Newsgroup: it.comp.os.linux.sys
Titolo: maledetto, si fa per dire, iptables

avevo configurato in 2 secondi il mio firewall/router con ipchains con 
le seguenti regole 8no eccessivamente restrittive, ma + che accettabili, 
secondo me, mel mio ambiente domenstico, con connessione ad ip variabile:
(quello che riporto è il fire ipchains savato da /etc/init.d/ipchains save)
:input DENY
:forward DENY
:output ACCEPT
-A input -s 
192.168.0.0/255.255.255.0
 -d 
0.0.0.0/0.0.0.0
 -j ACCEPT
-A input -s 
0.0.0.0/0.0.0.0
 -d 
0.0.0.0/0.0.0.0
 22:22 -p 6 -j ACCEPT
-A input -s 
0.0.0.0/0.0.0.0
 -d 
0.0.0.0/0.0.0.0
 22:22 -p 17 -j ACCEPT
-A input -s 
0.0.0.0/0.0.0.0
 -d 
0.0.0.0/0.0.0.0
 -p 1 -j ACCEPT
-A input -s 
0.0.0.0/0.0.0.0
 -d 
0.0.0.0/0.0.0.0
 1024:5999 -p 6 -j ACCEPT
-A input -s 
0.0.0.0/0.0.0.0
 -d 
0.0.0.0/0.0.0.0
 1024:5999 -p 17 -j ACCEPT
-A input -s 
0.0.0.0/0.0.0.0
 -d 
0.0.0.0/0.0.0.0
 6010:65535 -p 6 -j ACCEPT
-A input -s 
0.0.0.0/0.0.0.0
 -d 
0.0.0.0/0.0.0.0
 6010:65535 -p 17 -j ACCEPT
-A input -s 
0.0.0.0/0.0.0.0
 -d 
0.0.0.0/0.0.0.0
 -i lo -j ACCEPT
-A forward -s 
192.168.0.0/255.255.255.0
 -d 
0.0.0.0/0.0.0.0
 -j MASQ
inutile dire che funzionava benissimo!
ora sono passato ad iptables, e il masquerading non funge +! dove sbaglio?
(ecco il file savato in /etc/sysconfig da /etc/init.d/iptables dopo che 
ho inserito le regole a mano ad una ad una!)
# Generated by iptables-save v1.2.4 on Wed Mar  6 00:04:41 2002
*nat
:PREROUTING ACCEPT [267:48931]
:POSTROUTING ACCEPT [1892:114218]
:OUTPUT ACCEPT [1892:114218]
[0:0] -A POSTROUTING -s 
192.168.0.0/255.255.255.0
 -o ppp0 -j MASQUERADE
COMMIT
# Completed on Wed Mar  6 00:04:41 2002
# Generated by iptables-save v1.2.4 on Wed Mar  6 00:04:41 2002
*filter
:INPUT DROP [7:810]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [87307:61795321]
[0:0] -A INPUT -p tcp -m tcp --dport 1024:5999 -j ACCEPT
[0:0] -A INPUT -p udp -m udp --dport 1024:5999 -j ACCEPT
[74876:60945442] -A INPUT -p tcp -m tcp --dport 6010:65535 -j ACCEPT
[4652:666948] -A INPUT -p udp -m udp --dport 6010:65535 -j ACCEPT
[488:35936] -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
[0:0] -A INPUT -p udp -m udp --dport 22 -j ACCEPT
[122:55933] -A INPUT -i lo -j ACCEPT
[0:0] -A INPUT -s 
192.168.0.0/255.255.255.0
 -j ACCEPT
COMMIT
# Completed on Wed Mar  6 00:04:41 2002

> :FORWARD DROP [0:0]
Scusa ma rispondo velocissimo e potrei non aver letto bene: direi
che stai droppando tutto il traffico in forward, anche quello che
passa attraverso nat.
In ogni caso le regole che hai riportato sono per lo piu' inutili
con netfilter: puoi usarne di meno e di piu' sicure se sfrutti le
funzionalita' di stateful inspection: magari dai un occhiata a un
paio di tutorial.
Comunque sshd non e' in ascolto sulla 22/udp e probabilmente stai
accettando in input su ppp0 pacchetti spoofati con gli ip privati
della tua rete interna ;)
Fabio

