l -s 255.255.255.255 -d $ANYWHERE -j DENY

## LAN access and masquerading
# LAN $B%"%/%;%9$H%^%9%+%l!<%G%#%s%0(B
#
# Allow connections from our own LAN's private IP addresses via the LAN
# interface and set up forwarding for masqueraders if we have a LAN_NET
# defined above. 
# LAN $B%$%s%?!<%U%'%9$rDL$8$F$N!"2f!9<+?H$N(B LAN $B$N%W%i%$%Y!<%H(B IP $B%"%I%l%9(B
# $B$+$i$N@\B3$r5v2D$7!">e$G(B LAN_NET $B$,Dj5A$5$l$F$$$l$P%^%9%+%l!<%@!<$N(B
# $B%U%)%o!<%G%#%s%0$r@_Dj$9$k!#(B
if [ -n "$LAN_NET" ]; then 
 echo 1 > /proc/sys/net/ipv4/ip_forward
 $IPCHAINS -A input  -i $LAN_IFACE  -j ACCEPT
 $IPCHAINS -A forward -s $LAN_NET -d $LAN_NET -j ACCEPT
 $IPCHAINS -A forward  -s $LAN_NET -d ! $LAN_NET -j MASQ
fi

## Blacklist hosts/nets
# $B%V%i%C%/%j%9%H(B hosts/nets
#
# Get the blacklisted hosts/nets out of the way, before we start opening 
# up any services. These will have no access to us at all, and will be
# logged.
# $B%V%i%C%/%j%9%H$K$N$C$?%[%9%H(B/$B%M%C%H$r!"$I$N%5!<%t%#%9$b3+$+$l(B
# $B$kA0$KJD$a=P$9!#$3$l$i$O$^$C$?$/2f!9$K%"%/%;%9$r;}$?$:!"(B
# $B%m%0$r$H$i$l$k!#(B
for i in $BLACKLIST; do
 $IPCHAINS -A input -l -s $i -j DENY
done

## Trusted hosts/nets
# $B?.MQ$G$-$k%[%9%H(B/$B%M%C%H(B
#
# This is our trusted host list. These have access to everything.
# $B?.MQ$9$k%[%9%H$N%j%9%H!#$3$l$i$OA4$F$X$N%"%/%;%98"$r;}$D!#(B
for i in $TRUSTED; do
 $IPCHAINS -A input -s $i -j ACCEPT
done

# Port Forwarding
# $B%]!<%H%U%)%o!<%G%#%s%0(B
#
# Which ports get forwarded to which host. This is one to one 
# port mapping (ie 80 -> 80) in this case.
# NOTE: ipmasqadm is a separate package from ipchains and needs 
# to be installed also. Check first!
# $B$I$N%]!<%H$,$I$N%[%9%H$X%U%)%o!<%I$5$l$k$+!#$3$l$O$3$N>l9g(B
# $B0lBP0l$N%^%C%T%s%0!J$D$^$j!"(B80 $B$+$i(B 80 $B$X!K!#(B
# $BCm0U!'(B ipmasqadm $B$O(B ipchains $B$H$OJL$N%Q%C%1!<%8$G!"$3$l$b(B
# $B%$%s%9%H!<%k$9$kI,MW$,$"$k!#$^$:%A%'%C%/$9$k$3$H!#(B
[ -n "$FORWARD_HOST" ] && ipmasqadm portfw -f &&\
 for i in $FORWARD_PORTS; do
   ipmasqadm portfw -a -P tcp -L $WAN_IP $i -R $FORWARD_HOST $i
 done

## Open, but Restricted Access ports/services
# $B3+$$$?!"$7$+$7@)8B$5$l$?%"%/%;%9$N%]!<%H(B/$B%5!<%t%#%9(B
#
# Allow DHCP server (their port 67) to client (to our port 68) UDP traffic
# from outside source.
# $B30It%=!<%9$+$i%/%i%$%"%s%H$N!J2f!9$N(B68$BHV%]!<%H$X$N!K(BUDP $B%H%i%U%#%C%/(B
# $B$X!!(BDHCP $B%5!<%P!J(B67$BHV%]!<%H!K$r5v2D$9$k!#(B
[ -n "$DHCP_SERVER" ] &&\
 $IPCHAINS -A input -p udp -s $DHCP_SERVER 67 -d $ANYWHERE 68 -j ACCEPT 

