CentOS 7 – Firewalld allow all traffic from a Server

I hate the default firewall in CentOS. 😀

Its so unneeded complicated that a simple Access-Rule seems to be as hard as climbing up the mount everest.

So, my problem was i wanted to configure a CentOS-Server for our backup system. Backup client was installed but the CentOS-Firwall was blocking the traffic.

Our backup-system needs several ports (in range) and communication comes from multiple servers.

But i didnt wanted to allow a port range because of security. So open up traffic for our backup-subnet was the way to go.

Here is the command:

firewall-cmd --permanent --zone=public --direct --add-rule ipv4 filter IN_public_allow 0 -s xx.x.xx.x/xx -j ACCEPT

firewall-cmd --reload

Have fun 😀

Ubuntu Firewall Skript

Hey,

hier n kleines Skript zur bequemeren Konfiguration von iptables unter Ubuntu.

Hier das Konfigurationsskript:

/etc/iptables.sh

#!/bin/sh

# Iptables
FW=”/sbin/iptables”

# vorhandene Regeln & Ketten löschen
$FW -F
$FW -X
$FW -t nat -F

# Standardregeln
$FW -P INPUT ACCEPT
$FW -P FORWARD ACCEPT
$FW -P OUTPUT ACCEPT

$FW -A INPUT -p tcp –dport www -s xxx.xx.xx.x/16 -j ACCEPT
$FW -A INPUT -p tcp –dport www -j DROP
$FW -A INPUT -p tcp –dport https -s xxx.xx.xx.x/16 -j ACCEPT
$FW -A INPUT -p tcp –dport https -j DROP

$FW -A INPUT -p tcp –dport ssh -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport ssh -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport ssh -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport ssh -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport ssh -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport ssh -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport ssh -j DROP

$FW -A INPUT -p tcp –dport 21 -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport 21 -j DROP

$FW -A INPUT -p tcp –dport 7777 -s xxx.xx.xx.xxx -j ACCEPT
$FW -A INPUT -p tcp –dport 7777 -j DROP

Hier das Init-Skript:

/etc/init.d/firewall

#!/bin/sh
### BEGIN INIT INFO
# Provides: iptables
# Required-Start: $local_fs $remote_fs
# Required-Stop: $local_fs $remote_fs
# Should-Start: $syslog
# Should-Stop: $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start or stop the firewall daemon.
### END INIT INFO

. /lib/lsb/init-functions

case “$1” in
start)
/etc/iptables.sh
iptables -L
;;
stop)
iptables -F
iptables -X
iptables -L
;;
status)
iptables -L
;;
*)
echo “Usage: /etc/init.d/firewall {start|stop|status}”
exit 1
;;
esac

exit 0

Automatisches Laden des Skripts in den Default-Runlevels:

update-rc.d firewall defaults

[Linux] Smurf Attack Prevention

Hi,

um einer Flood Ping Attacke aus dem Weg zu gehen, sollte man iptables entsprechend so konfigurieren, dass nur ein Ping pro Sekunde angenommen wird, hier die CMD’s:

iptables -A INPUT -p icmp -m icmp --icmp-type address-mask-request -j DROP
iptables -A INPUT -p icmp -m icmp --icmp-type timestamp-request -j DROP
iptables -A INPUT -p icmp -m icmp -m limit --limit 1/second -j ACCEPT

Cisco Pix 501: Grundlagen ACL’s & Dhcp

Access Control List (ACL):

  • ACL=Firewallregel
  • Abarbeitung von oben nach unten bis ein
    passender Eintrag gefunden wird
  • Eine ACL wird mit „access-group“ einer
    Schnittstelle zugeordnet

Aufbau einer ACL:

access-list <name|nr> permit|deny
<protocol> <source> <destination>
[<parameter>]

Beispiel:

access-list 3 permit icmp any any echo-reply
access-list 7 permit tcp any any eq 22

Access-Group:

access-group <name|nr> in interface
<if-name>

Beispiel ACL’s:

access-list zentral permit icmp any any echo-reply
access-list zentral permit icmp any any unreachable
access-list zentral permit icmp any any time-exceeded
access-list zentral permit tcp host 192.189.51.100 62.199.66.16
255.255.255.240 eq 22
access-list zentral permit udp any host 62.199.66.23 eq 53
access-list zentral permit tcp any host 62.199.66.23 eq 53
access-list zentral permit tcp any host 62.199.66.24 eq 25
access-list zentral permit tcp any host 62.199.66.25 eq 80
access-group zentral in interface outside
Pix als Dhcp Server:
• dhcpd address <first>-<last> <if>
• dhcpd domain <dns-domain>
• dhcpd dns <dnsserverip1> [<ip2>]
• dhcpd wins <winserverip1> [<ip2>]
• dhcpd lease <lease-time>
• dhcpd enable <if>