Scribd
Upload
79 views4 pages

Iptables Rules for 10.5.0.1 Configuration

The document contains the configuration and rules for iptables on a Linux firewall. It shows: 1. Listing the existing iptables rules and default policies for the INPUT, FORWARD, and OUTPUT chains. 2. Removing all rules and resetting default policies. 3. Restricting the OUTPUT chain policy to DROP. 4. Re-adding rules to allow established connections and define rules for DNS, web, and SSH traffic between internal and external networks. 5. Additional rules are added to allow firewall updates and outbound internet access.

Uploaded by

Víctor Pinto
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
79 views4 pages

Iptables Rules for 10.5.0.1 Configuration

The document contains the configuration and rules for iptables on a Linux firewall. It shows: 1. Listing the existing iptables rules and default policies for the INPUT, FORWARD, and OUTPUT chains. 2. Removing all rules and resetting default policies. 3. Restricting the OUTPUT chain policy to DROP. 4. Re-adding rules to allow established connections and define rules for DNS, web, and SSH traffic between internal and external networks. 5. Additional rules are added to allow firewall updates and outbound internet access.

Uploaded by

Víctor Pinto
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd

1) Listar Reglas

root@fw:~# iptables -n -L -v
Chain INPUT (policy DROP 7 packets, 2296 bytes)
pkts bytes target prot opt in out source destination

0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0


state RELATED,ESTABLISHED
89 7446 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
1 101 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- lo * 0.0.0.0/0 0.0.0.0/0

1 73 ACCEPT udp -- lo * 0.0.0.0/0 0.0.0.0/0

0 0 ACCEPT icmp -- lo * 0.0.0.0/0 0.0.0.0/0

0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0


icmptype 8 state NEW

Chain FORWARD (policy DROP 3 packets, 984 bytes)


pkts bytes target prot opt in out source destination

0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0


state RELATED,ESTABLISHED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- eth2 eth0 10.5.2.0/24 0.0.0.0/0
state NEW
2 656 ACCEPT udp -- eth2 eth0 10.5.2.0/24 0.0.0.0/0
state NEW
0 0 ACCEPT icmp -- eth2 eth0 10.5.2.0/24 0.0.0.0/0
state NEW
0 0 ACCEPT udp -- eth1 * 10.5.1.0/24 10.5.0.1
udp dpt:53 state NEW
0 0 ACCEPT tcp -- eth1 * 10.5.1.0/24 10.5.0.1
tcp dpt:53 state NEW
0 0 ACCEPT tcp -- eth1 eth0 10.5.1.0/24 0.0.0.0/0
state NEW
0 0 ACCEPT tcp -- * eth1 0.0.0.0/0 10.5.1.11
tcp dpt:20 state NEW
0 0 ACCEPT tcp -- * eth1 0.0.0.0/0 10.5.1.11
tcp dpt:21 state NEW
0 0 ACCEPT tcp -- * eth1 0.0.0.0/0 10.5.1.10
tcp dpt:80 state NEW
0 0 ACCEPT tcp -- * eth1 0.0.0.0/0 10.5.1.10
tcp dpt:443 state NEW
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmptype 8 state NEW

Chain OUTPUT (policy ACCEPT 91 packets, 6103 bytes)


pkts bytes target prot opt in out source destination

2) Eliminar reglas
root@fw:~# iptables -F
root@fw:~# iptables -n -L -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy DROP 0 packets, 0 bytes)


pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)


pkts bytes target prot opt in out source destination

3) Restringir tráfico de la cadena faltante

root@fw:~# iptables -P OUTPUT DROP


root@fw:~# iptables -L -v -n
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy DROP 0 packets, 0 bytes)


pkts bytes target prot opt in out source destination

Chain OUTPUT (policy DROP 0 packets, 0 bytes)


pkts bytes target prot opt in out source destination

root@fw:~#

4)registrar nuevamente las reglas para el dominio example.net

iptables -A FORWARD -m state --state ESTABLISHED


iptables -A INPUT -m state --state ESTABLISHED
iptables -A OUTPUT -m state --state ESTABLISHED

iptables -A FORWARD -s 10.5.1.0/24 -i eth1 -d 10.5.0.1 -p udp --dport 53 -m state


--state NEW -j LOG
iptables -A FORWARD -s 10.5.1.0/24 -i eth1 -d 10.5.0.1 -p udp --dport 53 -m state
--state NEW -j ACCEPT

iptables -A FORWARD -s 10.5.1.0/24 -i eth1 -d 10.5.0.1 -p tcp --dport 53 -m state