# Allow 'identd' (to our TCP port 113) from mail server only.
# $B%a%$%k%5!<%P$N$_$+$i!J2f!9$N(B TCP 113 $BHV%]!<%H$X$N!K(B'identd' $B$r5v2D(B
[ -n "$MAIL_SERVER" ] &&\
 $IPCHAINS -A input -p tcp -s $MAIL_SERVER  -d $WAN_IP 113 -j ACCEPT 

# Open up PUBLIC server ports here (available to the world):
# $B$3$3$G(B PUBLIC $B%5!<%P%]!<%H$r3+$/!J@$3&$X7R$2$k$?$a!K!'(B
for i in $PUBLIC_PORTS; do
 $IPCHAINS -A input -p tcp -s $ANYWHERE -d $WAN_IP $i -j ACCEPT 
done

# So I can check my home POP3 mailbox from work. Also, so I can ssh 
# in to home system. Only allow connections from my workplace's
# various IPs. Everything else is blocked.
# $B$3$&$7$F$*$1$P;E;v>l$+$i<+Bp$N(B POP3 $B%a%$%k%\%C%/%9$r%A%'%C%/$G$-$k!#(B
# $B$^$?!"<+Bp%7%9%F%`$X(B ssh $B$GF~$k$3$H$b$G$-$k!#;E;v>l$N$5$^$6$^$J(B
# IP $B%"%I%l%9$+$i$N@\B3$r5v2D$9$k$@$1!#B>$OA4$F%V%m%C%/$5$l$k!#(B
$IPCHAINS -A input -p tcp -s 255.10.9.8/29 -d $WAN_IP 110 -j ACCEPT 

# Uncomment to allow ftp data back (active ftp). Not required for 'passive'
# ftp connections.
# ftp $B%G!<%?%P%C%/!J%"%/%F%#%V(B ftp$B!K$r5v2D$9$k$H$-$O%3%a%s%H%"%&%H$r30$9!#(B
# $B%Q%C%7%V(B ftp $B@\B3$K$D$$$F$OI,MW$J$$!#(B
#$IPCHAINS -A input -p tcp -s $ANYWHERE 20 -d $WAN_IP $LOCAL_PORTS -y -j ACCEPT

# Accept non-SYN TCP, and UDP connections to LOCAL_PORTS. These are
# the high, unprivileged ports (1024 to 4999 by default). This will
# allow return connection traffic for connections that we initiate
# to outside sources. TCP connections are opened with 'SYN' packets.
# We have already opened those services that need to accept SYNs
# for, so other SYNs are excluded here for everything else.
# LOCAL_PORTS $B$X$NHs(B SYN TCP $B$H(B UDP $B@\B3$r$N(B SYN $B$O$=$l0J30$NA4$F$K$D$$$F$3$3$G5q@d$9$k!#(B
$IPCHAINS -A input -p tcp -s $ANYWHERE -d $WAN_IP $LOCAL_PORTS ! -y -j ACCEPT 

# We can't be so selective with UDP since that protocol does not know 
# about SYNs.
# UDP $B$O(B SYN $B$K$D$$$FCN$i$J$$$N$G!"$=$l$[$IA*BrE*$K$G$-$J$$!#(B
$IPCHAINS -A input -p udp -s $ANYWHERE -d $WAN_IP $LOCAL_PORTS -j ACCEPT 

