Hello, i wold like to change the VDP IPTABLES defualt rules.
I Need to close all Incoming traffic except for my network xxx.xxx.xxx.xxx
Someone can show me the best way to do this hardening ?
I have find This:
less /etc/firewall.default
#!/bin/sh
# This is to be installed/run on each of the Avamar nodes on
# the customer network.
# In the case that something goes terribly wrong invoke the command:
# "service avfirewall stop" for SLES or "iptables stop" for RHEL.
# To see if the parameters are loaded run "service avfirewall status"
# on SLES or "iptables -L" on RHEL.
#-- OP_MODE should be set in the /etc/firewall.conf file
if [ -z "$OP_MODE" ]; then
#-- OP_MODE wasn't set ... just default to FULL
OP_MODE="FULL"
fi
# 1. Path to the iptables command
IPT=`which iptables`
#sleep 10
MYIP=`hostname -i`
# 2. Flush old rules, old custom tables
$IPT --flush
$IPT --delete-chain
# 3. Set default policies for all three default chains, drop all incoming and
# forwarded packets, allow outgoing packets
# NOTE: Since the "default" policy of the outbound connections is "ACCEPT",
# we do not need any further "OUTPUT" rules (except for the loopback interface)
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT ACCEPT
# 4. Enable free use of loopback interfaces
$IPT -A INPUT -s 127.0.0.1 -j ACCEPT
$IPT -A OUTPUT -s 127.0.0.1 -j ACCEPT
# 5. Allow returning packets
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# 6. Allow ICMP traffic - for network debugging
$IPT -A INPUT -p icmp -j ACCEPT
# 7. Allow DNS and NTP access from any servers
# NOTE: add a "-s <ip address>" before the "-j" to specify which
# DNS and NTP servers may be allowed
#$IPT -A INPUT -p udp --dport 53 -j ACCEPT
#$IPT -A INPUT -p tcp --dport 53 -j ACCEPT
#$IPT -A INPUT -p udp --dport 123 -j ACCEPT
#$IPT -A INPUT -p tcp --dport 123 -j ACCEPT
# 8. Allow everyone to communicate on required ports
#$IPT -A INPUT -p tcp -m multiport --dport 22,80,443,7778,7779,7780,7781,8443,28001 -j ACCEPT
# allow port for MC Web services
#$IPT -A INPUT -p tcp --dport 9443 -j ACCEPT
# allow LDAP and LoginManager connections
#$IPT -A INPUT -p udp -m multiport --dport 389,700 -j ACCEPT
#$IPT -A INPUT -p tcp -m multiport --dport 389,700 -j ACCEPT
#$IPT -A OUTPUT -p tcp -m multiport --sport 389,700 -j ACCEPT
#$IPT -A OUTPUT -p udp -m multiport --sport 389,700 -j ACCEPT
#
# appliance can talk to itself
#
$IPT -A INPUT -p tcp -s $MYIP -d $MYIP -j ACCEPT
#
# Necessary for VDP to operate
$IPT -A OUTPUT -p tcp -m multiport --sport 22,80,902,7444,7778,8543,8580,9443 -j ACCEPT
$IPT -A OUTPUT -p udp -m multiport --sport 53,137,138 -j ACCEPT
#
$IPT -A INPUT -p tcp -m multiport --dport 22,80,902,7444,7778,8543,8580,9443 -j ACCEPT
$IPT -A INPUT -p udp -m multiport --dport 53,137,138 -j ACCEPT
#
$IPT -A INPUT -p tcp -m multiport --sport 7444 -j ACCEPT
#
# open communication on these encrypted ports
#
$IPT -A INPUT -p tcp --sport 443 -j ACCEPT
$IPT -A INPUT -p tcp --sport 9443 -j ACCEPT
#
# gsan ports
#
$IPT -A INPUT -p tcp -s $MYIP -d $MYIP --sport 27000 -j ACCEPT
$IPT -A INPUT -p tcp -s $MYIP -d $MYIP --sport 29000 -j ACCEPT
