Next we write the rules to deny all traffic coming towards our MAIN network on the WLAN interface:

#BLOCK WiFI FROM REACHING 192.168.1.0/24 or 192.168.0.0/24
echo “-> BLOCKING WiFi”
$IPT -A FORWARD -i eth1 -p all -s $any -d $good -j DROP

Then we allow DNS queries from our MAIN network. Keep in mind, the default policies are locked down completely. This means you have to allow every service specifically.

#accept dns
echo “-> ALLOWING DNS”
$IPT -A INPUT -i eth0 -p udp -s $good -d 192.168.0.9/32 –dport 53 -j ACCEPT

Now we will allow traffic between all GOOD networks and traffic coming to the server on the MAIN interface.

#ACCEPT FROM LAN
echo “-> ALLOWING LAN”
$IPT -A lan -i eth0 -p all -s $good -d $good-j ACCEPT
$IPT -A lan -i eth0 -p all -s $good -d $good–j ACCEPT
$IPT -A lan -i tun1 -p all -s $good -d $good–j ACCEPT
$IPT -Alan-i tun0 -p all -s $good -d $good- -j ACCEPT
$IPT -A INPUT -j lan
$IPT -A OUTPUT -j lan
$IPT -A FORWARD -j lan

Now we will accept OpenVPN connections on both interfaces and SSH on both. This will nail it down quite nicely.

#Accept OPENVPN. Duh.
echo “-> ACCEPTING OPENVPN”
$IPT -A vpn -i eth0 -p tcp -s $any –destination-port 9000 -j ACCEPT
$IPT -A vpn -i eth1 -p tcp -s $bad –destination-port 9000 -j ACCEPT
$IPT -A vpn-o eth1-p tcp –source-port 9000 -j ACCEPT
$IPT -A vpn-o eth0 -p tcp –source-port 9000 -j ACCEPT
$IPT -A INPUT -i eth1 -p tcp -s $bad –destination-port 22 -j ACCEPT
$IPT -A INPUT -i eth0 -p tcp -s $any –destination-port 22 -j ACCEPT
$IPT -A INPUT -j vpn
$IPT -A OUTPUT -j vpn

And last but not least we make the log chain, this allows s to prefix the log entry with anything so it is easier to spot in the logs.

$IPT -A log -j LOG –log-level info –log-prefix “IPTABLES: ”
$IPT -A log -j DROP
$IPT -A INPUT -j log
$IPT -A OUTPUT-j log
$IPT -A FORWARD -j log

There you have it, now you can save the file and run it. After that you can check with iptables -L and see if your tables are there. Also verify your traffic, is everything working. If it isn’t check the logs it tells you from where it did not allow something.

Any thoughts and comments are welcome. A special thanks goes to mobsec.com for letting me write about this ?venture?. If you want to go after a big script and want to try out dissecting it, here is a very good example!
//Flosse

If you are interested in the full series,pick another part, or just go to the category root:

• Category: /sbin/iptables
• IPTables explained: Part 1 (a tutorial to understanding and creating your own rules)
• IPTABLES explained : Part 2 ( or a how to for iptables about efficient rule design)
• IPTABLES explained: Part 3 (Creating a complex IPTables script)

Also if you want to go further with iptables HERE is a very good article about restricting iptables by time of the day!

Popularity: 9% [?]

Pages: 1 2