# Allow access to the masquerading ports conditionally. Masquerading
# uses it's own port range -- on 2.2 kernels ONLY! 2.4 kernels, do not 
# use these ports, so comment out!
# $B>l9g$K$h$C$F$O%^%9%+%l!<%I$7$F$$$k%]!<%H$X$N@\B3$r5v2D$9$k!#(B
# $B%^%9%+%l!<%G%#%s%0$O<+?H$N%]!<%HHO0O$rMQ$$$k!J(B2.2 $B%+!<%M%k$N$_$G!*!K!#(B
# 2.4 $B%+!<%M%k$O$3$l$i$N%]!<%H$r;H$o$J$$$N$G!"%3%a%s%H%"%&%H$9$k$h$&$K!*(B
[ -n "$LAN_NET" ] &&\
 $IPCHAINS -A input -p tcp -s $ANYWHERE -d $WAN_IP 61000: ! -y -j ACCEPT &&\
 $IPCHAINS -A input -p udp -s $ANYWHERE -d $WAN_IP 61000: -j ACCEPT

## ICMP (ping)
#
# ICMP rules, allow the bare essential types of ICMP only. Ping
# request is blocked, ie we won't respond to someone else's pings,
# but can still ping out. 
# ICMP $B$N5,B'!"(BICMP $B$N$`$-=P$7$NK\$NC/$+$N(B ping $B$K$OEz$($J$$$,!"(B
# $B<+J,$O(B ping out $B$9$k$3$H$,$G$-$k!#(B
$IPCHAINS -A input  -p icmp  --icmp-type echo-reply \
   -s $ANYWHERE -i $WAN_IFACE -j ACCEPT
$IPCHAINS -A input  -p icmp  --icmp-type destination-unreachable \
   -s $ANYWHERE -i $WAN_IFACE -j ACCEPT
$IPCHAINS -A input  -p icmp  --icmp-type time-exceeded \
   -s $ANYWHERE -i $WAN_IFACE -j ACCEPT

#######################################################################
# Set the catchall, default rule to DENY, and log it all. All other
# traffic not allowed by the rules above, winds up here, where it is
# blocked and logged. This is the default policy for this chain
# anyway, so we are just adding the logging ability here with '-l'.
# Outgoing traffic is allowed as the default policy for the 'output'
# chain. There are no restrictions on that.
# $B$J$s$G$bH"$r$*$-!J%G%U%)%k%H%k!<%k$O(B DENY$B!K!"$=$NA4$F$N%m%0$r$H$k!#(B
# $B>e$N%k!<%k$G5v2D$5$l$F$$$J$$B>$NA4$F$N%H%i%U%#%C%/$r!"$3$3$G(B
# $B;OKv$r$D$1!"%V%m%C%/$7%m%0$r$H$k!#$3$l$O$3$N%A%'%$%s$K$D$$$F$N(B
# $B%G%U%)%k%H$N%]%j%7!<$@$+$i!"$3$3$G$O(B '-l' $B$G%m%0G=NO$rDI2C$9$k$N$_!#(B
# $B30$K8~$+$&%H%i%U%#%C%/$O(B 'output' $B%A%'%$%s$K$D$$$F$N%G%U%)%k%H(B
# $B%]%j%7!<$H$7$F5v2D$5$l$F$$$k!#$3$l$K$D$$$F$O2?$N@)8B$b$*$+$J$$!#(B
$IPCHAINS -A input -l -j DENY

echo "Ipchains firewall is up `date`."

##-- eof ipchains.sh

 

#!/bin/sh
#
# iptables.sh
#
# An example of a simple iptables configuration. This script 
# can enable 'masquerading' and will open user definable ports.
# $BC1=c$J(B ipchains $B@_Dj$NNc!#$3$N%9%/%j%W%H$O!V%^%9%+%l!<%G%#%s%0!W(B
# $B$,2DG=$G!"%f!<%6Dj5A%]!<%H$r3+$/!#(B
###################################################################
# Begin variable declarations and user configuration options ######
#  $BJQ?t@k8@$H%f!<%6@_Dj%*%W%7%g%s(B
# Set the location of iptables (default).
# ipchains $B!J%G%U%)%k%H!K$N>l=j$r@_Dj!#(B
IPTABLES=/sbin/iptables

# Local Interfaces
# $B%m!<%+%k%$%s%?!<%U%'!<%9(B
# This is the WAN interface that is our link to the outside world.
# $B$3$l$O(B WAN $B%$%s%?!<%U%'!<%9!"30$N@$3&$K2f!9$r$D$J$2$k!#(B
# For pppd and pppoe users.
# pppd $B$H(B pppoe $B%f!<%6$N$?$a!#(B