$IPT -A INPUT -p tcp -s $MYIP -d $MYIP --dport 27000 -j ACCEPT
$IPT -A INPUT -p tcp -s $MYIP -d $MYIP --dport 29000 -j ACCEPT
$IPT -A OUTPUT -p tcp -s $MYIP -d $MYIP --sport 27000 -j ACCEPT
$IPT -A OUTPUT -p tcp -s $MYIP -d $MYIP --sport 29000 -j ACCEPT
$IPT -A OUTPUT -p tcp -s $MYIP -d $MYIP --dport 27000 -j ACCEPT
$IPT -A OUTPUT -p tcp -s $MYIP -d $MYIP --dport 29000 -j ACCEPT
# New filter to stop UDP flooding
#$IPT -I INPUT -p tcp --dport 26000 -m state --state NEW -m recent --set
#$IPT -I INPUT -p tcp --dport 26000 -m state --state NEW -m recent --update --seconds 60 --hitcount 20 -j DROP
# 9. Allow everyone to communicate on GSAN required port ranges
#$IPT -A INPUT -p tcp -m multiport --dport 19000:19500 -j ACCEPT
#$IPT -A INPUT -p udp -m multiport --dport 19000:19500 -j ACCEPT
#$IPT -A INPUT -p tcp -m multiport --dport 20000:20500 -j ACCEPT
#$IPT -A INPUT -p udp -m multiport --dport 20000:20500 -j ACCEPT
#$IPT -A INPUT -p tcp -m multiport --dport 25000:25500 -j ACCEPT
#$IPT -A INPUT -p udp -m multiport --dport 25000:25500 -j ACCEPT
#$IPT -A INPUT -p tcp -m multiport --dport 26000:26500 -j ACCEPT
#$IPT -A INPUT -p udp -m multiport --dport 26000:26500 -j ACCEPT
#$IPT -A INPUT -p tcp -m multiport --dport 27000:27500 -j ACCEPT
#$IPT -A INPUT -p tcp -m multiport --dport 40000:45000 -j ACCEPT
# possible ports for apache tomcat mod_jk proxy tool
#$IPT -A INPUT -p tcp -m multiport --dport 8543,8580 -j ACCEPT
# 10. Allow SNMP traffic
# management console traffic
#$IPT -A INPUT -p udp --dport 161 -j ACCEPT
# data domain traps traffic
#$IPT -A INPUT -p udp --dport 162 -j ACCEPT
#
# Allow everyone communication on ports 27000/27001/27002
# NOTE: should this ONLY be for localhost and would be covered by rule 4
#$IPT -A INPUT -p tcp -m multiport --destination-port 27000,27001,27002 -j ACCEPT
# 11. Allow everyone to communicate in on ports 29000/29100 for stunnel
#$IPT -A INPUT -p tcp -m multiport --destination-port 29000,29100 -j ACCEPT
# 12. Allow everyone to communicate on ports range from 8778 to 8781
#$IPT -A INPUT -p tcp -m multiport --dport 8778:8781 -j ACCEPT
# 13. Allow DTLT default ports to be open
#$IPT -A INPUT -p tcp -m multiport --destination-port 8080,8181,8444 -j ACCEPT
# DROP all other traffic and log it
# 14. Create a LOGDROP chain to log and drop packets
LOGLIMIT="2/s"
LOGLIMITBURST="10"
$IPT -N LOGDROP
$IPT -A LOGDROP -p tcp -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-level 7 --log-prefix "TCP LOGDROP: "
$IPT -A LOGDROP -p udp -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-level 7 --log-prefix "UDP LOGDROP: "
$IPT -A LOGDROP -p icmp -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-level 7 --log-prefix "ICMP LOGDROP: "
$IPT -A LOGDROP -f -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-level 7 --log-prefix "FRAGMENT LOGDROP: "
$IPT -A LOGDROP -j DROP
$IPT -A INPUT -p icmp -j LOGDROP -m pkttype ! --pkt-type broadcast
$IPT -A INPUT -p tcp -j LOGDROP -m pkttype ! --pkt-type broadcast
$IPT -A INPUT -p udp -j LOGDROP -m pkttype ! --pkt-type broadcast
$IPT -A INPUT -p tcp -j REJECT --reject-with tcp-reset
