Newsgroup: it.comp.os.linux.iniziare
Titolo: configurare guarddog

Sto provando a configurare guarddog seguendo questa guida:
http://www.knoppixitalia.org/modules/newbb/viewtopic.php?viewmode=flat&order=ASC&topic_id=614&forum=14&move=prev&topic_time=1176814096
ho seguito tutto alla lettera ma i risultati sono tragici, sembra che mi 
navighi solo sui siti gia' aperti, la posta va e non va, solo il p2p 
sembrava funzionare ma una volta riavviato nemmeno quello ...che ne 
pensate della guida, ne conoscete una migliore?
Ciao e grazie

 pensate della guida, ne conoscete una migliore?
A che ti serve guarddog? Hai servizi esposti alla rete?
-- 
Best Regards, Jack
Linux User #264449
Powered by Debian GNU/Linux on AMD64

 A che ti serve guarddog? Hai servizi esposti alla rete?
Per una questione di sicurezza, mi pare di aver letto che anche con 
linux e consigliabile avere un firewall attivo.

 linux e consigliabile avere un firewall attivo.
Si, avendo servizi in ascolto sulla rete. 
No, se non c'e' niente di attivo.


 
Sinceramente e una domanda a cui non so rispondere, in ogni caso non 
riesco a capire perche' avendo seguito quella guida passo passo anche 
semplici cose come la posta e internet non vanno bene ed e' per questo 
chiedevo se a guida fosse valida e se ne conoscevate di migliori anche 
al solo scopo di apprendimento.
Ciao e grazie

 semplici cose come la posta e internet non vanno bene
Seguire una guida a pappagallo senza capire cosa si sta facendo porta a 
questo. Cerca di capire cos'e' un firewall, come funziona, come agisce 
guarddog sul sistema e *poi* modifica le cose.
Altrimenti, lascia tutto com'e'.


 guarddog sul sistema e *poi* modifica le cose.
Questo piu' o meno lo so, non riesco a capire come funzionano le 
finestre fra di loro, perche' devo creare una nuova zona (come dice la 
guida) e come funzionano fra di loro le 3 zone (locale, internet) + 
quella creata. Sono abituato ai firewall di windows che fanno 
praticamente tutto in automatico.

 praticamente tutto in automatico.
Ho scoperto che si puo' configurare in maniera piu' semplice senza usare 
le zone, ho abilitato i servizi che m'interessano e funziona pero' non 
capisco come mai riesco a scaricare la posta (ho diversi indirizzi) da 
tutti i server (tin, email, vigilio, yahoo) ma non da gmail ...
... tra l'altro questa cosa mi ha mandato in confusione anche con a 
precedente configurazione.

 precedente configurazione.
Che pirla!
... adesso l'ho capito usa un protocollo diverso ssl ...

 Altrimenti, lascia tutto com'e'.
In ogni modo mi sa che non e' un problema della configurazione, perche' 
il tutto funziona bene poi d'improvviso smette di funzionare (o va solo 
qualcosa) ma con un semplice applica dato alla configurazione senza 
modificare nulla il tutto riprende ad andare .. purtroppo solo per un 
po'...
... cosa puo' essere successo?
Ciao

 ... cosa puo' essere successo? 
hai frugato nei files di  /var/log?
magari segnala qlc errore;
r
-- 
posted from a ridicoulus Country
tutto sui Pentangle: 
http://umpf.net/

 magari segnala qlc errore;
In quella directory non trovo niente ...
... sto quasi pensando di migrare alla debian a 32 bit mi sembra che con 
questa sia tutto piu' complicato ...

 Sto provando a configurare guarddog 
Sono passato a debian a 32 bit per maggiore semplicita' e ho risolto 
diversi problemi, continua pero' il problema con guarddog che non resta 
configurato pero' forse ho capito qualcosa:
ho notato che non e' stato creato /etc/rc.firewall che se non mi sbaglio 
e' indispensabile, come posso risolvere? manchera' qualche pacchetto?

ho notato che non e' stato creato /etc/rc.firewall 
... ma se lo faccio a manina faccio casino?