# WAN_IFACE="ppp0"
WAN_IFACE="eth0"
#
# Local Area Network (LAN) interface.
# $B%m!<%+%k%(%j%"%M%C%H%o!<%/(B(LAN)$B%$%s%?!<%U%'!<%9(B
#LAN_IFACE="eth0"
LAN_IFACE="eth1"

# Our private LAN address(es), for masquerading.
# $B2f!9$N%W%i%$%Y!<%H(B LAN $B%"%I%l%9!J$?$A!K!"%^%9%+%l!<%G%#%s%0$N$?$a$N!#(B
LAN_NET="192.168.1.0/24"

# For static IP, set it here! 
# $B%9%?%F%#%C%/(B IP $B$N$?$a!#$3$3$G@_Dj$;$h!*(B
#WAN_IP="1.2.3.4"

# Set a list of public server port numbers here...not too many!
# These will be open to the world, so use caution. The example is
# sshd, and HTTP (www). Any services included here should be the
# latest version available from your vendor. Comment out to disable
# all Public services. Do not put any ports to be forwarded here,
# this only direct access.
# $B$3$3$G%Q%V%j%C%/%5!<%P$N%]!<%HHV9f$N%j%9%H$r@_Dj!#B?$9$.$J$$$h$&$K!*(B
# $B$3$l$i$O@$3&$K8~$1$F3+$+$l$k$N$G!"MWCm0U!#$3$NNc$O(B sshd, HTTP(www).
# $B$3$3$N$I$N%5!<%t%#%9$b%t%'%s%@$N:G?7%P!<%8%g%s$K$9$Y$-!#(B
# $BA4$F$N%Q%V%j%C%/%5!<%t%#%9$rIT2DG=$K$9$k$?$a$K$O%3%a%s%H%"%&%H$;$h!#(B
# $B%U%)%o!<%I$5$l$k%]!<%H$O$I$l$b$3$3$K$*$+$J$$$3$H!"$3$l$OD>@\$N(B
# $B%"%/%;%9$N$_!#(B
#PUBLIC_PORTS="22 80 443"
PUBLIC_PORTS="22"

# If we want to do port forwarding, this is the host 
# that will be forwarded to.
# $B$b$7%]!<%H%U%)%o!<%G%#%s%0$7$?$$$J$i!"$3$l$,%U%)%o!<%I$5$l$k@h$N%[%9%H!#(B
#FORWARD_HOST="192.168.1.3"

# A list of ports that are to be forwarded. 
# $B%U%)%o!<%I$5$l$k$Y$-%]!<%H$N%j%9%H(B
#FORWARD_PORTS="25  80"

# If you get your public IP address via DHCP, set this.
# $B$b$7(B DHCP $B$rDL$8$F%Q%V%j%C%/$J(B IP $B%"%I%l%9$r@_Dj$9$k$J$i!"$3$3$G!#(B
DHCP_SERVER=66.21.184.66

# If you need identd for a mail server, set this.
# $B%a%$%k%5!<%P$N$?$a$K(B identd $B$,I,MW$J$i$3$3$G!#(B
MAIL_SERVER=

# A list of unwelcome hosts or nets. These will be denied access 
# to everything, even our 'Public' services. Provide your own list.
# $BK>$^$L5R$N%[%9%H$H%M%C%H$N%j%9%H!#$3$l$i$OA4$F$X$N%"%/%;%9!"(B
# $B2f!9$N%Q%V%j%C%/%5!<%t%#%9$5$($b!"5qH]$5$l$k(B
# $B<+J,<+?H$N%j%9%H$rMQ0U$;$h!#(B
#BLACKLIST="11.22.33.44 55.66.77.88"