--state NEW -j LOG
iptables -A FORWARD -s 10.5.1.0/24 -i eth1 -d 10.5.0.1 -p tcp --dport 53 -m state
--state NEW -j ACCEPT

iptables -A FORWARD -s 0.0.0.0/0 -d 10.5.1.11 -o eth1 -p tcp --dport 20 -m state


--state NEW -j LOG
iptables -A FORWARD -s 0.0.0.0/0 -d 10.5.1.11 -o eth1 -p tcp --dport 20 -m state
--state NEW -j ACCEPT

iptables -A FORWARD -s 0.0.0.0/0 -d 10.5.1.11 -o eth1 -p tcp --dport 21 -m state


--state NEW -j LOG
iptables -A FORWARD -s 0.0.0.0/0 -d 10.5.1.11 -o eth1 -p tcp --dport 21 -m state
--state NEW -j ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -d 10.5.1.10 -o eth1 -p tcp --dport 80 -m state
--state NEW -j LOG
iptables -A FORWARD -s 0.0.0.0/0 -d 10.5.1.10 -o eth1 -p tcp --dport 80 -m state
--state NEW -j ACCEPT

iptables -A FORWARD -s 0.0.0.0/0 -d 10.5.1.10 -o eth1 -p tcp --dport 443 -m state


--state NEW -j LOG
iptables -A FORWARD -s 0.0.0.0/0 -d 10.5.1.10 -o eth1 -p tcp --dport 443 -m state
--state NEW -j ACCEPT

******permite mantener la comunicación de las conexiones ya establecidas


iptables -A FORWARD -m state --state ESTABLISHED

******agregar puertos 80 y 443 con una sola regla


iptables -A FORWARD -s 0.0.0.0/0 -d 10.5.1.10 -o eth1 -p tcp -m multiport --source-
port 80,443 -m state --state NEW -j LOG
iptables -A FORWARD -s 0.0.0.0/0 -d 10.5.1.10 -o eth1 -p tcp -m multiport --source-
port 80,443 -m state --state NEW -j ACCEPT

5) Permitir resolución DNS públic Google 8.8.8.8


---iptables -A OUTPUT -s 10.5.2.0/24 -o eth0 -d 8.8.8.8 -p udp --dport 53 -m state
--state NEW -j LOG
---iptables -A OUTPUT -s 10.5.2.0/24 -o eth0 -d 8.8.8.8 -p udp --dport 53 -m state
--state NEW -j ACCEPT

---iptables -A INPUT -s 0.0.0.0/0 -i eth0 -d 10.5.2.0/24 -p udp --dport 53 -m state


--state NEW -j LOG
---iptables -A INPUT -s 0.0.0.0/0 -i eth0 -d 10.5.2.0/24 -p udp --dport 53 -m state
--state NEW -j ACCEPT

iptables -A FORWARD -s 10.5.2.0/24 -i eth2 -d 8.8.8.8 -p udp --dport 53 -m state


--state NEW,ESTABLISHED -j LOG
iptables -A FORWARD -s 10.5.2.0/24 -i eth2 -d 8.8.8.8 -p udp --dport 53 -m state
--state NEW,ESTABLISHED -j ACCEPT

--iptables -A FORWARD -s 8.8.8.8 -i eth0 -d 10.5.2.0/24 -p udp --dport 53 -m state


--state NEW,ESTABLISHED -j LOG ?
--iptables -A FORWARD -s 8.8.8.8 -i eth0 -d 10.5.2.0/24 -p udp --dport 53 -m state
--state NEW,ESTABLISHED -j ACCEPT ?

6) conexiones desde la red local hacía el server web en la DMZ


iptables -A FORWARD -s 10.5.2.0/24 -i eth2 -d 10.5.1.10 -p tcp -m multiport
--source-port 80,443 -m state --state NEW,ESTABLISHED -j LOG
iptables -A FORWARD -s 10.5.2.0/24 -i eth2 -d 10.5.1.10 -p tcp -m multiport
--source-port 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT

7) Conexiones desde la red local hacía servidores web en internet


iptables -A FORWARD -s 10.5.2.0/24 -i eth2 -d 0.0.0.0/0 -p tcp -m multiport
--source-port 80,443 -m state --state NEW,ESTABLISHED -j LOG
iptables -A FORWARD -s 10.5.2.0/24 -i eth2 -d 0.0.0.0/0 -p tcp -m multiport
--source-port 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT

8) Se desea permitir conexiones desde internet al servidor web por HTTP en la DMZ
iptables -A FORWARD -s 0.0.0.0/0 -i eth0 -d 10.5.1.10 -p tcp --dport 80 -m state
--state NEW,ESTABLISHED -j LOG
iptables -A FORWARD -s 0.0.0.0/0 -i eth0 -d 10.5.1.10 -p tcp --dport 80 -m state
--state NEW,ESTABLISHED -j ACCEPT
9) permitir conexiones SSH desde la red local
iptables -A INPUT -p tcp -s 10.5.2.0/24 --dport 22 -m conntrack --ctstate
NEW,ESTABLISHED -j LOG
iptables -A INPUT -p tcp -s 10.5.2.0/24 --dport 22 -m conntrack --ctstate
NEW,ESTABLISHED -j ACCEPT

se agrega porque la política OUTPUT se encuentra en modo DROP


iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j LOG
iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

10) Permitir al firewall conexion a internet para actualizarce


iptables -A OUTPUT -o eth0 -d 82.194.78.250 -p tcp -m multiport --source-port
80,443 -m state --state NEW,ESTABLISHED -j LOG
iptables -A OUTPUT -o eth0 -d 82.194.78.250 -p tcp -m multiport --source-port
80,443 -m state --state NEW,ESTABLISHED -j ACCEPT

You might also like