 # Completed on Wed Mar  6 00:04:41 2002
Nella FORWARD hai messo solo DROP.
Se ho ben capito quando fai il masquerade i pacchetti passano per forward
devi quindi aprire le porte che ti interessano
esempio:
	iptables -A FORWARD -p tcp --dport 22 -j ACCEPT
Non ho mai usato ipchains ma da quello che ho capito devi fare attenzione
che con iptables le catene di INPUT e OUTPUT vengono usate solo dai pacchetti
generati/destinati per la tua macchina Firewall.
Poi ognuno di questi problemi ha storia a se e io ti potrei anche aver
detto delle cazzate ma siccome sono le 9:51 e sto dormendo all'impiedi
non mi ritengo responsabile di eventuali danni ai tuoi sistemi. *g*
-- 
Saluti, Antonio Gallo - AGX per gli amici di Usenet
(o_         
http://www.antoniogallo.it
   Sito personale
//\         
http://www.badpenguin.org
    Progetto "Bad Penguin" (d)
V_/_        
http://www.linux.it/ILS
      Italian Linux Society 

inutile:
ho aggiunto il forward a tutta la rete locale ma continua a non funzionare
# Generated by iptables-save v1.2.4 on Wed Mar  6 12:39:25 2002
*nat
:PREROUTING ACCEPT [323:51993]
:POSTROUTING ACCEPT [1986:120107]
:OUTPUT ACCEPT [1986:120107]
[0:0] -A POSTROUTING -s 
192.168.0.0/255.255.255.0
 -o ppp0 -j MASQUERADE
COMMIT
# Completed on Wed Mar  6 12:39:25 2002
# Generated by iptables-save v1.2.4 on Wed Mar  6 12:39:25 2002
*filter
:INPUT DROP [50:3222]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [88443:61883879]
[0:0] -A INPUT -p tcp -m tcp --dport 1024:5999 -j ACCEPT
[0:0] -A INPUT -p udp -m udp --dport 1024:5999 -j ACCEPT
[75570:61041485] -A INPUT -p tcp -m tcp --dport 6010:65535 -j ACCEPT
[4846:693812] -A INPUT -p udp -m udp --dport 6010:65535 -j ACCEPT
[488:35936] -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
[0:0] -A INPUT -p udp -m udp --dport 22 -j ACCEPT
[324:71139] -A INPUT -i lo -j ACCEPT
[0:0] -A INPUT -s 
192.168.0.0/255.255.255.0
 -j ACCEPT
[0:0] -A FORWARD -s 
192.168.0.0/255.255.255.0
 -j ACCEPT
COMMIT
# Completed on Wed Mar  6 12:39:25 2002

 [0:0] -A FORWARD -s 
192.168.0.0/255.255.255.0
 -j ACCEPT
Se non sbaglio il traffico così "esce"
ma poi effettui il drop di tutto quello che torna indietro verso gli
host che hai mascherato...
Credo che devi aggiungere anche la seguente regola per permettere a
tutte le connessioni che sono uscite di poter rientrare 
	iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
p.s.
se sbaglio correggetemi, please!!!


 ha scritto nel messaggio
news:3C856846...@proxys.com...
| avevo configurato in 2 secondi il mio firewall/router con ipchains con
| le seguenti regole 8no eccessivamente restrittive, ma + che accettabili,
| [0:0] -A POSTROUTING -s 
192.168.0.0/255.255.255.0
 -o ppp0 -j MASQUERADE
iptables -t nat -A POSTROUTING -d ! 
192.168.0.0/24
 -j MASQUERADE
puo' andare con le dovute correzzioni??
--
[ Penguin At Work ]
-> 
http://web.tiscali.it/penguinatwork/
-> aka Fustino Di Dixan while working

ora funziona, grazie mille!
questa era solo la configurazione di partenza, volevo partire con 
qualcosa che già funzionava... ora cerco di milgiorare le regole!
grazie

cosě va meglio?
# Generated by iptables-save v1.2.4 on Wed Mar  6 15:43:09 2002
*nat
:PREROUTING ACCEPT [635:70179]
:POSTROUTING ACCEPT [2375:143931]
:OUTPUT ACCEPT [2375:143931]
[61:4064] -A POSTROUTING -s 
192.168.0.0/255.255.255.0
 -o ppp0 -j MASQUERADE
COMMIT
# Completed on Wed Mar  6 15:43:09 2002
# Generated by iptables-save v1.2.4 on Wed Mar  6 15:43:09 2002
*filter
:INPUT DROP [258:15054]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [94132:62343758]
[0:0] -A INPUT -p tcp -m tcp --dport 1024:5999 -m state --state 
RELATED,ESTABLISHED -j ACCEPT
[19:760] -A INPUT -p udp -m state --state RELATED,ESTABLISHED -m udp 
--dport 1024:5999 -j ACCEPT
[79171:61665171] -A INPUT -p tcp -m tcp --dport 6010:65535 -m state 
--state RELATED,ESTABLISHED -j ACCEPT
[5761:818423] -A INPUT -p udp -m state --state RELATED,ESTABLISHED -m 
udp --dport 6010:65535 -j ACCEPT
[488:35936] -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
[0:0] -A INPUT -p udp -m udp --dport 22 -j ACCEPT
[1266:147142] -A INPUT -i lo -j ACCEPT
[0:0] -A INPUT -s 
192.168.0.0/255.255.255.0
 -i eth0 -j ACCEPT
[596:70084] -A FORWARD -s 
192.168.0.0/255.255.255.0
 -i eth0 -o ppp0 -j 
ACCEPT
[524:430653] -A FORWARD -d 
192.168.0.0/255.255.255.0
 -i ppp0 -o eth0 -m 
state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Wed Mar  6 15:43:09 2002