 ... ma se lo faccio a manina faccio casino?
ti posto il mio (ma bada che non è a posto, l'ho usato per disabilitare 
il fw);
#!/bin/bash
# [Guarddog2]
# DO NOT EDIT!
# This firewall script was generated by "Guarddog" by Simon Edwards
# 
http://www.simonzone.com/software/guarddog/
 This script requires Linux
# kernel version 2.2.x and ipchains OR Linux kernel 2.4.x and iptables.
#
# [Description]
#
# [Config]
# LOCALPORTRANGESTART=1024
# LOCALPORTRANGEEND=5999
# DISABLED=1
# LOGREJECT=0
# LOGDROP=0
# LOGABORTEDTCP=1
# LOGIPOPTIONS=1
# LOGTCPOPTIONS=1
# LOGTCPSEQUENCE=1
# LOGLEVEL=4
# LOGRATELIMIT=1
# LOGRATE=1
# LOGRATEUNIT=0
# LOGRATEBURST=10
# LOGWARNLIMIT=1
# LOGWARNRATE=2
# LOGWARNRATEUNIT=1
# DHCPC=0
# DHCPCINTERFACENAME=eth0
# DHCPD=0
# DHCPDINTERFACENAME=eth0
# ALLOWTCPTIMESTAMPS=0
# [ServerZone] Internet
# [ClientZone] Locale
# CONNECTED=1
# [ServerZone] Locale
# [ClientZone] Internet
# CONNECTED=1
# [End]
# Real code starts here
# If you change the line below then also change the # DISABLED line above.
DISABLE_GUARDDOG=1
if test -z $GUARDDOG_VERBOSE; then
   GUARDDOG_VERBOSE=0
fi;
if [ $DISABLE_GUARDDOG -eq 0 ]; then
# Set the path
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/sbin
# Detect which filter command we should use.
FILTERSYS=0
# 0 = unknown, 1 = ipchains, 2 = iptables
# Check for ipchains.
if [ -e /sbin/ipchains ]; then
   FILTERSYS=1
fi;
if [ -e /usr/sbin/ipchains ]; then
   FILTERSYS=1
fi;
if [ -e /usr/local/sbin/ipchains ]; then
   FILTERSYS=1
fi;
# Check for iptables support.
if [ -e /proc/sys/kernel/osrelease ]; then
   KERNEL_VERSION=`sed "s/^\([0-9][0-9]*\.[0-9][0-9]*\).*\$/\1/" < 
/proc/sys/kernel/osrelease`
   if [ $KERNEL_VERSION == "2.6" ]; then
     KERNEL_VERSION="2.4"
   fi;
   if [ $KERNEL_VERSION == "2.5" ]; then
     KERNEL_VERSION="2.4"
   fi;
   if [ $KERNEL_VERSION == "2.4" ]; then
     if [ -e /sbin/iptables ]; then
       FILTERSYS=2
     fi;
     if [ -e /usr/sbin/iptables ]; then
       FILTERSYS=2
     fi;
     if [ -e /usr/local/sbin/iptables ]; then
       FILTERSYS=2
     fi;
   fi;
fi;
if [ $FILTERSYS -eq 0 ]; then
   logger -p 
auth.info
 -t guarddog "ERROR Can't determine the firewall 
command! (Is ipchains or iptables installed?)"
   [ $GUARDDOG_VERBOSE -eq 1 ] && echo "ERRORE: non riesco a determinare 
il comando di firewall! (E' installato ipchains o iptables?)"
   false
fi;
if [ $FILTERSYS -eq 1 ]; then
###############################
###### ipchains ###############
###############################
logger -p 
auth.info
 -t guarddog Configuring ipchains firewall now.
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Uso ipchains."
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Reimposto le regole del firewall."
# Shut down all traffic
ipchains -P forward DENY
ipchains -P input DENY
ipchains -P output DENY
# Delete any existing chains
ipchains -F
ipchains -X
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Imposto i parametri del kernel."
# Turn on kernel IP spoof protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts 2> /dev/null
# Set the up TCP timestamps config
echo 0 > /proc/sys/net/ipv4/tcp_timestamps 2> /dev/null
# Enable TCP SYN Cookie Protection
echo 1 > /proc/sys/net/ipv4/tcp_syncookies 2> /dev/null
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route 2> /dev/null
# Log truly weird packets.
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians 2> /dev/null
# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
# Set kernel rp_filter. NICs used for IPSEC should not have rp_fitler 
turned on.
# Find the IPs of any ipsecX NICs
IPSEC_IPS="`ifconfig | gawk '/^ipsec\w/ { grabip = 1}
/inet addr:[[:digit:]\\.]+/ { if(grabip==1) printf \"%s 
\",gensub(/^.*inet addr:([[:digit:]\\.]+).*$/,\"\\\\1\",\"g\",$0)
grabip = 0}'`"
# Build a list of NIC names and metching IPs
IP_NIC_PAIRS="`ifconfig | gawk '/^\w/ { nic = 
gensub(/^(.*):.*/,\"\\\\1\",\"g\",$1)}
