building first iptables firewall ;)

illvzn · n00b Joined: 18 Jan 2003 Posts: 47

I need help/resources for building a very simple firewall to secure my workstation.

So far all I can think of needing info on is how to (drop) all packets, except for ones that I request through programs that I'm running... such as, mozilla/konqueror, gaim, tribes2, quake3, ut2k3, irc clients... just common stuff.

If I could get a simple script setup, I could then read some documentation and then add more features... make this a learning process so that if I needed to allow ssh, telnet connections then I would know what to add to my script

Any help would be greatly appreciated. I think I'm not very good at googling

tod · Posted: Tue May 13, 2003 5:58 am Post subject:

A good start would be
http://www-106.ibm.com/developerworks/edu/l-dw-linuxfw-i.html

I would then suggest merging net-firewall/fwbuilder ( it features a druid to get you started quickly).

If you subscribe or have access to Linux Journal at a library, the May and June issues have a pretty good walkthrough of fwbuilder in the Paranoid Penguin section by Mick Bauer.

hth

69link · n00b Joined: 18 Apr 2003 Posts: 53 Location: Sweden

If you want to build your own script, then I definately recommend reading: http://iptables-tutorial.frozentux.net/

There are some examplescripts there aswell. Building your own iptables-script can be problematic at first, but there are alot of "live" examples out there:
http://www.kurd.nu/
http://www.knowplace.org/netfilter/index.html
http://www.sns.ias.edu/~jns/security/iptables/

petu · Posted: Tue May 13, 2003 10:47 am Post subject:

I started making my iptables rules by simply creating these rules:

neilhwatson · l33t Joined: 06 Feb 2003 Posts: 719 Location: Canada

petu has the right of it. There is one golden rule to making firewalls regardless of what OS or tools you are using:

Deny everything by default (input, output, and forward). Then turn on only what you need.

It's harder to do but, you are less likely to have unwanted holes.

You can also try www.netfilter.org, the makers of Iptables. Also, O'Reilly has a book Building Internet Firewall that is a great reference on network services and how filter them.
_________________
The true guru is a teacher.
Neil Watson

elykyllek · Posted: Tue May 13, 2003 7:04 pm Post subject: i used this

looking or using these firewalls would be a good start.

Jimbow · Posted: Tue May 13, 2003 8:17 pm Post subject:

I have been using rc.firewall from http://projectfiles.com/firewall/

It is a single GPL'ed bash script. It is easy to run and configure and does exactly what you are asking for (plus more if desired). I've been thinking about making an ebuild for it.
_________________
After Perl everything else is just assembly language.