Newsgroup: it.comp.sicurezza.varie
Titolo: iptables e regole di forward da rete privata

Ciao a tutto l'ng,
ho una soluzione firewall di questo tipo:
firewall + dmz + retelocale
il firewall ha  input output forward drop;
I servizi disponibili alla rete locale vengono proxati da demoni tipo
squid per la posta elettronica, delegated per smtp pop3 imap e nntp,
dns ecc..
tutto funziona perfettamente, mai dato problemi con un ottimo uptime
su connessione hdsl.
Per fare assistenza ad un cliente tramite vnc mi trovo costretto a
configurare una serie di regole forward dalla rete locale verso
l'esterno per porte come 5900 e la 22, peccato non funzioni nulla.
La Nat viene fatta dal router cisco.
Dove sbaglio??
L' rc.firewall di seguito è stato modificato da diverse persone, ed
infine da me, come lo considerate?
Accetto modifiche e consigli.
Grazie
C
## ============================================================
# RULES
## LOOPBACK
# Allow unlimited traffic on the loopback interface.
$IPTABLES -A INPUT -i $LPBACK -j ACCEPT
$IPTABLES -A OUTPUT -o $LPBACK -j ACCEPT
## SYN-FLOODING PROTECTION
# This rule maximises the rate of incoming connections. In order to do
this we divert tcp
# packets with the SYN bit set off to a user-defined chain. Up to
limit-burst connections
# can arrive in 1/limit seconds ..... in this case 4 connections in
one second. After this, one
# of the burst is regained every second and connections are allowed
again. The default limit
# is 3/hour. The default limit burst is 5/hour.
#
$IPTABLES -N syn-flood
$IPTABLES -A INPUT -i $OUTSIDE -p tcp --syn -j syn-flood
$IPTABLES -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A syn-flood -j LOG --log-level 4 --log-prefix "IPTABLES
SYN-FLOOD: "
$IPTABLES -A syn-flood -j DROP
#
$IPTABLES -A INPUT -i $VPN -p tcp --syn -j syn-flood
$IPTABLES -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A syn-flood -j LOG --log-level 4 --log-prefix "IPTABLES
SYN-FLOOD: "
$IPTABLES -A syn-flood -j DROP
#
## Make sure NEW tcp connections are SYN packets
$IPTABLES -A INPUT -i $OUTSIDE -p tcp ! --syn -m state --state NEW -j
LOG --log-level 4 --log-prefix "IPTABLES SYN-NONVALID: "
$IPTABLES -A INPUT -i $OUTSIDE -p tcp ! --syn -m state --state NEW -j
DROP
$IPTABLES -A INPUT -i $DMZ -p tcp ! --syn -m state --state NEW -j LOG
--log-level 4 --log-prefix "IPTABLES SYN-NONVALID: "
$IPTABLES -A INPUT -i $DMZ -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A INPUT -i $INSIDE -p tcp ! --syn -m state --state NEW -j
LOG --log-level 4 --log-prefix "IPTABLES SYN-NONVALID: "
$IPTABLES -A INPUT -i $INSIDE -p tcp ! --syn -m state --state NEW -j
DROP
$IPTABLES -A INPUT -i $VPN -p tcp ! --syn -m state --state NEW -j LOG
--log-level 4 --log-prefix "IPTABLES SYN-NONVALID: "
$IPTABLES -A INPUT -i $VPN -p tcp ! --syn -m state --state NEW -j DROP
## FRAGMENTS
# Log fragments just to see if we get any, and deny them too (if you
want, comment out!).
$IPTABLES -A INPUT -i $DMZ -f -j LOG --log-level 4 --log-prefix
"IPTABLES FRAGMENTS: "
#$IPTABLES -A INPUT -i $DMZ -f -j DROP
$IPTABLES -A INPUT -i $INSIDE -f -j LOG --log-level 4 --log-prefix
"IPTABLES FRAGMENTS: "
#$IPTABLES -A INPUT -i $INSIDE -f -j DROP
$IPTABLES -A INPUT -i $VPN -f -j LOG --log-level 4 --log-prefix
"IPTABLES FRAGMENTS: "
#$IPTABLES -A INPUT -i $VPN -f -j DROP
$IPTABLES -A FORWARD -f -j LOG --log-level 4 --log-prefix "IPTABLES
FRAGMENTS: "
#$IPTABLES -A FORWARD -f -j DROP
# Refuse broadcast address packets.
$IPTABLES -A INPUT -i $OUTSIDE -d $INTERNET_BCAST -j LOG --log-level 4
--log-prefix "IPTABLES BCAST: "
$IPTABLES -A INPUT -i $OUTSIDE -d $INTERNET_BCAST -j DROP
$IPTABLES -A INPUT -i $DMZ -d $DMZ_BCAST -j LOG --log-level 4
--log-prefix "IPTABLES BCAST: "
$IPTABLES -A INPUT -i $DMZ -d $DMZ_BCAST -j DROP
$IPTABLES -A INPUT -i $INSIDE -d $INTRANET_BCAST -p udp --dport 137 -j
DROP
$IPTABLES -A INPUT -i $INSIDE -d $INTRANET_BCAST -p udp --dport 138 -j
DROP
$IPTABLES -A INPUT -i $INSIDE -d $INTRANET_BCAST -j LOG --log-level 4
--log-prefix "IPTABLES BCAST: "
$IPTABLES -A INPUT -i $INSIDE -d $INTRANET_BCAST -j DROP
$IPTABLES -A INPUT -i $VPN -d $INTRANET_BCAST -j LOG --log-level 4
--log-prefix "IPTABLES BCAST: "
$IPTABLES -A INPUT -i $VPN -d $INTRANET_BCAST -j DROP
#
#
$IPTABLES -A INPUT -i $OUTSIDE -p tcp -m state --state
RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o $OUTSIDE -p tcp -m state --state
RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i $INSIDE -p tcp -m state --state
RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o $INSIDE -p tcp -m state --state
RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i $DMZ -p tcp -m state --state RELATED,ESTABLISHED
-j ACCEPT
$IPTABLES -A OUTPUT -o $DMZ -p tcp -m state --state
RELATED,ESTABLISHED -j ACCEPT
#
# Local Intranet SMTP Request to Delegate SMTP Proxy
$IPTABLES -A INPUT -i $INSIDE -p tcp -s $INTRANET --dport 25 -m state
--state NEW,ESTABLISHED -j ACCEPT
# Local SMTP Request from Delegate SMTP Proxy to MAIL_WIND
$IPTABLES -A OUTPUT -o $OUTSIDE -p tcp -d $MAIL_WIND --dport 25 -m
state --state NEW,ESTABLISHED -j ACCEPT
# Local Intranet POP3 Request to Delegate POP3 Proxy e Imap
$IPTABLES -A INPUT -i $INSIDE -p tcp -s $INTRANET --dport 110 -m state
--state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i $INSIDE -p tcp -s $INTRANET --dport 143 -m state
--state NEW,ESTABLISHED -j ACCEPT
# Local Intranet NNTP Request to Delegate NNTP Proxy
$IPTABLES -A INPUT -i $INSIDE -p tcp -s $INTRANET --dport 119 -m state
--state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i $INSIDE -p tcp -s $INTRANET --dport 1119 -m
state --state NEW,ESTABLISHED -j ACCEPT
# Local POP3 Request from Delegate POP3 Proxy to POP3_KUBOS
$IPTABLES -A OUTPUT -o $OUTSIDE -p tcp -d $POP3_KUBOS --dport 110 -m
state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o $OUTSIDE -p tcp -d $POP3_KUBOS --dport 143 -m
state --state NEW,ESTABLISHED -j ACCEPT
# Local Intranet Request to Squid Proxy
$IPTABLES -A INPUT -i $INSIDE -p tcp -s $INTRANET --dport 3128 -m
state --state NEW,ESTABLISHED -j ACCEPT
# Local Intranet Request to ftp port 21
$IPTABLES -A INPUT -i $INSIDE -p tcp -s $INTRANET --dport 21 -m state
--state NEW,ESTABLISHED -j ACCEPT
# Local HTTP/HTTPS/FTP/ensim/plesk Request from Squid Proxy 
$IPTABLES -A OUTPUT -o $OUTSIDE -p tcp  --dport 80 -m state --state
NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o $OUTSIDE -p tcp  --dport 443 -m state --state
NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o $OUTSIDE -p tcp  --dport 8443 -m state --state
NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o $OUTSIDE -p tcp  --dport 19638 -m state --state
NEW,ESTABLISHED -j ACCEPT
# Local NNTP Request from Delegated Redirector
$IPTABLES -A OUTPUT -o $OUTSIDE -p tcp  --dport 119 -m state --state
NEW,ESTABLISHED -j ACCEPT
# Internal DNS Request from INTRANET 
$IPTABLES -A OUTPUT -o $INSIDE -p udp -d $INTRANET --sport 53 -m state
--state ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i $INSIDE -p udp -s $INTRANET --dport 53 -m state
--state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o $DMZ -p udp -d $KUBOS_DMZ --sport 53 -m state
--state ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i $DMZ -p udp -s $KUBOS_DMZ --dport 53 -m state
--state NEW,ESTABLISHED -j ACCEPT
# External DNS Request to WIND FORWARDERS
$IPTABLES -A OUTPUT -o $OUTSIDE -p udp -d $DNS_FORWARDER1 --dport 53
-m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i $OUTSIDE -p udp -s $DNS_FORWARDER1 --sport 53 -m
state --state ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o $OUTSIDE -p udp -d $DNS_FORWARDER2 --dport 53
-m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i $OUTSIDE -p udp -s $DNS_FORWARDER2 --sport 53 -m
state --state ESTABLISHED -j ACCEPT
# Local Received SSH Request
$IPTABLES -A INPUT -i $INSIDE -p tcp --dport 22 -m state --state
NEW,ESTABLISHED -j ACCEPT
## ICMP
# We always allow icmp out.
$IPTABLES -A OUTPUT -o $DMZ -p icmp -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -o $INSIDE -p icmp -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -o $OUTSIDE -p icmp -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -o $VPN -p icmp -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -N ICMP
$IPTABLES -A INPUT --proto icmp -j ICMP
$IPTABLES -A ICMP -p icmp -m state --state ESTABLISHED,RELATED -j
ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type echo-reply -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type destination-unreachable -j
ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type network-unreachable -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type host-unreachable -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type protocol-unreachable -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type port-unreachable -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type fragmentation-needed -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type source-route-failed -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type network-unknown -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type host-unknown -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type network-prohibited -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type host-prohibited -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type TOS-network-unreachable -j
ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type TOS-host-unreachable -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type communication-prohibited -j
ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type host-precedence-violation -j
ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type precedence-cutoff -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type source-quench -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type redirect -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type network-redirect -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type host-redirect -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type TOS-network-redirect -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type TOS-host-redirect -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type echo-request -m limit --limit
12/minute -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type router-advertisement -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type router-solicitation -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type time-exceeded -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type ttl-zero-during-transit -j
ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type ttl-zero-during-reassembly -j
ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type parameter-problem -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type ip-header-bad -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type required-option-missing -j
ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type timestamp-request -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type timestamp-reply -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type address-mask-request -j ACCEPT
$IPTABLES -A ICMP -p icmp --icmp-type address-mask-reply -j ACCEPT
$IPTABLES -A ICMP -p icmp -j LOG --log-level 4 --log-prefix "IPTABLES
ICMP-IN: "
$IPTABLES -A ICMP -p icmp -j DROP
## LOGGING
# Any udp not already allowed is logged and then dropped.
$IPTABLES -A INPUT -i $INSIDE -p udp --dport 67 -j DROP
$IPTABLES -A INPUT -i $INSIDE -p udp --dport 68 -j DROP
$IPTABLES -A INPUT -i $INSIDE -p udp --dport 137 -j DROP
$IPTABLES -A INPUT -i $INSIDE -p udp --dport 138 -j DROP
$IPTABLES -A INPUT -i $INSIDE -p udp --dport 1900 -j DROP
#$IPTABLES -A INPUT -i $INSIDE -p udp -j LOG --log-level 4
--log-prefix "IPTABLES UDP-IN: "
#$IPTABLES -A INPUT  -i $INSIDE -p udp -j DROP
$IPTABLES -A INPUT  -i $DMZ -p udp -j LOG --log-level 4 --log-prefix
"IPTABLES UDP-IN: "
#$IPTABLES -A INPUT  -i $DMZ -p udp -j DROP
$IPTABLES -A OUTPUT -o $INSIDE -p udp -j LOG --log-level 4
--log-prefix "IPTABLES UDP-OUT: "
#$IPTABLES -A OUTPUT -o $INSIDE -p udp -j DROP
$IPTABLES -A OUTPUT -o $DMZ -p udp -j LOG --log-level 4 --log-prefix
"IPTABLES UDP-OUT: "