/inet addr:.*/ {match($0,/inet addr:[[:digit:]\.]+/)
ip=substr($0,RSTART+10,RLENGTH-10)
printf \"%s_%s\\n\",nic,ip }'`"
# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL
# Activate rp_filter for each NIC, except for NICs that are using
# an IP that is involved with IPSEC.
for X in $IP_NIC_PAIRS ; do
   NIC="`echo \"$X\" | cut -f 1 -d _`"
   IP="`echo \"$X\" | cut -f 2 -d _`"
   RPF="1"
   for SEC_IP in $IPSEC_IPS ; do
     if [[ $SEC_IP == $IP ]]; then
       RPF="0"
     fi
   done
   echo $RPF > /proc/sys/net/ipv4/conf/$NIC/rp_filter 2> /dev/null
done
echo "1024 5999" > /proc/sys/net/ipv4/ip_local_port_range 2> /dev/null
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Configuro le regole del firewall."
# Allow loopback traffic.
ipchains -A input -i lo -j ACCEPT
ipchains -A output -i lo -j ACCEPT
# Accept broadcasts from ourself.
# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
IP_BCAST_PAIRS="`ifconfig | gawk '/^\w/ { nic = 
gensub(/^(.*):.*/,\"\\\\1\",\"g\",$1)}
/inet addr:.*Bcast/ {match($0,/inet addr:[[:digit:]\\.]+/)
ip=substr($0,RSTART+10,RLENGTH-10)
match($0,/Bcast:[[:digit:]\\.]+/)
bcast = substr($0,RSTART+6,RLENGTH-6)
printf \"%s_%s_%s\\n\",nic,ip,bcast }'`"
# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL
for X in $IP_BCAST_PAIRS ; do
   NIC="`echo \"$X\" | cut -f 1 -d _`"
   IP="`echo \"$X\" | cut -f 2 -d _`"
   BCAST="`echo \"$X\" | cut -f 3 -d _`"
   ipchains -A input -i $NIC -s $IP -d $BCAST -j ACCEPT
done
# Allow certain critical ICMP types
ipchains -A input -p icmp --sport 3 -j ACCEPT                 # Dest 
unreachable
ipchains -A output -p icmp --sport 3 -j ACCEPT                # Dest 
unreachable
ipchains -A forward -p icmp --sport 3 -j ACCEPT &> /dev/null  # Dest 
unreachable
ipchains -A input -p icmp --sport 11 -j ACCEPT                # Time 
exceeded
ipchains -A output -p icmp --sport 11 -j ACCEPT               # Time 
exceeded
ipchains -A forward -p icmp --sport 11 -j ACCEPT &> /dev/null # Time 
exceeded
ipchains -A input -p icmp --sport 12 -j ACCEPT                # 
Parameter Problem
ipchains -A output -p icmp --sport 12 -j ACCEPT               # 
Parameter Problem
ipchains -A forward -p icmp --sport 12 -j ACCEPT &> /dev/null # 
Parameter Problem
# Work out our local IPs.
# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
NIC_IP="`ifconfig | gawk '/^\w/ { nic = 
gensub(/^(.*):.*/,\"\\\\1\",\"g\",\$1)}
/inet addr:/ { match(\$0,/inet addr:[[:digit:]\\.]+/)
printf \"%s_%s\\n\",nic,substr(\$0,RSTART+10,RLENGTH-10) }
/Bcast/ { match(\$0,/Bcast:[[:digit:]\\.]+/)
printf \"%s_%s\\n\",nic,substr(\$0,RSTART+6,RLENGTH-6) }'`"
# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL
# Create the nicfilt chain
ipchains -N nicfilt
GOT_LO=0
NIC_COUNT=0
for X in $NIC_IP ; do
     NIC="`echo \"$X\" | cut -f 1 -d _`"
     IP="`echo \"$X\" | cut -f 2 -d _`"
     ipchains -A nicfilt -i $NIC -j RETURN
     # We also take this opportunity to see if we only have a lo interface.
     if [ $NIC == "lo" ]; then
         GOT_LO=1
     fi
     let NIC_COUNT=$NIC_COUNT+1
done
IPS="`echo \"$NIC_IP\" | cut -f 2 -d _`"
# Do we have just a lo interface?
if [ $GOT_LO -eq 1 ] && [ $NIC_COUNT -eq 1 ] ; then
   MIN_MODE=1
else
   MIN_MODE=0
fi
# Are there *any* interfaces?
if [ $NIC_COUNT -eq 0 ] ; then
   MIN_MODE=1
fi
# If we only have a lo interface or no interfaces then we assume that DNS
# is not going to work and just skip any iptables calls that need DNS.
ipchains -A nicfilt -j DENY
# Create the filter chains
# Create chain to filter traffic going from 'Internet' to 'Locale'
ipchains -N f0to1
# Create chain to filter traffic going from 'Locale' to 'Internet'
ipchains -N f1to0
# Add rules to the filter chains
# Traffic from 'Internet' to 'Locale'
# Rejected traffic from 'Internet' to 'Locale'
# Traffic from 'Locale' to 'Internet'
# Rejected traffic from 'Locale' to 'Internet'
# Place DENY and log rules at the end of our filter chains.
# Failing all the rules above, we DENY and maybe log the packet.
ipchains -A f0to1 -j DENY
