Tag: Firewall

CentOS 7 – Firewalld allow all traffic from a Server

Leave a comment

I hate the default firewall in CentOS. 😀

Its so unneeded complicated that a simple Access-Rule seems to be as hard as climbing up the mount everest.

So, my problem was i wanted to configure a CentOS-Server for our backup system. Backup client was installed but the CentOS-Firwall was blocking the traffic.

Our backup-system needs several ports (in range) and communication comes from multiple servers.

But i didnt wanted to allow a port range because of security. So open up traffic for our backup-subnet was the way to go.

Here is the command:

firewall-cmd --permanent --zone=public --direct --add-rule ipv4 filter IN_public_allow 0 -s xx.x.xx.x/xx -j ACCEPT

firewall-cmd --reload

Have fun 😀

Ubuntu Firewall Skript

2 Comments

Hey,

hier n kleines Skript zur bequemeren Konfiguration von iptables unter Ubuntu.

Hier das Konfigurationsskript:

/etc/iptables.sh

#!/bin/sh

# Iptables
FW=”/sbin/iptables”

# vorhandene Regeln & Ketten löschen
$FW -F
$FW -X
$FW -t nat -F

# Standardregeln
$FW -P INPUT ACCEPT
$FW -P FORWARD ACCEPT
$FW -P OUTPUT ACCEPT

$FW -A INPUT -p tcp –dport www -s xxx.xx.xx.x/16 -j ACCEPT
$FW -A INPUT -p tcp –dport www -j DROP
$FW -A INPUT -p tcp –dport https -s xxx.xx.xx.x/16 -j ACCEPT
$FW -A INPUT -p tcp –dport https -j DROP

$FW -A INPUT -p tcp –dport ssh -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport ssh -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport ssh -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport ssh -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport ssh -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport ssh -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport ssh -j DROP

$FW -A INPUT -p tcp –dport 21 -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport 21 -j DROP

$FW -A INPUT -p tcp –dport 7777 -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport 7777 -j DROP

Hier das Init-Skript:

/etc/init.d/firewall

#!/bin/sh
### BEGIN INIT INFO
# Provides: iptables
# Required-Start: $local_fs $remote_fs
# Required-Stop: $local_fs $remote_fs
# Should-Start: $syslog
# Should-Stop: $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start or stop the firewall daemon.
### END INIT INFO

. /lib/lsb/init-functions

case “$1” in
start)
/etc/iptables.sh
iptables -L
;;
stop)
iptables -F
iptables -X
iptables -L
;;
status)
iptables -L
;;
*)
echo “Usage: /etc/init.d/firewall {start|stop|status}”
exit 1
;;
esac

exit 0

Automatisches Laden des Skripts in den Default-Runlevels:

update-rc.d firewall defaults

[Linux] Smurf Attack Prevention

Leave a comment

Hi,

um einer Flood Ping Attacke aus dem Weg zu gehen, sollte man iptables entsprechend so konfigurieren, dass nur ein Ping pro Sekunde angenommen wird, hier die CMD’s:

iptables -A INPUT -p icmp -m icmp --icmp-type address-mask-request -j DROP
iptables -A INPUT -p icmp -m icmp --icmp-type timestamp-request -j DROP
iptables -A INPUT -p icmp -m icmp -m limit --limit 1/second -j ACCEPT

Cisco Pix 501: Grundlagen ACL’s & Dhcp

Leave a comment

Access Control List (ACL):

  • ACL=Firewallregel
  • Abarbeitung von oben nach unten bis ein
    passender Eintrag gefunden wird
  • Eine ACL wird mit „access-group“ einer
    Schnittstelle zugeordnet

Aufbau einer ACL:

access-list <name|nr> permit|deny
<protocol> <source> <destination>
[<parameter>]

Beispiel:

access-list 3 permit icmp any any echo-reply
access-list 7 permit tcp any any eq 22

Access-Group:

access-group <name|nr> in interface
<if-name>

Beispiel ACL’s:

access-list zentral permit icmp any any echo-reply
access-list zentral permit icmp any any unreachable
access-list zentral permit icmp any any time-exceeded
access-list zentral permit tcp host 192.189.51.100 62.199.66.16
255.255.255.240 eq 22
access-list zentral permit udp any host 62.199.66.23 eq 53
access-list zentral permit tcp any host 62.199.66.23 eq 53
access-list zentral permit tcp any host 62.199.66.24 eq 25
access-list zentral permit tcp any host 62.199.66.25 eq 80
access-group zentral in interface outside
Pix als Dhcp Server:
• dhcpd address <first>-<last> <if>
• dhcpd domain <dns-domain>
• dhcpd dns <dnsserverip1> [<ip2>]
• dhcpd wins <winserverip1> [<ip2>]
• dhcpd lease <lease-time>
• dhcpd enable <if>