My personal notes on all things technical and factual....

Clayton's Tech Bits

Search this site:

Custom Search

Thu, 21 Jul 2011

/Admin/iptables: Build A Router With iptables

This[1] is a deeper reference, but it did not quite get the job done for me. (Nor did a lot of other recipes I looked at either, for that matter....) The "Example Scenario: SOHO" here[2] got me a working router.

First make sure forwarding is enabled in your router OS. The standard way to do this on Debian is to edit /etc/sysctl.conf to turn on net.ipv4.ip_forward. My machine is not a full-time router, so I added a

up echo 1 > /proc/sys/net/ipv4/ip_forward

line to the /etc/network/interfaces clause that brings up my internal LAN interface, ie.

iface static inet static
  address 10.1.1.1
  netmask 255.255.255.0
  network 10.1.1.0
  broadcast 10.1.1.255
  up echo 1 > /proc/sys/net/ipv4/ip_forward

Then I added these lines to my "basic firewall":

-A POSTROUTING -o eth0 -j MASQUERADE

-A INPUT -s 10.1.1.0/24 -i eth4 -m state --state NEW,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.1.1.0/24 -i eth4 -m state --state NEW,ESTABLISHED -j ACCEPT
-A FORWARD -d 10.1.1.0/24 -i eth0 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -d 10.1.1.0/24 -o eth4 -m state --state NEW,ESTABLISHED -j ACCEPT

where eth0 is the outward/WAN interface, eth4 is the inward/LAN interface, and 10.1.1.0/24 is the IP address block used on the LAN. Note that only ESTABLISHED, not NEW, connections are allowed to come in on eth0/WAN.

To configure DHCP[3] add this line to rules.v4:

-A INPUT -i eth4 -p udp -m udp --sport 67:68 --dport 67:68 -j ACCEPT

and

apt-get install dnsmasq

Just configure the dhcp-range in /etc/dnsmasq.conf, ie.

dhcp-range=10.1.1.50,10.1.1.150,12h

and it should be all ready to go.

[1] http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch14_:_Linux_Firewalls_Using_iptables#Masquerading_.28Many_to_One_NAT.29
[2] http://fedorasolved.org/Members/kanarip/iptables-howto
[3] http://www.faqs.org/docs/iptables/lettingdhcprequests.html

posted at: 03:52 | path: /Admin/iptables | permanent link to this entry

Tue, 21 Jun 2011

/Admin/iptables: Build A Basic Firewall with iptables

This seems like a good starting point[1], blocking everything except SSH, established, loopback, and outgoing connections:

iptables -P INPUT ACCEPT
iptables -F
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -L -v
/etc/init.d/iptables-persistent save

On my Debian system, the last "save" line puts a reloadable copy of the current running iptables rules in /etc/iptables/rules.v4 & /etc/iptables/rules.v6. Thereafter, it is also possible (advisable?) to edit these files directly to add/modify rules. For instance to open up the http port, add the following line to /etc/iptables/rules.v4:

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

Then load the new ruleset using:

iptables-restore < rules.v4

[1] http://wiki.centos.org/HowTos/Network/IPTables

posted at: 09:56 | path: /Admin/iptables | permanent link to this entry

Home

Contact

Resumé / C.V.

Links

Categories:

Archives:

Subscribe XML RSS Feed

Thu, 21 Jul 2011

Tue, 21 Jun 2011