root@nastoosquare:/etc/init.d/rc3.d/#: service avfirewall status
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- localhost.localdomain anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT tcp -- nastoosquare.virtualsolution.net nastoosquare.virtualsolution.net
ACCEPT tcp -- anywhere anywhere multiport dports ssh,http,ideafarm-door,7444,interwise,8543,8580,tungsten-https
ACCEPT udp -- anywhere anywhere multiport dports domain,netbios-ns,netbios-dgm
ACCEPT tcp -- anywhere anywhere multiport sports 7444
ACCEPT tcp -- anywhere anywhere tcp spt:https
ACCEPT tcp -- anywhere anywhere tcp spt:tungsten-https
ACCEPT tcp -- nastoosquare.virtualsolution.net nastoosquare.virtualsolution.net tcp spt:27000
ACCEPT tcp -- nastoosquare.virtualsolution.net nastoosquare.virtualsolution.net tcp spt:29000
ACCEPT tcp -- nastoosquare.virtualsolution.net nastoosquare.virtualsolution.net tcp dpt:27000
ACCEPT tcp -- nastoosquare.virtualsolution.net nastoosquare.virtualsolution.net tcp dpt:29000
LOGDROP icmp -- anywhere anywhere PKTTYPE != broadcast
LOGDROP tcp -- anywhere anywhere PKTTYPE != broadcast
LOGDROP udp -- anywhere anywhere PKTTYPE != broadcast
REJECT tcp -- anywhere anywhere reject-with tcp-reset
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- localhost.localdomain anywhere
ACCEPT tcp -- anywhere anywhere multiport sports ssh,http,ideafarm-door,7444,interwise,8543,8580,tungsten-https
ACCEPT udp -- anywhere anywhere multiport sports domain,netbios-ns,netbios-dgm
ACCEPT tcp -- nastoosquare.virtualsolution.net nastoosquare.virtualsolution.net tcp spt:27000
ACCEPT tcp -- nastoosquare.virtualsolution.net nastoosquare.virtualsolution.net tcp spt:29000
ACCEPT tcp -- nastoosquare.virtualsolution.net nastoosquare.virtualsolution.net tcp dpt:27000
ACCEPT tcp -- nastoosquare.virtualsolution.net nastoosquare.virtualsolution.net tcp dpt:29000
Chain LOGDROP (3 references)
target prot opt source destination
LOG tcp -- anywhere anywhere limit: avg 2/sec burst 10 LOG level debug prefix `TCP LOGDROP: '
LOG udp -- anywhere anywhere limit: avg 2/sec burst 10 LOG level debug prefix `UDP LOGDROP: '
LOG icmp -- anywhere anywhere limit: avg 2/sec burst 10 LOG level debug prefix `ICMP LOGDROP: '
LOG all -f anywhere anywhere limit: avg 2/sec burst 10 LOG level debug prefix `FRAGMENT LOGDROP: '
DROP all -- anywhere anywhere
-------------------------------------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------------------------------------
What do you think about this changes:
Original
$IPT -A OUTPUT -p tcp -m multiport --sport 22,80,902,7444,7778,8543,8580,9443 -j ACCEPT
$IPT -A OUTPUT -p udp -m multiport --sport 53,137,138 -j ACCEPT
Modified
$IPT -A OUTPUT -p tcp -m multiport -s xx.57.10.0/24 -d xx.57.10.0/24 --sport 22,80,902,7444,7778,8543,8580,9443 -j ACCEPT
$IPT -A OUTPUT -p udp -m multiport -s xx.57.10.0/24 -d xx.57.10.0/24 --sport 53,137,138 -j ACCEPT
--------------------------------------------------------------------------------------------------
Original
$IPT -A INPUT -p tcp -m multiport --dport 22,80,902,7444,7778,8543,8580,9443 -j ACCEPT
$IPT -A INPUT -p udp -m multiport --dport 53,137,138 -j ACCEPT