# A list of "trusted" hosts and/or nets. These will have access to 
# ALL protocols, and ALL open ports. Be selective here.
# $B!V?.MQ$G$-$k!W%[%9%H$H(B/$B$^$?$O%M%C%H$N%j%9%H!#$3$l$i$OA4$F$N(B
# $B%W%m%H%3%k$HA4$F$N3+$$$?%]!<%H$K%"%/%;%9$G$-$k!#(B
# $B$3$l$O@:A*$7$F!#(B
#TRUSTED="1.2.3.4/8  5.6.7.8"

## end user configuration options #################################
## $B%(%s%I%f!<%6@_Dj%*%W%7%g%s(B
###################################################################

# Any and all addresses from anywhere.
# $BG$0U$N>l=j$+$i$NA4$F$N%"%I%l%9(B
ANYWHERE="0/0"

# These modules may need to be loaded:
# $B$3$l$i$N%b%8%e!<%k$rFI$_9~$`I,MW$,$"$k$+$b!#(B
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp

# Start building chains and rules #################################
## $B%A%'%$%s$H5,B'$N@_Dj$N;O$^$j(B
# Let's start clean and flush all chains to an empty state.
# $B$^$:A4$F$N%A%'%$%s$r6u$N>uBV$K!#(B
$IPTABLES -F
$IPTABLES -X


# Set the default policies of the built-in chains. If no match for any 
# of the rules below, these will be the defaults that IPTABLES uses.
# $BAH$_9~$_$N%A%'%$%s$N%G%U%)%k%H%]%j%7!<$r@_Dj!#0J2<$N%k!<%k$N$I$l$K$b(B
# $B0lCW$7$J$1$l$P!"$3$l$i$,(B IPTABLES $B$N;H$&%G%U%)%k%H$K$J$k!#(B
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P INPUT DROP 

# Accept localhost/loopback traffic.
# localhost/loopback $B%H%i%U%#%C%/$re$G(B LAN_NET $B$,Dj5A$5$l$F$$$l$P%^%9%+%l!<%@!<$N(B
# $B%U%)%o!<%G%#%s%0$r@_Dj$9$k!#(B
if [ -n "$LAN_NET" ]; then 
 echo 1 > /proc/sys/net/ipv4/ip_forward
 $IPTABLES -A INPUT -i $LAN_IFACE  -j ACCEPT
# $IPTABLES -A INPUT -i $LAN_IFACE -s $LAN_NET -d $LAN_NET  -j ACCEPT  
 $IPTABLES -t nat -A POSTROUTING -s $LAN_NET -o $WAN_IFACE -j MASQUERADE
fi

## Blacklist
#$B!!%V%i%C%/%j%9%H(B
# Get the blacklisted hosts/nets out of the way, before we start opening 
# up any services. These will have no access to us at all, and will 
# be logged.
# $B%V%i%C%/%j%9%H$K$N$C$?%[%9%H(B/$B%M%C%H$r!"$I$N%5!<%t%#%9$b3+$+$l(B
# $B$kA0$KJD$a=P$9!#$3$l$i$O$^$C$?$/2f!9$K%"%/%;%9$r;}$?$:!"(B
# $B%m%0$r$H$i$l$k!#(B
for i in $BLACKLIST; do
 $IPTABLES -A INPUT -s $i -m limit --limit 5/minute \
   -j LOG --log-prefix "Blacklisted: "
 $IPTABLES -A INPUT -s $i -j DROP
done

## Trusted hosts/nets
#$B?.MQ$G$-$k%[%9%H(B/$B%M%C%H(B
# This is our trusted host list. These have access to everything.
# $B?.MQ$9$k%[%9%H$N%j%9%H!#$3$l$i$OA4$F$X$N%"%/%;%98"$r;}$D!#(B
for i in $TRUSTED; do
 $IPTABLES -A INPUT -s $i -j ACCEPT
done