#$IPTABLES -A OUTPUT -o $DMZ -p udp -j DROP
# Any icmp not already allowed is logged and then dropped.
$IPTABLES -A OUTPUT -o $INSIDE -p icmp -j LOG --log-level 4
--log-prefix "IPTABLES ICMP-OUT: "
#$IPTABLES -A OUTPUT -o $INSIDE -p icmp -j DROP
$IPTABLES -A OUTPUT -o $DMZ -p icmp -j LOG --log-level 4 --log-prefix
"IPTABLES ICMP-OUT: "
#$IPTABLES -A OUTPUT -o $DMZ -p icmp -j DROP
#
# Any tcp not already allowed is logged and then dropped.
#$IPTABLES -A INPUT  -i $INSIDE -p tcp -j LOG --log-level 4
--log-prefix "IPTABLES TCP-IN: "
#$IPTABLES -A INPUT  -i $INSIDE -p tcp -j DROP
$IPTABLES -A INPUT  -i $DMZ -p tcp -j LOG --log-level 4 --log-prefix
"IPTABLES TCP-IN: "
#$IPTABLES -A INPUT  -i $DMZ -p tcp -j DROP
$IPTABLES -A OUTPUT -o $INSIDE -p tcp -j LOG --log-level 4
--log-prefix "IPTABLES TCP-OUT: "
#$IPTABLES -A OUTPUT -o $INSIDE -p tcp -j DROP
$IPTABLES -A OUTPUT -o $DMZ -p tcp -j LOG --log-level 4 --log-prefix
"IPTABLES TCP-OUT: "
#$IPTABLES -A OUTPUT -o $DMZ -p tcp -j DROP
#
# Allow forwarding all RELATED,ESTABLISHED packets
$IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
#
# Allow SSH forwarding from INTRANET to ARES, APOLLO
$IPTABLES -A FORWARD -p tcp -s $INTRANET -d $APOLLO --dport 22 -m
state --state NEW,ESTABLISHED -j ACCEPT
# Allow Webmin forwarding from INTRANET to ARES, APOLLO
$IPTABLES -A FORWARD -p tcp -s $INTRANET -d $APOLLO --dport 10000 -m
state --state NEW,ESTABLISHED -j ACCEPT
# Allow PhpMyadmin forwarding from INTRANET to APOLLO
$IPTABLES -A FORWARD -p tcp -s $INTRANET -d $APOLLO --dport 3306 -m
state --state NEW,ESTABLISHED -j ACCEPT
# Allow smtp forwarding from APOLLO to Internet
$IPTABLES -A FORWARD -p tcp -s $APOLLO --dport 25 -m state --state
NEW,ESTABLISHED -j ACCEPT
# Allow smtp forwarding from Internet to APOLLO
$IPTABLES -A FORWARD -p tcp -d $APOLLO --dport 25 -m state --state
NEW,ESTABLISHED -j ACCEPT
# Allow imap forwarding from Internet to APOLLO
$IPTABLES -A FORWARD -p tcp -d $APOLLO --dport 143 -m state --state
NEW,ESTABLISHED -j ACCEPT
# Allow pop3 forwarding from Internet to APOLLO
$IPTABLES -A FORWARD -p tcp -d $APOLLO --dport 110 -m state --state
NEW,ESTABLISHED -j ACCEPT
 
# Allow icmp forwarding
$IPTABLES -A FORWARD -p icmp --icmp-type echo-request -j ACCEPT
$IPTABLES -A FORWARD -p icmp --icmp-type echo-reply -j ACCEPT
$IPTABLES -A FORWARD -p icmp --icmp-type destination-unreachable -j
ACCEPT
$IPTABLES -A FORWARD -p icmp --icmp-type time-exceeded -j ACCEPT
$IPTABLES -A FORWARD -p icmp --icmp-type ttl-zero-during-transit -j
ACCEPT
$IPTABLES -A FORWARD -p icmp --icmp-type ttl-zero-during-reassembly -j
ACCEPT
# Allow Logging DROPPED Packets FORWARDED
$IPTABLES -A FORWARD -j LOG --log-level 4 --log-prefix "IPTABLES
GENERIC: "

 $IPTABLES -A FORWARD -p tcp -d $APOLLO --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT
$APOLLO e' un server MTA, POP3 e IMAP4, immagino. Non lo stai proteggendo 
da syn flood e dai new not syn, che mi sembrava fossero policy aziendali.
Fabio