Modified
$IPT -A INPUT -p tcp -m multiport -s xx.57.10.0/24 -d xx.57.10.0/24 --dport 22,80,902,7444,7778,8543,8580,9443 -j ACCEPT
$IPT -A INPUT -p udp -m multiport -s xx.57.10.0/24 -d xx.57.10.0/24 --dport 53,137,138 -j ACCEPT
--------------------------------------------------------------------------------------------------
$IPT -A INPUT -p tcp -m multiport -s xx.57.10.0/24 -d xx.57.10.0/24 --sport 7444 -j ACCEPT
$IPT -A INPUT -p tcp --s xx.57.10.0/24 -d xx.57.10.0/24 --sport 443 -j ACCEPT
$IPT -A INPUT -p tcp -s xx.57.10.0/24 -d xx.57.10.0/24 --sport 9443 -j ACCEPT
Thanks
ps
default rules are this:
Chain INPUT (policy DROP 3367 packets, 263K bytes)
pkts bytes target prot opt in out source destination
156K 25M ACCEPT all -- * * 127.0.0.1 0.0.0.0/0
757K 370M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
34 2806 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
5115 306K ACCEPT tcp -- * * xx.57.10.221 xx.57.10.221
193 10484 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 22,80,902,7444,7778,8543,8580,9443
896 92128 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 53,137,138
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport sports 7444
2 88 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:443
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:9443
0 0 ACCEPT tcp -- * * xx.57.10.221 xx.57.10.221 tcp spt:27000
0 0 ACCEPT tcp -- * * xx.57.10.221 xx.57.10.221 tcp spt:29000
0 0 ACCEPT tcp -- * * xx.57.10.221 xx.57.10.221 tcp dpt:27000
0 0 ACCEPT tcp -- * * xx.57.10.221 xx.57.10.221 tcp dpt:29000
0 0 LOGDROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 PKTTYPE != broadcast
125 6805 LOGDROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 PKTTYPE != broadcast
54 3862 LOGDROP udp -- * * 0.0.0.0/0 0.0.0.0/0 PKTTYPE != broadcast
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with tcp-reset
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 470K packets, 159M bytes)
pkts bytes target prot opt in out source destination
156K 25M ACCEPT all -- * * 127.0.0.1 0.0.0.0/0
207K 120M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport sports 22,80,902,7444,7778,8543,8580,9443
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 multiport sports 53,137,138
36416 14M ACCEPT tcp -- * * xx.57.10.221 xx.57.10.221 tcp spt:27000
33 10198 ACCEPT tcp -- * * xx.57.10.221 xx.57.10.221 tcp spt:29000
42448 7299K ACCEPT tcp -- * * xx.57.10.221 xx.57.10.221 tcp dpt:27000
43 7048 ACCEPT tcp -- * * xx.57.10.221 xx.57.10.221 tcp dpt:29000
Chain LOGDROP (3 references)
pkts bytes target prot opt in out source destination
125 6805 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 2/sec burst 10 LOG flags 0 level 7 prefix `TCP LOGDROP: '
54 3862 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 2/sec burst 10 LOG flags 0 level 7 prefix `UDP LOGDROP: '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 2/sec burst 10 LOG flags 0 level 7 prefix `ICMP LOGDROP: '
0 0 LOG all -f * * 0.0.0.0/0 0.0.0.0/0 limit: avg 2/sec burst 10 LOG flags 0 level 7 prefix `FRAGMENT LOGDROP: '
179 10667 DROP all -- * * 0.0.0.0/0 0.0.0.0/0