Algenon
n00b
Joined: 27 Jan 2005
Posts: 48
Location: Ashby-de-la-Zouch, UK
|
 Posted: Sun Sep 04, 2005 9:09 am Post subject: Firewall mods for wireless LAN and NTP |
 |
|
I have a laptop running Gentoo 2005.1 and a desktop (also Gentoo). The laptop is running on a wireless LAN to a D-Link router. The router is connected to a cable modem and ethernet cable to the desktop unit, thus both machines can access the internet. Both machines are using iptables for a firewall, the desktop has NFS ports locked using the excellent tutorial at https://forums.gentoo.org/viewtopic-t-77748-highlight-statd.html. I have been using the iptables config below (which came from this forum) for a couple of years now with no signs of any attempt by malicious users to break-in. However, I wish to open up the desk top machine for file access using NFS. My plan is this. Keep the laptop firewall as is. Block ports for NFS 2049, quotad, status and mountd at ports 32764-32767 in the router to prevent internet access (allowing only LAN access) and open up the desktop machine ports for NFS, quotad, status and moutd. I am not really sure how to do this and would it leave my desktop machine vulnerable? Any advice would be welcome.
iptables set up as below.
| Code: | #!/bin/sh
# Set location of iptables
IPTABLES=/sbin/iptables
# Define interfaces
PUBLIC_IF="eth0"
# Flush current rules
$IPTABLES -t nat -F
$IPTABLES -t filter -F
$IPTABLES -t mangle -F
# Delete custom chains
$IPTABLES -t nat -X
$IPTABLES -t filter -X
$IPTABLES -t mangle -X
# Set default policies
$IPTABLES -t filter -P INPUT DROP
$IPTABLES -t filter -P FORWARD DROP
$IPTABLES -t filter -P OUTPUT ACCEPT
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P INPUT ACCEPT
$IPTABLES -t mangle -P FORWARD ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT
$IPTABLES -t mangle -P POSTROUTING ACCEPT
# Allow traffic from trusted interfaces
$IPTABLES -A INPUT -i lo -j ACCEPT
# Allow traffic from established connections
$IPTABLES -A INPUT -i $PUBLIC_IF -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow typical ICMP responses
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 4 -j ACCEPT
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT |
Regards,
Algenon. 
Last edited by Algenon on Sun Sep 04, 2005 7:58 pm; edited 1 time in total |
|
Networking & Security
