Como configurar o iptables para um roteador doméstico?

Question

Como configurar o iptables para um roteador doméstico?

#1 resposta do (0 votos)

0

Estou configurando um PI de framboesa como roteador doméstico e abaixo está meu script atual do iptables. O roteador também tem

um proxy,
samba,
CUPS,
bind9,
um ponto de acesso WLAN e
um servidor DHCP.

Não tenho certeza se a configuração abaixo funciona, se a ligação não puder responder a um pedido de DNS: Preciso tornar possível abrir uma conexão "NEW" na porta 53 na cadeia de saída? Ou eu tenho que colocá-lo na cadeia FORWARD, porque o cliente da LAN faz o pedido de upstream em vez de ligar.

O roteador deve obter um IP (para a interface WAN) via DHCP do meu provedor. O roteador também distribuirá IPs para os clientes (W) da LAN. Eu tenho que permitir a porta udp 67/68 em todas as interfaces para a cadeia de entrada e saída para isso?

Existe uma maneira de tornar meu script mais curto, ou seja, obter o mesmo resultado, melhorando a legibilidade? Meu objetivo básico é fornecer os serviços instalados (veja acima) para clientes de rede local (W) e fornecer aos clientes de rede local (W) acesso a HTTP (s), IMAP (s), SMTP, NTP e WhatsApp.

#!/bin/sh
log() {
 echo "$(date '+%b %d %H:%M:%S') $(hostname) iptablesInit: $1"
 echo "$(date '+%b %d %H:%M:%S') $(hostname) iptablesInit: $1" >> /var/log/iptablesInit.log
}

IPT="/sbin/iptables"

WAN="WAN"
LAN="LAN"
WLAN="WLAN"

# Flush all chaines
log 'Flush everything...'
$IPT -F
$IPT -X
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -t nat -F
$IPT -t nat -X

$IPT -F INPUT
$IPT -F FORWARD
$IPT -F OUTPUT
log 'Flush done'

# unlimited
$IPT -A INPUT  -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

# set policies
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP

# NAT
$IPT -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE

#===== BLOCK =====
# Block sync
$IPT -A INPUT -i ${WAN} -p tcp ! --syn -m state --state NEW  -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Drop Sync"
$IPT -A INPUT -i ${WAN} -p tcp ! --syn -m state --state NEW -j DROP

# Block Fragments
$IPT -A INPUT -i ${WAN} -f  -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fragments Packets"
$IPT -A INPUT -i ${WAN} -f -j DROP

# Block bad stuff
$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags ALL ALL -j DROP

$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "NULL Packets"
$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags ALL NONE -j DROP # NULL packets

$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "XMAS Packets"
$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS

$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fin Packets Scan"
$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans

$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

# Block CUPS WAN access
$IPT -A OUTPUT -o ${WAN} -p tcp --dport 631 -j REJECT
$IPT -A OUTPUT -o ${WAN} -p udp --dport 631 -j REJECT

#===== ALLOW =====
# Allow full connection but no incomming stuff between LAN and router
#$IPT -A INPUT  -i ${LAN} -m state --state ESTABLISHED,RELATED -j ACCEPT
#$IPT -A OUTPUT -o ${LAN} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Allow ssh 
$IPT -A INPUT -i ${LAN}  -p tcp --dport 22 -j ACCEPT
$IPT -A OUTPUT -o ${LAN} -p tcp --dport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT

# allow ICMP ping pong stuff
$IPT -A INPUT  -i ${LAN}  -p icmp -j ACCEPT
$IPT -A OUTPUT -o ${LAN}  -p icmp -j ACCEPT
$IPT -A INPUT  -i ${WLAN} -p icmp -j ACCEPT
$IPT -A OUTPUT -o ${WLAN} -p icmp -j ACCEPT

# Allow port 53 tcp/udp (DNS Server)
$IPT -A INPUT  -p tcp --dport 53 -m state --state NEW,ESTABLISHED,RELATED  -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A INPUT  -p udp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A INPUT  -p tcp --dport 953 -m state --state NEW,ESTABLISHED,RELATED  -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 953 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Proxy
$IPT -A INPUT -i ${LAN}  -p tcp --dport 3128 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p tcp --dport 3128 -j ACCEPT