# Failing all the rules above, we DENY and maybe log the packet.
ipchains -A f1to0 -j DENY
# Add some temp DNS accept rules to the input and output chains.
# This is so that we can pass domain names to ipchains and have ipchains be
# able to look it up without being blocked by the our half-complete 
firewall.
if [ $MIN_MODE -eq 0 ] ; then
   ipchains -A output -p tcp --sport 0:65535 --dport 53:53 -j ACCEPT
   ipchains -A input -p tcp ! -y --sport 53:53 --dport 0:65535 -j ACCEPT
   ipchains -A output -p udp --sport 0:65535 --dport 53:53 -j ACCEPT
   ipchains -A input -p udp --sport 53:53 --dport 0:65535 -j ACCEPT
fi
# Chain to split traffic coming from zone 'Internet' by dest zone
ipchains -N s0
for X in $IPS ; do
     ipchains -A s0 -d $X -j f0to1
done
if [ $MIN_MODE -eq 0 ] ; then
true # make sure this if [] has a least something in it.
fi
ipchains -A s0 -j DENY
# Chain to split traffic coming from zone 'Locale' by dest zone
ipchains -N s1
if [ $MIN_MODE -eq 0 ] ; then
true # make sure this if [] has a least something in it.
fi
ipchains -A s1 -j f1to0
# Create the srcfilt chain
ipchains -N srcfilt
if [ $MIN_MODE -eq 0 ] ; then
true # make sure this if [] has a least something in it.
fi
# Assume internet default rule
ipchains -A srcfilt -j s0
# Remove the temp DNS accept rules
if [ $MIN_MODE -eq 0 ] ; then
   ipchains -D output -p tcp --sport 0:65535 --dport 53:53 -j ACCEPT
   ipchains -D input -p tcp ! -y --sport 53:53 --dport 0:65535 -j ACCEPT
   ipchains -D output -p udp --sport 0:65535 --dport 53:53 -j ACCEPT
   ipchains -D input -p udp --sport 53:53 --dport 0:65535 -j ACCEPT
fi
# The output chain is quite simple. We diverge and filter any traffic from
# the local machine and accept the rest. The rest should have come via the
# forward chain, and hence is already filtered.
ipchains -A output -j nicfilt
for X in $IPS ; do
     ipchains -A output -s $X -j s1
done
ipchains -A output -j ACCEPT
ipchains -A input -j nicfilt
# Direct local bound traffic on the input chain to the srcfilt chain
for X in $IPS ; do
     ipchains -A input -d $X -j srcfilt
done
ipchains -A input -j ACCEPT
# All traffic on the forward chains goes to the srcfilt chain.
ipchains -A forward -j nicfilt &> /dev/null
ipchains -A forward -j srcfilt &> /dev/null
logger -p 
auth.info
 -t guarddog Finished configuring firewall
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Finito."
fi;
if [ $FILTERSYS -eq 2 ]; then
###############################
###### iptables firewall ######
###############################
logger -p 
auth.info
 -t guarddog Configuring iptables firewall now.
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Uso iptables."
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Reimposto le regole del firewall."
# Shut down all traffic
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT DROP
# Delete any existing chains
iptables -F
iptables -X
# Load any special kernel modules.
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Carico i moduli del kernel."
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Imposto i parametri del kernel."
# Turn on kernel IP spoof protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts 2> /dev/null
# Set the TCP timestamps config
echo 0 > /proc/sys/net/ipv4/tcp_timestamps 2> /dev/null
# Enable TCP SYN Cookie Protection if available
test -e /proc/sys/net/ipv4/tcp_syncookies && echo 1 > 
/proc/sys/net/ipv4/tcp_syncookies 2> /dev/null
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route 2> /dev/null
echo 0 > /proc/sys/net/ipv4/conf/default/accept_source_route 2> /dev/null
# Log truly weird packets.
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians 2> /dev/null
echo 1 > /proc/sys/net/ipv4/conf/default/log_martians 2> /dev/null
# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