Ti mando una riduzione di uno script che uso io
non lanciarlo prendilo come esempio.
***BETA***
#!/bin/sh
. /etc/rc.d/functions.inc
if [ -f /etc/rc.conf.default ]; then
  . /etc/rc.conf.default
fi
if [ -f /etc/rc.conf ]; then
  . /etc/rc.conf
fi
case $1 in
start)
if [ "$firewall" != "YES" ]; then
  CHK_WARN "1" "service" "firewall" "is not enabled"
  exit 0
fi
echoc CYAN "(*) starting firewall... "
LOGPARAM="-j LOG --log-level info -m limit --limit 5/minute --limit-burst 3 "
LOGIDS="-j LOG --log-level info -m limit --limit 50/minute --limit-burst 5 "
# IP Spoofing ( 0=disabled; 1=rp filter; 2=reverse path_filtering)
# Log Martians ( 0=disabled; 1=enabled)
for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do
  echo $firewall_rpfilter > $f
done
for f in /proc/sys/net/ipv4/conf/*/log_martians ; do
  echo $firewall_log_martians > $f
done
# flush and create
#echo -n "init "
iptables -F 
iptables -t nat -F 
iptables -t mangle -F 
for c in drop-and-log drop-ids check_tcp check_udp check_icmp local_input \
	local_forward external_input external_forward 
do
  iptables -N $c 1>/dev/null 2>/dev/null
  iptables -F $c
done
iptables -Z
# default
iptables -P INPUT   ACCEPT
iptables -P OUTPUT  ACCEPT
iptables -P FORWARD ACCEPT
echo "... firewalling '$firewall_int' ==> '$firewall_ext'"
# DROP-AND-LOG
iptables -A drop-and-log $LOGPARAM --log-prefix "log-drop: "
iptables -A drop-and-log -j DROP
# DROP-IDS
iptables -A drop-ids -p tcp --tcp-flags ALL NONE $LOGIDS \
	--log-prefix "hping-null-drop: "
iptables -A drop-ids -p tcp --tcp-flags ALL NONE -j DROP
#iptables -A drop-ids -p tcp --tcp-flags ALL ACK  $LOGIDS \
	--log-prefix "hping-ack-drop: "
#iptables -A drop-ids -p tcp --tcp-flags ALL ACK  -j DROP
iptables -A drop-ids -p tcp --tcp-flags ALL FIN $LOGIDS \
	--log-prefix "nmap-fin-drop: "
iptables -A drop-ids -p tcp --tcp-flags ALL FIN -j DROP
iptables -A drop-ids -p tcp --tcp-flags ALL FIN,URG,PSH $LOGIDS \
	--log-prefix "nmap-xmas-drop: "
iptables -A drop-ids -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
iptables -A drop-ids -p tcp --tcp-flags ALL ALL $LOGIDS \
	--log-prefix "nmap-xmas2-drop: "
iptables -A drop-ids -p tcp --tcp-flags ALL ALL -j DROP
iptables -A drop-ids -p tcp --tcp-flags SYN,FIN SYN,FIN $LOGIDS \
	--log-prefix "synfin-drop: "
iptables -A drop-ids -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A drop-ids -p tcp --tcp-flags SYN,RST SYN,RST $LOGIDS \
	--log-prefix "synrst-drop: "
iptables -A drop-ids -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A drop-ids -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG $LOGIDS \
	--log-prefix "nmapmisc-drop: "
iptables -A drop-ids -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
iptables -A drop-ids -p tcp ! --syn -m state --state NEW $LOGIDS \
	--log-prefix "newnotsyn-drop: "
iptables -A drop-ids -p tcp ! --syn -m state --state NEW -j DROP
iptables -A drop-ids -m state --state INVALID $LOGIDS \
	--log-prefix "invalid-drop: "
iptables -A drop-ids -m state --state INVALID -j DROP
iptables -A drop-ids -m psd  $LOGIDS --log-prefix "psd-drop: "
iptables -A drop-ids -m psd  -j DROP
iptables -A drop-ids $LOGIDS --log-prefix "generic-ids-drop: "
iptables -A drop-ids -j DROP
# ***** Accept TCP ****
# If you have a TCP packet for an open port please call this chain
# instead of accept
# Syn Flood:
#iptables -A accept_tcp -p tcp --syn -m limit --limit 5/s \
	--limit-burst 5 -j ACCEPT
#iptables -A accept_tcp -p tcp --syn -j drop-ids
#iptables -A accept_tcp -j ACCEPT
# ***** TCP *****
# Portscan with Syn
iptables -A check_tcp -m psd  -j drop-ids
# NMAP X-MAS
iptables -A check_tcp -p tcp --tcp-flags ALL FIN,URG,PSH -j drop-ids
iptables -A check_tcp -p tcp --tcp-flags ALL ALL -j drop-ids
