slacky.eu

Codice: Seleziona tutto

root@darkstar:~# iptables-restore  < .iptables.rc

Codice: Seleziona tutto

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
COMMIT

Codice: Seleziona tutto

root@darkstar:~# iptables -L -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Codice: Seleziona tutto

Firewall:
Verso il server: TCP aperto, UDP aperto
Verso il client: TCP chiuso, UDP aperto

Codice: Seleziona tutto

#!/bin/sh

IPTAB=$(which iptables)
text="-m comment --comment"

flush_chain(){
### FLUSHING CHAINS ###
$IPTAB -F
$IPTAB -X
$IPTAB -Z
}

set_policy(){
### CATENA DI DEFAULT ###
$IPTAB -P INPUT   $1
$IPTAB -P FORWARD $1
$IPTAB -P OUTPUT  $1
}

set_loop(){
 $IPTAB -$1 INPUT  $text 'Accetta connessione di LOOPBACK' -i lo -j ACCEPT 
 $IPTAB -$1 OUTPUT $text 'Accetta connessione di LOOPBACK' -o lo -j ACCEPT  
}

set_global(){
 $IPTAB -$1 INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 $IPTAB -$1 OUTPUT -j ACCEPT
}

set_firewall(){
 flush_chain
 set_policy   DROP
 set_loop     A 
 set_global   A
}

unset_firewall(){
 flush_chain
 set_policy   ACCEPT
}


# MAIN
case "$1" in
  start)
     echo "Attiva Firewall..."
     set_firewall
     ;;
  stop)
     echo "Disattiva Firewall..."
     unset_firewall
     ;;
  restart)
     echo "Riattiva Firewall..."
     set_firewall
     ;;
  status)
     $IPTAB -L -v
     ;;
  block)
     echo "Blocca tutte le Connessioni..."
     flush_chain
     set_policy   DROP
     set_loop     A
     ;;
  *)
     echo "Utilizzo: $0 {start|stop|restart|status|block}"
     exit 
     ;;
esac
exit 0

Codice: Seleziona tutto

# If there is a firewall script, run it before enabling packet forwarding.
# See the HOWTOs on http://www.netfilter.org/ for documentation on
# setting up a firewall or NAT on Linux.  In some cases this might need to
# be moved past the section below dealing with IP packet forwarding.
if [ -x /etc/rc.d/rc.firewall ]; then
  /etc/rc.d/rc.firewall start
fi

Codice: Seleziona tutto

# iptables -L -v
Chain INPUT (policy DROP 7889 packets, 470K bytes)
 pkts bytes target     prot opt in     out     source               destination         
  140 16011 ACCEPT     all  --  lo     any     anywhere             anywhere             /* Accetta connessione di LOOPBACK */
1345K 1484M ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  194 23493 ACCEPT     all  --  any    lo      anywhere             anywhere             /* Accetta connessione di LOOPBACK */
 947K  116M ACCEPT     all  --  any    any     anywhere             anywhere