# Set kernel rp_filter. NICs used for IPSEC should not have rp_fitler 
turned on.
# Find the IPs of any ipsecX NICs
IPSEC_IPS="`ifconfig | gawk '/^ipsec\w/ { grabip = 1}
/inet addr:[[:digit:]\\.]+/ { if(grabip==1) printf \"%s 
\",gensub(/^.*inet addr:([[:digit:]\\.]+).*$/,\"\\\\1\",\"g\",$0)
grabip = 0}'`"
# Build a list of NIC names and metching IPs
IP_NIC_PAIRS="`ifconfig | gawk '/^\w/ { nic = 
gensub(/^(.*):.*/,\"\\\\1\",\"g\",$1)}
/inet addr:.*/ {match($0,/inet addr:[[:digit:]\.]+/)
ip=substr($0,RSTART+10,RLENGTH-10)
printf \"%s_%s\\n\",nic,ip }'`"
# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL
# Activate rp_filter for each NIC, except for NICs that are using
# an IP that is involved with IPSEC.
for X in $IP_NIC_PAIRS ; do
   NIC="`echo \"$X\" | cut -f 1 -d _`"
   IP="`echo \"$X\" | cut -f 2 -d _`"
   RPF="1"
   for SEC_IP in $IPSEC_IPS ; do
     if [[ $SEC_IP == $IP ]]; then
       RPF="0"
     fi
   done
   echo $RPF > /proc/sys/net/ipv4/conf/$NIC/rp_filter 2> /dev/null
done
echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter 2> /dev/null
echo "1024 5999" > /proc/sys/net/ipv4/ip_local_port_range 2> /dev/null
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Configuro le regole del firewall."
# Set up our logging and packet 'executing' chains
iptables -N logdrop2
iptables -A logdrop2 -j DROP
iptables -N logdrop
iptables -A logdrop -j logdrop2
iptables -N logreject2
iptables -A logreject2 -p tcp -j REJECT --reject-with tcp-reset
iptables -A logreject2 -p udp -j REJECT --reject-with icmp-port-unreachable
iptables -A logreject2 -j DROP
iptables -N logreject
iptables -A logreject -j logreject2
iptables -N logaborted2
iptables -A logaborted2 -j LOG --log-prefix "ABORTED " --log-level 4 
--log-ip-options --log-tcp-options --log-tcp-sequence
iptables -A logaborted2 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -N logaborted
iptables -A logaborted -m limit --limit 1/second --limit-burst 10 -j 
logaborted2
iptables -A logaborted -m limit --limit 2/minute --limit-burst 1 -j LOG 
--log-prefix "LIMITED " --log-level 4
# Allow loopback traffic.
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
# Accept broadcasts from ourself.
IP_BCAST_PAIRS="`ifconfig | gawk '/^\w/ { nic = 
gensub(/^(.*):.*/,\"\\\\1\",\"g\",$1)}
/inet addr:.*Bcast/ {match($0,/inet addr:[[:digit:]\\.]+/)
ip=substr($0,RSTART+10,RLENGTH-10)
match($0,/Bcast:[[:digit:]\\.]+/)
bcast = substr($0,RSTART+6,RLENGTH-6)
printf \"%s_%s_%s\\n\",nic,ip,bcast }'`"
# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL
for X in $IP_BCAST_PAIRS ; do
   NIC="`echo \"$X\" | cut -f 1 -d _`"
   IP="`echo \"$X\" | cut -f 2 -d _`"
   BCAST="`echo \"$X\" | cut -f 3 -d _`"
   iptables -A INPUT -i $NIC -s $IP -d $BCAST -j ACCEPT
done
# Detect aborted TCP connections.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -p tcp 
--tcp-flags RST RST -j logaborted
# Quickly allow anything that belongs to an already established connection.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow certain critical ICMP types
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT 
  # Dest unreachable
iptables -A OUTPUT -p icmp --icmp-type destination-unreachable -j ACCEPT 
# Dest unreachable
iptables -A FORWARD -p icmp --icmp-type destination-unreachable -j 
ACCEPT &> /dev/null  # Dest unreachable
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT 
  # Time exceeded
iptables -A OUTPUT -p icmp --icmp-type time-exceeded -j ACCEPT 
  # Time exceeded
iptables -A FORWARD -p icmp --icmp-type time-exceeded -j ACCEPT &> 
/dev/null # Time exceeded
iptables -A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT 
  # Parameter Problem
iptables -A OUTPUT -p icmp --icmp-type parameter-problem -j ACCEPT 
  # Parameter Problem
iptables -A FORWARD -p icmp --icmp-type parameter-problem -j ACCEPT &> 
/dev/null # Parameter Problem
# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