# Port Forwarding
#$B%]!<%H%U%)%o!<%G%#%s%0(B
# Which ports get forwarded to which host. This is one to one 
# port mapping (ie 80 -> 80) in this case.
# $B$I$N%]!<%H$,$I$N%[%9%H$X%U%)%o!<%I$5$l$k$+!#$3$l$O$3$N>l9g(B
# $B0lBP0l$N%^%C%T%s%0!J$D$^$j!"(B80 $B$+$i(B 80 $B$X!K!#(B
[ -n "$FORWARD_HOST" ] &&\
 for i in $FORWARD_PORTS; do
   $IPTABLES -A FORWARD -p tcp -s $ANYWHERE -d $FORWARD_HOST \
     --dport $i -j ACCEPT
   $IPTABLES -t nat -A PREROUTING -p tcp -d $WAN_IP --dport $i \
     -j DNAT --to $FORWARD_HOST:$i
 done

## Open, but Restricted Access ports
#$B3+$$$?!"$7$+$7@)8B$5$l$?%"%/%;%9$N%]!<%H(B/$B%5!<%t%#%9(B
# Allow DHCP server (their port 67) to client (to our port 68) UDP
# traffic from outside source.
# $B30It%=!<%9$+$i%/%i%$%"%s%H$N!J2f!9$N(B68$BHV%]!<%H$X$N!K(BUDP $B%H%i%U%#%C%/(B
# $B$X!!(BDHCP $B%5!<%P!J(B67$BHV%]!<%H!K$r5v2D$9$k!#(B
[ -n "$DHCP_SERVER" ] &&\
 $IPTABLES -A INPUT -p udp -s $DHCP_SERVER --sport 67 \
   -d $ANYWHERE --dport 68 -j ACCEPT 

# Allow 'identd' (to our TCP port 113) from mail server only.
# $B%a%$%k%5!<%P$N$_$+$i!J2f!9$N(B TCP 113 $BHV%]!<%H$X$N!K(B'identd' $B$r5v2D(B
[ -n "$MAIL_SERVER" ] &&\
 $IPTABLES -A INPUT -p tcp -s $MAIL_SERVER  -d $WAN_IP --dport 113 -j ACCEPT 

# Open up Public server ports here (available to the world):
# $B$3$3$G(B PUBLIC $B%5!<%P%]!<%H$r3+$/!J@$3&$X7R$2$k$?$a!K!'(B
for i in $PUBLIC_PORTS; do
 $IPTABLES -A INPUT -p tcp -s $ANYWHERE -d $WAN_IP --dport $i -j ACCEPT 
done

# So I can check my home POP3 mailbox from work. Also, so I can ssh 
# in to home system. Only allow connections from my workplace's
# various IPs. Everything else is blocked.
# $B$3$l$K$h$C$F;E;v>l$+$i<+Bp$N(B POP3 $B%a%$%k%\%C%/%9$r%A%'%C%/$G$-$k!#(B
# $B$^$?!"<+Bp%7%9%F%`$X(B ssh $B$GF~$k$3$H$b$G$-$k!#;E;v>l$N$5$^$6$^$J(B
# IP $B%"%I%l%9$+$i$N@\B3$r5v2D$9$k$@$1!#B>$OA4$F%V%m%C%/$5$l$k!#(B
$IPTABLES -A INPUT -p tcp -s 255.10.9.8/29 -d $WAN_IP --dport 110 -j ACCEPT 

## ICMP (ping)
#
# ICMP rules, allow the bare essential types of ICMP only. Ping
# request is blocked, ie we won't respond to someone else's pings,
# but can still ping out.
# ICMP $B$N5,B'!"(BICMP $B$N$`$-=P$7$NK\$NC/$+$N(B ping $B$K$OEz$($J$$$,!"(B
# $B<+J,$O(B ping out $B$9$k$3$H$,$G$-$k!#(B
$IPTABLES -A INPUT  -p icmp  --icmp-type echo-reply \
   -s $ANYWHERE -d $WAN_IP -j ACCEPT
$IPTABLES -A INPUT  -p icmp  --icmp-type destination-unreachable \
   -s $ANYWHERE -d $WAN_IP -j ACCEPT
$IPTABLES -A INPUT  -p icmp  --icmp-type time-exceeded \
   -s $ANYWHERE -d $WAN_IP -j ACCEPT

