FM / html

/usr/share/doc/iptables/html

Name	Size	Mode	Actions
NAT-HOWTO-1.html	1152	0644	edit dl rm
NAT-HOWTO-2.html	4346	0644	edit dl rm
NAT-HOWTO-3.html	1444	0644	edit dl rm
NAT-HOWTO-4.html	4400	0644	edit dl rm
NAT-HOWTO-5.html	5139	0644	edit dl rm
NAT-HOWTO-6.html	8397	0644	edit dl rm
NAT-HOWTO-7.html	1324	0644	edit dl rm
NAT-HOWTO-8.html	1136	0644	edit dl rm
NAT-HOWTO-9.html	2091	0644	edit dl rm
NAT-HOWTO-10.html	2525	0644	edit dl rm
NAT-HOWTO-11.html	910	0644	edit dl rm
NAT-HOWTO.html	2666	0644	edit dl rm
netfilter-extensions-HOWTO-1.html	2102	0644	edit dl rm
netfilter-extensions-HOWTO-2.html	7807	0644	edit dl rm
netfilter-extensions-HOWTO-3.html	28969	0644	edit dl rm
netfilter-extensions-HOWTO-4.html	12548	0644	edit dl rm
netfilter-extensions-HOWTO-5.html	7041	0644	edit dl rm
netfilter-extensions-HOWTO-6.html	11242	0644	edit dl rm
netfilter-extensions-HOWTO-7.html	2188	0644	edit dl rm
netfilter-extensions-HOWTO-8.html	1021	0644	edit dl rm
netfilter-extensions-HOWTO-9.html	2222	0644	edit dl rm
netfilter-extensions-HOWTO.html	7267	0644	edit dl rm
netfilter-hacking-HOWTO-1.html	7474	0644	edit dl rm
netfilter-hacking-HOWTO-2.html	1718	0644	edit dl rm
netfilter-hacking-HOWTO-3.html	8038	0644	edit dl rm
netfilter-hacking-HOWTO-4.html	53338	0644	edit dl rm
netfilter-hacking-HOWTO-5.html	1056	0644	edit dl rm
netfilter-hacking-HOWTO-6.html	3028	0644	edit dl rm
netfilter-hacking-HOWTO-7.html	9288	0644	edit dl rm
netfilter-hacking-HOWTO-8.html	5234	0644	edit dl rm
netfilter-hacking-HOWTO-9.html	835	0644	edit dl rm
netfilter-hacking-HOWTO.html	3811	0644	edit dl rm
packet-filtering-HOWTO-1.html	1891	0644	edit dl rm
packet-filtering-HOWTO-2.html	1593	0644	edit dl rm
packet-filtering-HOWTO-3.html	5775	0644	edit dl rm
packet-filtering-HOWTO-4.html	2189	0644	edit dl rm
packet-filtering-HOWTO-5.html	1644	0644	edit dl rm
packet-filtering-HOWTO-6.html	3505	0644	edit dl rm
packet-filtering-HOWTO-7.html	35616	0644	edit dl rm
packet-filtering-HOWTO-8.html	1457	0644	edit dl rm
packet-filtering-HOWTO-9.html	2333	0644	edit dl rm
packet-filtering-HOWTO-10.html	2575	0644	edit dl rm
packet-filtering-HOWTO-11.html	3742	0644	edit dl rm
packet-filtering-HOWTO.html	2831	0644	edit dl rm

Edit: /usr/share/doc/iptables/html/packet-filtering-HOWTO-11.html (3742B)

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
 <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.82">
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <TITLE>Linux 2.4 Packet Filtering HOWTO: Advice on Packet Filter Design</TITLE>
 <LINK HREF="packet-filtering-HOWTO-10.html" REL=previous>
 <LINK HREF="packet-filtering-HOWTO.html#toc11" REL=contents>
</HEAD>
<BODY>
Next
<A HREF="packet-filtering-HOWTO-10.html">Previous</A>
<A HREF="packet-filtering-HOWTO.html#toc11">Contents</A>
<HR>
<H2><A NAME="s11">11.</A> <A HREF="packet-filtering-HOWTO.html#toc11">Advice on Packet Filter Design</A></H2>

Common wisdom in the computer security arena is to block everything,
then open up holes as neccessary. This is usually phrased `that which
is not explicitly allowed is prohibited'. I recommend this approach
if security is your maximal concern.

Do not run any services you do not need to, even if you think you
have blocked access to them.

If you are creating a dedicated firewall, start by running nothing,
and blocking all packets, then add services and let packets through as
required.

I recommend security in depth: combine tcp-wrappers (for
connections to the packet filter itself), proxies (for connections
passing through the packet filter), route verification and packet
filtering. Route verification is where a packet which comes from an
unexpected interface is dropped: for example, if your internal network
has addresses 10.1.1.0/24, and a packet with that source address comes
in your external interface, it will be dropped. This can be enabled
for one interface (ppp0) like so:

<BLOCKQUOTE><CODE>
<PRE>
# echo 1 > /proc/sys/net/ipv4/conf/ppp0/rp_filter
#
</PRE>
</CODE></BLOCKQUOTE>

Or for all existing and future interfaces like this:

<BLOCKQUOTE><CODE>
<PRE>
# for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
# echo 1 > $f
# done
#
</PRE>
</CODE></BLOCKQUOTE>

Debian does this by default where possible. If you have asymmetric
routing (ie. you expect packets coming in from strange directions),
you will want to disable this filtering on those interfaces.

Logging is useful when setting up a firewall if something isn't
working, but on a production firewall, always combine it with the
`limit' match, to prevent someone from flooding your logs.

I highly recommend connection tracking for secure systems: it
introduces some overhead, as all connections are tracked, but is very
useful for controlling access to your networks. You may need to load
the `ip_conntrack.o' module if your kernel does not load modules
automatically, and it's not built into the kernel. If you want to
accurately track complex protocols, you'll need to load the
appropriate helper module (eg. `ip_conntrack_ftp.o').

<BLOCKQUOTE><CODE>
<PRE>
# iptables -N no-conns-from-ppp0
# iptables -A no-conns-from-ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A no-conns-from-ppp0 -m state --state NEW -i ! ppp0 -j ACCEPT
# iptables -A no-conns-from-ppp0 -i ppp0 -m limit -j LOG --log-prefix "Bad packet from ppp0:"
# iptables -A no-conns-from-ppp0 -i ! ppp0 -m limit -j LOG --log-prefix "Bad packet not from ppp0:"
# iptables -A no-conns-from-ppp0 -j DROP

# iptables -A INPUT -j no-conns-from-ppp0
# iptables -A FORWARD -j no-conns-from-ppp0
</PRE>
</CODE></BLOCKQUOTE>

Building a good firewall is beyond the scope of this HOWTO, but my
advice is `always be minimalist'. See the Security HOWTO for more
information on testing and probing your box.

<HR>
Next
<A HREF="packet-filtering-HOWTO-10.html">Previous</A>
<A HREF="packet-filtering-HOWTO.html#toc11">Contents</A>
</BODY>
</HTML>

cmd: