linux firewall to block windows programs??

[fenris]

How do I setup a linux firewall (mandrake 7.2 and ipchains) to block unauthorized attempts by software on my windows boxes to reach the internet? Is as simple as blocking the domains? What kind of rules would I have to setup and how would I figure it out?

I guess the first part would be how would I monitor (and log) all the connections that are being made to the internet and alert me to the fact that there is one being made. Then from that I would be able to deter mischeivious software.

The reason I bring this up is that zonealarm does this in windows. But it doesn't work in windows XP, which I am sure that XP itself will be "phoning" home.

Any ideas.... Troy Williams B.Eng.
fenris@hotmail.com

 

[marsd]

ipchains -P output DENY
(your other policies depend on your security stance..
a closed firewall is ideal as long as you know what
needs in and out and from whom..)

ipchains -A output -s private net address -d 0/0 80 -p tcp -j ACCEPT -l
#allows http over 80 out and logs everything.

You can allow other services outbound like this when you have to.
On the other hand you could let everything out and log
everything..

ipchains -A output -s private net address -d 0/0 -j ACCEPT
-l

These logs would be huge with over 10 users actively using the internet. If you have an idea of what kind of traffic you are looking for that would make it easier to log it...
You could run tcpdump or another packet sniffer to monitor user traffic.

OTOH:
Real time monitoring and active ids can be handled by a product called psionic port sentry-this may be the solution you are looking for rather than plain jane ipchains.

 

[ifincham]

Hi,

Marsd has given you the basics of what to do - I would add, however, that you will almost certainly need to allow more than just port 80 through - for example https/ssl uses port 443. Also, in trying to block all those 'phone-home' progs you will also be blocking icq / yahoo messenger / real-audio, etc, etc., unless you allow the related ports through the firewall.

A good reference on tcp/udp ports can be found at -->

http://advice.networkice.com/advice/Exploits/Ports/default.htm

. You can click on the port numbers on that list to get more detail.

Regards

 

[fenris]

Well I want to be able to detect when a piece of software that should have nothing to do with the internet (power point 2000) tries to use it.....

If I can log which machines port they are coming from and if I can see a pattern I'll block it. But what I am trying to do is something similar to what zonealarm does for windows.

Thanks for the input...
Troy Williams B.Eng.
fenris@hotmail.com

 

[marsd]

Thats basically what you could do with something like port sentry..all these firewalls need rulesets-> there's not an
automagic detect win phone home seting;-)