From 0963985a41b78ac5454ac21ea775975908f824c4 Mon Sep 17 00:00:00 2001 From: "David M. Syzdek" Date: Mon, 10 May 2021 15:02:39 -0800 Subject: examples: updating example rules --- src/firewall.d/global.d/ipsets-example | 68 ++++++++++++++++++++++++---------- src/firewall.d/global.d/rules-example | 22 +++++++++-- src/firewall.d/global.d/rules4-example | 10 ----- src/firewall.d/global.d/rules6-example | 10 ----- src/firewall.d/ipsets-example | 2 +- src/firewall.d/rules-example | 8 ++++ src/firewall.d/rules4-example | 3 ++ src/firewall.d/rules6-example | 3 ++ 8 files changed, 82 insertions(+), 44 deletions(-) diff --git a/src/firewall.d/global.d/ipsets-example b/src/firewall.d/global.d/ipsets-example index 8a6d35f..ff54196 100644 --- a/src/firewall.d/global.d/ipsets-example +++ b/src/firewall.d/global.d/ipsets-example @@ -13,26 +13,54 @@ # @sysconfdir@/firewall.d/rules6 # -####################### -# # -# Standard Services # -# # -####################### - -create SERVICES bitmap:port range 1-1024 comment -add SERVICES 20 comment "FTP data" -add SERVICES 21 comment "FTP" -add SERVICES 22 comment "SSH" -add SERVICES 23 comment "Telnet" -add SERVICES 25 comment "SMTP" -add SERVICES 53 comment "DNS" -add SERVICES 69 comment "TFTP" -add SERVICES 80 comment "HTTP" -add SERVICES 110 comment "POP3" -add SERVICES 123 comment "NTP" -add SERVICES 143 comment "IMAP" -add SERVICES 389 comment "LDAP" -add SERVICES 443 comment "HTTPS" +###################### +# # +# Private Networks # +# # +###################### + +create PRIVATE4 hash:ip family inet hashsize 1024 comment +create PRIVATE6 hash:ip family inet6 hashsize 1024 comment +create PRIVATE list:set +add PRIVATE PRIVATE4 +add PRIVATE PRIVATE6 +add PRIVATE4 10.0.0.0/8 "rfc1918" +add PRIVATE4 172.16.0.0/12 "rfc1918" +add PRIVATE4 192.168.0.0/1 "rfc1918" +add PRIVATE6 fc00::/7 "rfc4193" +add PRIVATE6 fe80::/10 "rfc4291" + + +################# +# # +# Black Holes # +# # +################# + +# dynamic blackhole lists +create DYNAMIC_BLACKHOLE4 hash:ip family inet hashsize 1024 timeout 600 +create DYNAMIC_BLACKHOLE6 hash:ip family inet6 hashsize 1024 timeout 600 +create DYNAMIC_BLACKHOLE list:set +add DYNAMIC_BLACKHOLE DYNAMIC_BLACKHOLE4 +add DYNAMIC_BLACKHOLE DYNAMIC_BLACKHOLE6 + +# dynamic blackhole exemptions +create DYNAMIC_EXEMPTION4 hash:net family inet hashsize 1024 comment +create DYNAMIC_EXEMPTION6 hash:net family inet6 hashsize 1024 comment +create DYNAMIC_EXEMPTION list:set +add DYNAMIC_EXEMPTION DYNAMIC_EXEMPTION4 +add DYNAMIC_EXEMPTION DYNAMIC_EXEMPTION6 +add DYNAMIC_EXEMPTION PRIVATE4 +add DYNAMIC_EXEMPTION PRIVATE6 + +# static blackhole lists +create BLACKHOLE4 hash:ip family inet hashsize 1024 +create BLACKHOLE6 hash:ip family inet6 hashsize 1024 +create BLACKHOLE list:set +add BLACKHOLE BLACKHOLE4 +add BLACKHOLE BLACKHOLE6 +add BLACKHOLE DYNAMIC_BLACKHOLE4 +add BLACKHOLE DYNAMIC_BLACKHOLE6 # end of rules diff --git a/src/firewall.d/global.d/rules-example b/src/firewall.d/global.d/rules-example index 66efc0f..e6a598b 100644 --- a/src/firewall.d/global.d/rules-example +++ b/src/firewall.d/global.d/rules-example @@ -29,15 +29,31 @@ # allow all local host traffic -I INPUT -i lo -j ACCEPT -# reject ident loopups (fixes delays when connecting to misconfigured hosts) --A INPUT -p tcp --dport ident -j REJECT --reject-with tcp-reset +# drop black hole traffic +-I INPUT -m set --match-set BLACKHOLE src -j DROP +-I INPUT -m set --match-set BLACKHOLE src \ + -m limit --limit 1/minute \ + -j LOG --log-level 7 --log-prefix "iptables blackhole: " + +# reject ident lookups (fixes delays when connecting to misconfigured hosts) +-A