#DHCP
$IPT -A INPUT -p udp --dport 67 -j ACCEPT
$IPT -A INPUT -p udp --dport 68 -j ACCEPT

# Open port 631 for CUPS/Printing
$IPT -A INPUT -i ${LAN}  -p tcp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${LAN}  -p udp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p tcp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p udp --dport 631 -j ACCEPT

# Samba
$IPT -A INPUT -p tcp -m multiport --dport 139,445 -j ACCEPT
$IPT -A INPUT -p udp -m multiport --dport 137,138 -j ACCEPT

#===== FORWARD =====
# HTTP(s)
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p tcp -m multiport --dport 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p udp -m multiport --dport 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${LAN} -o ${WAN} -p tcp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p udp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p tcp -m multiport --dport 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p udp -m multiport --dport 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p tcp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p udp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# IMAP(s)
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p tcp -m multiport --dport 143,993 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p udp -m multiport --dport 143,993 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${LAN} -o ${WAN} -p tcp -m multiport --dport 143,993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p udp -m multiport --dport 143,993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p tcp -m multiport --dport 143,993 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p udp -m multiport --dport 143,993 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p tcp -m multiport --dport 143,993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p udp -m multiport --dport 143,993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# SMTP
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p tcp --dport 25 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p udp --dport 25 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${LAN} -o ${WAN} -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p udp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p tcp --dport 25 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p udp --dport 25 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p udp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# NTP
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p udp --dport 123 -m state --state ESTABLISHED,RELATED  -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p udp --dport 123 -m state --state NEW,ESTABLISHED,RELATED  -j ACCEPT

$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p udp --dport 123 -m state --state ESTABLISHED,RELATED  -j ACCEPT 
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p udp --dport 123 -m state --state NEW,ESTABLISHED,RELATED  -j ACCEPT 
# WhatsApp
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p tcp --dport 5222 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p tcp --dport 5222 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p tcp --dport 5222 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p tcp --dport 5222 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Reject (W)LAN Traffic rather than drop
$IPT -A INPUT   -i ${LAN}  -j REJECT --reject-with icmp-host-prohibited
$IPT -A INPUT   -i ${WLAN} -j REJECT --reject-with icmp-host-prohibited
$IPT -A FORWARD -i ${LAN}  -j REJECT --reject-with icmp-host-prohibited
$IPT -A FORWARD -i ${WLAN} -j REJECT --reject-with icmp-host-prohibited
$IPT -A OUTPUT             -j REJECT --reject-with icmp-host-prohibited

exit 0

networking iptables router linux wireless-networking

por kiigass 07.09.2017 / 21:00

1 resposta

Tags networking iptables router linux wireless-networking

Excel mostrando listras e caixas pretas O Excel está colocando vírgulas onde não deveria

score 0 · Answer 1

Toda a sua seção DNS, exclua-a Eu substituí toda a seção INPUT por você. Apague o seu DHCP 67,68 sua cobertura agora por relacionado, estabelecido.

IPT -I INPUT 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT


IPT -I FORWARD 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Agora apague todos os outros comandos que contêm RELATED, ESTABLISHED na sua cadeia de ataque. Então agora são todos redundantes, o que basicamente significa todos os outros comandos.

Seu código

# Open port 631 for CUPS/Printing
$IPT -A INPUT -i ${LAN}  -p tcp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${LAN}  -p udp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p tcp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p udp --dport 631 -j ACCEPT

# Samba
$IPT -A INPUT -p tcp -m multiport --dport 139,445 -j ACCEPT
$IPT -A INPUT -p udp -m multiport --dport 137,138 -j ACCEPT

Novo código para a cadeia INPUT.

$IPT -N INTERNET
$IPT -I INPUT 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$IPT -I INPUT -d <internet ip> -j INTERNET
$IPT -I INTERNET <add ports and protocols here from internet>
## insert **block bad** here
# Change INPUT to INTERNET for the chain in block bad
$IPT -I INTERNET -j drop


## You may want to add $IPT -A INPUT  -d <internet IP> -j DROP
## so random internet people can connect to 139,445,631
$IPT -A INPUT -p tcp -m multiport --dport 139,445,631 -j ACCEPT
$IPT -A INPUT -p udp -m multiport --dport 137,138,631 -j ACCEPT
$IPT -A INPUT -j drop

Qualquer coisa não aceita é descartada.