# Identd Reject
# Identd $B5qH](B
#
# Special rule to reject (with rst) any identd/auth/port 113
# connections. This will speed up some services that ask for this,
# but don't require it. Be careful, some servers may require this
# one (IRC for instance).
# $BA4$F$N(B identd/auth/port 113 $B@\B3$r(B (rst $B$H!K5qH]$9$kFCJL5,B'!#(B
# $B$3$l$rMW5a$9$k$,I,MW$H$O$7$J$$%5!<%t%#%9$r%9%T!<%I%"%C%W$9$k!#(B
# $BMWCm0U!"$3$l$rI,MW$H$9$k%5!<%t%#%9!J(BIRC $B$J$I!K$b$"$k!#(B
#$IPTABLES -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset

###################################################################
# Build a custom chain here, and set the default to DROP. All
# other traffic not allowed by the rules above, ultimately will
# wind up here, where it is blocked and logged, unless it passes
# our stateful rules for ESTABLISHED and RELATED connections. Let
# connection tracking do most of the worrying! We add the logging
# ability here with the '-j LOG' target. Outgoing traffic is
# allowed as that is the default policy for the 'output' chain.
# There are no restrictions placed on that in this script.
# $B$3$3$G$"$D$i$($N%A%'%$%s$r9=C[$7!"(BDROP $B$X$N%G%U%)%k%H$r@_Dj!#(B
# $B>e$N5,B'$G5v2D$5$l$J$$B>$N%H%i%U%#%C%/$OA4$F!":G=*E*$K$3$3$G(B
# $B;OKv$r$D$1!"(BESTABLISHED $B$H(B RELATED $B@\B3$K$D$$$F$N%9%F%$%H%U%k5,B'(B
# $B$r%Q%9$7$F$$$J$$8B$j!"%V%m%C%/$7%m%0$r$H$k!#@\B3DI@W5!G=$K?4G[;v$N(B
# $B$[$H$s$I$r$d$i$;$^$7$g$&!*$3$3$G$O(B '-j LOG' $B%?!<%2%C%H$G%m%05!G=$r(B
# $BDI2C$9$k!#30$K8~$+$&%H%i%U%#%C%/$O(B 'output' $B%A%'%$%s$K$D$$$F$N(B
# $B%G%U%)%k%H%]%j%7!<$J$N$G5v2D$5$l$F$$$k!#$3$N%9%/%j%W%H$G$O(B
# $B2?$N@)8B$b$*$+$J$$!#(B

# New chain...
# $B?7$7$$%A%'%$%s(B
$IPTABLES -N DEFAULT
# Use the 'state' module to allow only certain connections based 
# on their 'state'.
# $B$=$N(B 'state' $B$K4p$E$$$F$"$ke$G(B
# $BDj5A$7$?$"$D$i$($G:n$C$?(B 'DEFAULT' $B%A%'%$%s$K2!$79~$a$k!#(B
# $B$3$l$O(B FORWARD $B$H(B INPUT $B%A%'%$%s$NN>J}$N$?$a!#(B
$IPTABLES -A FORWARD -j DEFAULT
$IPTABLES -A INPUT   -j DEFAULT

echo "Iptables firewall is up `date`."

##-- eof iptables.sh
 
 

 ## Insert connection-tracking modules (not needed if built into kernel).
 ## $B@\B3DI@W%b%8%e!<%k$rA^F~!J%+!<%M%kAH$_9~$_$J$iITMW!K!#(B 
 insmod ip_conntrack
 insmod ip_conntrack_ftp

 ## Create chain which blocks new connections, except if coming from inside.
 ## $BFbB&$+$iMh$k$b$N0J30!"?7$7$$@\B3$r%V%m%C%/$9$k%A%'%$%s$r:n@.!#(B
 iptables -N block
 iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
 iptables -A block -m state --state NEW -i ! ppp0 -j ACCEPT
 iptables -A block -j DROP

 ## Jump to that chain from INPUT and FORWARD chains.
 ## INPUT $B$H(B FORWARD $B%A%'%$%s$+$i$=$N%A%'%$%s$X%8%c%s%W!#(B
 iptables -A INPUT -j block
 iptables -A FORWARD -j block