INPUT -m set --match-set PRIVATE src \ + -p tcp --dport ident \ + -j REJECT --reject-with tcp-reset # allow established connections --A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT +-I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + +# allow local networks to access services +-A INPUT -m set --match-set PRIVATE src -p tcp --dport ssh -j ACCEPT +-A INPUT -m set --match-set PRIVATE src -p tcp --dport domain -j ACCEPT +-A INPUT -m set --match-set PRIVATE src -p udp --dport domain -j ACCEPT # log everything else -A INPUT -m limit --limit 10/minute -j LOG --log-level 7 --log-prefix "iptables drop input: " +# blackhole filter misses +-A INPUT -m set ! --match-set DYNAMIC_EXEMPTION src -j SET --add-set DYNAMIC_BLACKHOLE src + COMMIT diff --git a/src/firewall.d/global.d/rules4-example b/src/firewall.d/global.d/rules4-example index 5f73887..2736754 100644 --- a/src/firewall.d/global.d/rules4-example +++ b/src/firewall.d/global.d/rules4-example @@ -19,11 +19,6 @@ # # ######################### *filter - -# allow all ICMP traffic --I INPUT -p icmp -j ACCEPT --I FORWARD -p icmp -j ACCEPT - COMMIT @@ -42,11 +37,6 @@ COMMIT # # ###################### *raw - -# ICMP traffic --I PREROUTING -p icmp -j NOTRACK --I OUTPUT -p icmp -j NOTRACK - COMMIT # end of rules diff --git a/src/firewall.d/global.d/rules6-example b/src/firewall.d/global.d/rules6-example index 8591787..cf5dd1a 100644 --- a/src/firewall.d/global.d/rules6-example +++ b/src/firewall.d/global.d/rules6-example @@ -20,11 +20,6 @@ # # ######################### *filter - -# allow all ICMPv6 traffic --I INPUT -p icmpv6 -j ACCEPT --I FORWARD -p icmpv6 -j ACCEPT - COMMIT @@ -34,11 +29,6 @@ COMMIT # # ###################### *raw - -# ICMP traffic --I PREROUTING -p icmpv6 -j NOTRACK --I OUTPUT -p icmpv6 -j NOTRACK - COMMIT # end of rules diff --git a/src/firewall.d/ipsets-example b/src/firewall.d/ipsets-example index 437676b..fb2785b 100644 --- a/src/firewall.d/ipsets-example +++ b/src/firewall.d/ipsets-example @@ -40,7 +40,7 @@ add PRIVATE4 10.0.0.0/8 "rfc1918" add PRIVATE4 172.16.0.0/12 "rfc1918" add PRIVATE4 192.168.0.0/1 "rfc1918" add PRIVATE6 fc00::/7 "rfc4193" -add PRIVATE6 fe80::/10 "rfc4291"" +add PRIVATE6 fe80::/10 "rfc4291" # end of rules diff --git a/src/firewall.d/rules-example b/src/firewall.d/rules-example index d892e9a..806098b 100644 --- a/src/firewall.d/rules-example +++ b/src/firewall.d/rules-example @@ -32,6 +32,14 @@ ############################## *filter +# set default policies +:INPUT DROP +:FORWARD DROP +:OUTPUT ACCEPT + +# allow all local host traffic +-I INPUT -i lo -j ACCEPT + ## accept HTTP/HTTPS connections #-A INPUT -p tcp --dport http -j ACCEPT #-A INPUT -p tcp --dport https -j ACCEPT diff --git a/src/firewall.d/rules4-example b/src/firewall.d/rules4-example index 238b8ca..2b5c0bc 100644 --- a/src/firewall.d/rules4-example +++ b/src/firewall.d/rules4-example @@ -31,6 +31,9 @@ ######################### *filter +# allow all ICMP traffic +-I INPUT -p icmp -j ACCEPT + ## accept SSH connections from RFC1918 addresses #-A INPUT -p tcp -s 10.0.0.0/8 --dport ssh -j ACCEPT #-A INPUT -p tcp -s 172.16.0.0/12 --dport ssh -j ACCEPT diff --git a/src/firewall.d/rules6-example b/src/firewall.d/rules6-example index 732a635..595e72d 100644 --- a/src/firewall.d/rules6-example +++ b/src/firewall.d/rules6-example @@ -31,6 +31,9 @@ ######################### *filter +# allow all ICMPv6 traffic +-I INPUT -p icmpv6 -j ACCEPT + ## accept SSH connections from link-local and RFC4193 addresses #-A INPUT -p tcp -s fc00::/7 --dport ssh -j ACCEPT #-A INPUT -p tcp -s fe80::/10 --dport ssh -j ACCEPT -- cgit v1.2.3