# Work out our local IPs.
NIC_IP="`ifconfig | gawk '/^\w/ { nic = 
gensub(/^(.*):.*/,\"\\\\1\",\"g\",\$1)}
/inet addr:/ { match(\$0,/inet addr:[[:digit:]\\.]+/)
printf \"%s_%s\\n\",nic,substr(\$0,RSTART+10,RLENGTH-10) }
/Bcast/ { match(\$0,/Bcast:[[:digit:]\\.]+/)
printf \"%s_%s\\n\",nic,substr(\$0,RSTART+6,RLENGTH-6) }'`"
# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL
# Create the nicfilt chain
iptables -N nicfilt
GOT_LO=0
NIC_COUNT=0
for X in $NIC_IP ; do
     NIC="`echo \"$X\" | cut -f 1 -d _`"
     iptables -A nicfilt -i $NIC -j RETURN
     # We also take this opportunity to see if we only have a lo interface.
     if [ $NIC == "lo" ]; then
         GOT_LO=1
     fi
     let NIC_COUNT=$NIC_COUNT+1
done
IPS="`echo \"$NIC_IP\" | cut -f 2 -d _`"
iptables -A nicfilt -j logdrop
# Do we have just a lo interface?
if [ $GOT_LO -eq 1 ] && [ $NIC_COUNT -eq 1 ] ; then
   MIN_MODE=1
else
   MIN_MODE=0
fi
# Are there *any* interfaces?
if [ $NIC_COUNT -eq 0 ] ; then
   MIN_MODE=1
fi
# If we only have a lo interface or no interfaces then we assume that DNS
# is not going to work and just skip any iptables calls that need DNS.
# Create the filter chains
# Create chain to filter traffic going from 'Internet' to 'Locale'
iptables -N f0to1
# Create chain to filter traffic going from 'Locale' to 'Internet'
iptables -N f1to0
# Add rules to the filter chains
# Traffic from 'Internet' to 'Locale'
# Rejected traffic from 'Internet' to 'Locale'
# Traffic from 'Locale' to 'Internet'
# Rejected traffic from 'Locale' to 'Internet'
# Place DROP and log rules at the end of our filter chains.
# Failing all the rules above, we log and DROP the packet.
iptables -A f0to1 -j logdrop
# Failing all the rules above, we log and DROP the packet.
iptables -A f1to0 -j logdrop
# Add some temp DNS accept rules to the input and output chains.
# This is so that we can pass domain names to ipchains and have iptables be
# able to look it up without being blocked by the our half-complete 
firewall.
if [ $MIN_MODE -eq 0 ] ; then
   iptables -A OUTPUT -p tcp --sport 0:65535 --dport 53:53 -j ACCEPT
   iptables -A INPUT -p tcp ! --syn --sport 53:53 --dport 0:65535 -j ACCEPT
   iptables -A OUTPUT -p udp --sport 0:65535 --dport 53:53 -j ACCEPT
   iptables -A INPUT -p udp --sport 53:53 --dport 0:65535 -j ACCEPT
fi
# Chain to split traffic coming from zone 'Internet' by dest zone
iptables -N s0
for X in $IPS ; do
     iptables -A s0 -d $X -j f0to1
done
if [ $MIN_MODE -eq 0 ] ; then
     true # make sure this if [] has at least something in it.
fi
iptables -A s0 -j logdrop
# Chain to split traffic coming from zone 'Locale' by dest zone
iptables -N s1
if [ $MIN_MODE -eq 0 ] ; then
     true # make sure this if [] has at least something in it.
fi
iptables -A s1 -j f1to0
# Create the srcfilt chain
iptables -N srcfilt
if [ $MIN_MODE -eq 0 ] ; then
     true # make sure this if [] has at least something in it.
fi
# Assume internet default rule
iptables -A srcfilt -j s0
if [ $MIN_MODE -eq 0 ] ; then
   # Remove the temp DNS accept rules
   iptables -D OUTPUT -p tcp --sport 0:65535 --dport 53:53 -j ACCEPT
   iptables -D INPUT -p tcp ! --syn --sport 53:53 --dport 0:65535 -j ACCEPT
   iptables -D OUTPUT -p udp --sport 0:65535 --dport 53:53 -j ACCEPT
   iptables -D INPUT -p udp --sport 53:53 --dport 0:65535 -j ACCEPT
fi
# The output chain is very simple. We direct everything to the
# 'source is local' split chain.
iptables -A OUTPUT -j s1
iptables -A INPUT -j nicfilt
iptables -A INPUT -j srcfilt
# All traffic on the forward chains goes to the srcfilt chain.
iptables -A FORWARD -j srcfilt &> /dev/null
logger -p 
auth.info
 -t guarddog Finished configuring firewall
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Finito."
fi;
fi;
true
-- 
sabato 27 linuxday 2007:
http://www.linuxday.it/index.php
distribuzione di distribuzioni gratuita!
installazione gratuita!
pretendete il meglio: Slackware o Debian!


