Simple problem with ....

[FredrikN]

Hi, I'm trying to write an Online Firewall creator but I have one problem.

This will fix Masq and Forwarding

echo '1'> /proc/sys/net/ipv4/ip_forward
/sbin/iptables --table nat --append POSTROUTING -o eth1 -j MASQUERADE
/sbin/iptables --append FORWARD --in-interface eth0 -j ACCEPT


But problem is that anything from eth1(LAN) will be accepted
out to Internet.

I want to enable Masq and Forwarding AND by default deny everything from eth1.

And then I want to open upp some selected ports, udp and tcp.

I have been reading some docs but can't figure it out

Does anyone have a clue ?

 

[marsd]

Okay..
You are coding a cgi for scenario based firewall sets?
That's a neat idea, I've had it before but was too lazy
to code it .

The first thing I would do is define the level for your
rules, casual rules, medium security, lockdown, etc..

From the above I can't tell if you are thinking that this
is a general solution for all seasons.

For my rulesets I will do a basic masq but define it
by protocol and by source/dest. I will also create a logchain and stateful chain for certain situations. My forwarding rules save me most worries about overall
security anyway.

I could add this rule:
eval $cmd -t nat -A POSTROUTING -s $loc_net -o eth1 -j MASQUERADE
#end masquerading rules.
#dnat redirect
And this one..
eval $cmd -t nat -A PREROUTING -i eth1 -p tcp --syn --dport 80 -j DNAT --to-destination x.x.x.x:8015
etc..

But if my forwarding rules look like:
##################################################
(POLICYROP)
eval $cmd -A FORWARD -s $loc_net -d 0/0 -o eth1 -j ACCEPT
eval $cmd -A FORWARD -s ! $loc_net -d $loc_net -p tcp --dport 1024:5800 -j ACCEPT
eval $cmd ! $loc_net -d $loc_net -p icmp -j ACCEPT
eval $cmd -A FORWARD -s ! $loc_net -d $loc_net -p udp --dport 1024:5800 -j ACCEPT
eval $cmd -A FORWARD -s ! $loc_net -d $loc_net -p tcp --dport 30000:65000 -j ACCEPT
eval $cmd -A FORWARD -s ! $loc_net -d $loc_net -p udp --dport 30000:65000 -j ACCEPT
#######################################################
The dnat rule is broken.

You can either use OUTPUT rules for your situation,
FORWARD rules, or a custom chain eval'd in one or both.

 

[FredrikN]

Okej, thanks

Will take a look at it

Anyway, here is my project, but remember it's still Beta but if you have any suggestions you are welcome

http://www.thegate.nu/pfg/

//FredrikN