setting up ipchains

[cleansedbb]

I have set up my ipchains as the following
my question is, am I blocking the Bad IP's right?
i.e. will
-A input -s 152.163.0.0/16 -d 0/0 -p tcp -y -j DENY
block 152.163.0.0-152.163.255.255
and should I move my deny ports up or leave them
at the bottom? I tried setting
:input DENY
:forward DENY
utput DENY
but it wouldnt let me do anything to an outside address
even if I setup rules to allow it.

running nmap on the local pc I show that 80,22,111,6000 are the only ports open.
yet running a superscan from an external pc I show 80-83 8080, 1080, 110, 25, 21, 22, 389, etc...
none of which I can connect to but ports 80 and 22 which are supposed to be open.


so heres what I have now:

#########################################################
:input ACCEPT
:forward ACCEPT
utput ACCEPT
######
# allow http/ssh/local
-A input -s 0/0 -d 0/0 80 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 22 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 -i lo -j ACCEPT
######
# block sunrpc/X
-A input -s 0/0 -d 0/0 6000:6009 -p tcp -y -j DENY
-A input -s 0/0 -d 0/0 111 -p tcp -y -j DENY
######
# block bad ip (aol)
-A input -s 152.163.0.0/16 -d 0/0 -p tcp -y -j DENY
-A input -s 152.163.0.0/16 -d 0/0 -p udp -j DENY
-A input -s 152.163.0.0/16 -d 0/0 -p icmp -j DENY
######
# block all
-A input -s 0/0 -d 0/0 -p tcp -y -j DENY
-A input -s 0/0 -d 0/0 -p udp -j DENY
-A input -s 0/0 -d 0/0 -p icmp -j DENY

 

[Norwich]

My preference would be to block all and tben only permit what you require - that way, there's no worry of anything 'creeping in'.

A good tool to use is:

http://www.linux-firewall-tools.com/linux/firewall/index.html

as is the rest of the site...

It'll generate a hugh and complex ipchains script but even if you don't use it, it's a really good study aid - so to speak.

 

[cleansedbb]

thank you, very informative site

 

[ifincham]

Hi,

Your rules are a little confused - what you do is first choose the default you prefer, i.e. do you allow everything by default or deny everything ? The '-P' flag indicates these default policies - e.g. :

/sbin/ipchains -P input DENY
/sbin/ipchains -P output DENY
/sbin/ipchains -P forward DENY

You then only need to code the exceptions, i.e. the rules that ACCEPT the packets you want to allow if you default to DENY or REJECT. Obviously the reverse also applies - you only need to code DENY or REJECT rules if your default is to ACCEPT.

See -->

http://netfilter.samba.org/ipchains/HOWTO-4.html#ss4.1

Regards

 

[cleansedbb]

the chain i posted was autogenerated with lokkit, I used the site posted aboved and it works a lot better.