Io intendevo se creando a mano il file /etc/rc.firewall e poi eseguivo
guarddog quest'ultimo sarebbe andato a scriverci sopra ...
... boh ... adesso vedo se ci capisco qualcosa sul tuo.
Ciao

 guarddog quest'ultimo sarebbe andato a scriverci sopra ...
mi ero distratto ;-P
cmq non credo sia questo il problema: al primo avvio Guarddog dovrebbe 
segnalarti che non trova il file di configurazione ma che la cosa è 
normale se è la prima volta che lo esegui;
tanto per sgombrare il campo: nat. lo usi come root (nella Slack prima 
di avviarsi mi chiede la pass di root, non ricordo se vale per tutte le 
distro);
r


 distro);
Non ho capito molto bene cosa sia nat (scusa sono ancora un po' 
spaesato) ma dandolo come comando in una shella (da root naturalmente) 
mi da: command not found
.. devo installare un qualche pacchetto? la sua eventuale mancanza puo' 
interferire con il problema di cui sopra?
Ciao e grazie

 interferire con il problema di cui sopra?
il pacchetto e' forse netstat-nat?

 interferire con il problema di cui sopra?
credo che andrà tutto a posto mettendo la riga in rc.local;


 credo che andrà tutto a posto mettendo la riga in rc.local;
adesso ci provo e poi riavvio ...

 naturalmente (è troppo lungo e tendo ad abbreviarlo);
visto il contesto direi che potevi essere frainteso, decisamente :)
 
 


Si'.
Sono anni che debbo prima leggere il mittente e poi analizzare il
testo. ;-)
Ed e' uno dei motivi per cui odio cordialmente le abbreviazioni che
non siano acronimi universalmente noti nel contesto in cui cisi trova.
Insomma, se scrivo GPL qui dentro, o se lo scrivo su it.hobby.meccanica
l'interlocutore capira' immediatamente di cosa parlo, anche se un cross
post metterebbe in crisi entrambi.
-- 
           |Save our planet!
    Ciao   |Save wildlife!
   roberto |For your E-MAIL use ONLY recycled Bytes  !!
           |roberto poggi   
rpo...@softhome.net

 credo che andrà tutto a posto mettendo la riga in rc.local;
Pare proprio che sia cosi' :-)