# Kill any Inbound/Outbound TCP-Packets with impossible flag-combinations 
# (Some port-scanners use these, eg. nmap Xmas,Null,etc.-scan)
iptables -A check_tcp -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j drop-ids
# HPING: Null scan
iptables -A check_tcp -p tcp --tcp-flags ALL NONE -j drop-ids
# SYN/RST
iptables -A check_tcp -p tcp --tcp-flags SYN,RST SYN,RST -j drop-ids
# SYN/FIN -- Scan(probably)
iptables -A check_tcp -p tcp --tcp-flags SYN,FIN SYN,FIN -j drop-ids
# NMAP FIN scan
iptables -A check_tcp -p tcp --tcp-flags ALL FIN  -j drop-ids
# Kill INVALID packets (not ESTABLISHED, RELATED or NEW)
iptables -A check_tcp -m state --state INVALID -j drop-ids
# Log & Drop TCP packets with NEW state, but aren't SYN 
iptables -A check_tcp -p tcp ! --syn -m state --state NEW -j drop-ids
# -----------------------------------------------------
# ATTACK: furtive port scanner
#iptables -A check_tcp -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit \
	--limit 1/s -j ACCEPT
# Silently reject Ident: because of possible delays when establishing 
#an outbound connection
#iptables -A check_tcp -p tcp --syn --dport 113 -j REJECT \
	--reject-with icmp-port-unreach
#iptables -A check_tcp -p tcp --dport 113 -j REJECT --reject-with tcp-reset
# ***** controllo UDP *****
# block UDP-Traceroute
#iptables -A check_udp -p udp --dport 33434:33523 -j drop-and-log
# ***** controllo ICMP *****
# Possible attacks can came from: redirect, timestamp-request, 
# timestamp-reply, address-mask-request, address-mask-reply, parameter-problem
# MS Traceroute (MS uses ICMP instead of UDp for tracert): 
# ttl-zero-during-transit, ttl-zero-during-reassembly
#
# Smurf:
#iptables -A check_icmp -p icmp -i $firewall_ext -d $firewall_net -j drop-ids
# don't let in packets larger than 84 byte (Normal ping)
#iptables -A ALLOW_ICMP -p icmp --icmp-type echo-request -m length 
#	--length ! :84 -j drop-ids
# Ping of death:
#iptables -A check_icmp -p icmp --icmp-type echo-request -m limit 
#	 --limit 5/s --limit-burst 5 -j ACCEPT
#iptables -A check_icmp -p icmp --icmp-type echo-request -j drop-ids
# TTL Exceeded (traceroute)
#iptables -A check_icmp -p icmp --icmp-type 11 -j drop-ids
#
iptables -A check_icmp -p icmp --icmp-type echo-reply              -j ACCEPT
iptables -A check_icmp -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A check_icmp -p icmp --icmp-type time-exceeded           -j ACCEPT
#
iptables -A check_icmp -p icmp --icmp-type source-quench           -j ACCEPT
#
iptables -A check_icmp -p icmp $LOGPARAM --log-prefix "icmp-drop: "
iptables -A check_icmp -p icmp -j DROP
# ===== Traffico da rete interna verso firewall =====
gen_hosts_rules		local_input	/etc/firewall/
hosts.int
gen_services_rules	local_input	/etc/firewall/
serv.int
# ===== Traffico da rete esterna verso firewall =====
gen_hosts_rules		external_input	/etc/firewall/hosts.ext
gen_services_rules	external_input	/etc/firewall/serv.ext
# ===== Traffico da rete interna verso rete esterna ======
gen_hosts_fwd_rules	local_forward	/etc/firewall/hosts.fwd
gen_services_rules	local_forward	/etc/firewall/serv.fwd
# ===== Traffico da rete esterna verso rete interna =====
# (!!!) Nessuna regola sugli host.... questo deve essere gestito dalla DMZ
# (!!!) Nessuna regola sui servizi... questo deve essere gestito dal portfwd
# ***** I N P U T *****
# remote interface claiming to be local machine (ip spoofing)
#iptables -A INPUT -i $firewall_ext -s $firewall_net -d 0/0 -j drop-ids
# controllo pacchetti
iptables -A INPUT -p tcp  -j check_tcp
iptables -A INPUT -p udp  -j check_udp
iptables -A INPUT -p icmp -j check_icmp
# Toglie i frammenti
#iptables -A INPUT -f -j drop-ids
# permette al traffico già prestabilito di passare
iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT
# da rete esterna verso firewall
for ii in $firewall_ext ; do
  iptables -A INPUT -i $ii -d $firewall_ipaddr -j external_input
done
# da rete interna verso firewall
for ii in $firewall_int ; do
  iptables -A INPUT -i $ii -d $firewall_ipaddr -j local_input
done
# da firewall verso firewall
iptables -A INPUT  -i lo -j ACCEPT
# ***** O U T P U T *****
# permette al traffico già prestabilito di passare
iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT
# controllo pacchetti
#iptables -A OUTPUT -p tcp  -j check_tcp
#iptables -A OUTPUT -p udp  -j check_udp
#iptables -A OUTPUT -p icmp -j check_icmp
# da firewall verso rete esterna
for ee in $firewall_ext ; do
  iptables -A OUTPUT -s $firewall_ipaddr -o $ee -j ACCEPT
done
# da firewall verso rete interna
for ii in $firewall_int ; do
  iptables -A OUTPUT -s $firewall_ipaddr -o $ii -j ACCEPT
done 
# da firewall verso firewall
iptables -A OUTPUT -o lo -j ACCEPT
# ***** F O R W A R D *****
# controllo pacchetti
iptables -A FORWARD -p tcp  -j check_tcp
iptables -A FORWARD -p udp  -j check_udp
iptables -A FORWARD -p icmp -j check_icmp
# Spoofing
#iptables -A FORWARD -s $firewall_net -i $firewall_ext -j drop-ids
# permette al traffico già prestabilito di passare
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# da rete interna verso rete esterna
for ii in $firewall_int ; do
  for ee in $firewall_ext ; do
    iptables -A FORWARD -i $ii -o $ee -j local_forward
  done
done
# da rete esterna verso rete interna 
for ee in $firewall_ext ; do
  for ii in $firewall_int ; do
    iptables -A FORWARD -i $ee -o $ii -j external_forward
  done
done
# ***** Logga e scarta tutto *****
# Non loggare Netbios
iptables -A INPUT -p udp --dport 138 -j DROP
iptables -A INPUT -p udp --dport 137 -j DROP
iptables -A INPUT   $LOGPARAM --log-prefix "input-drop: "
iptables -A INPUT   -j DROP
iptables -A OUTPUT  $LOGPARAM --log-prefix "output-drop: "
iptables -A OUTPUT  -j DROP
iptables -A FORWARD $LOGPARAM --log-prefix "forward-drop: "
iptables -A FORWARD -j DROP
# ===== NAT =====
if [ "$firewall_nat" = "YES" ]; then
  echo "... masquerading $firewall_net"
  iptables -t nat -A POSTROUTING -s "$firewall_net" -j MASQUERADE
  #DEBUG: devo aggiungere==> -o $firewall_ext   ???
fi
# ***** Tune Kernel Parameters *****
#echo "> tuning kernel parameters"
echo 1 > /proc/sys/net/ipv4/ip_forward 
# don't respond to broadcast pings (Smurf-Amplifier-Protection)
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
# enable bad error message protection
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
# drop the ECN flag in tcp-packets
echo 0 > /proc/sys/net/ipv4/tcp_ecn
# kill timestamps
echo 0 > /proc/sys/net/ipv4/tcp_timestamps
# enable SYN Cookies
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
# reduce DoS'ing ability by reducing timeouts
echo   30 > /proc/sys/net/ipv4/tcp_fin_timeout
echo 2400 > /proc/sys/net/ipv4/tcp_keepalive_time
echo    0 > /proc/sys/net/ipv4/tcp_sack
echo    0 > /proc/sys/net/ipv4/tcp_window_scaling
# kill redirects
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
# block source routing
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
## - Don't send ICMP redirects - needed for transparent proxy
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
# increase maximum limit of ip_conntrack
echo 16384 > /proc/sys/net/ipv4/ip_conntrack_max
#end of start
;;
stop)
	#echoc CYAN -n "(*) stopping firewall ... "
	iptables -F
	iptables -X
	CHK_ERR "0" "stopped" "firewall"
	;;
*)
	echoc RED "$0: parametro '$1' sconosciuto"
	exit 1
	;;
esac
*** OGNI COMMENTO E' GRADITISSIMO ***


 [0:0] -A INPUT -p udp -m udp --dport 22 -j ACCEPT
A che serve l'udp sulla prota dello ssh?


 
sě, aperto a tutti perché accedo alla mia lan da fuori... dai clienti 
per esempio se mi serve qualcosa che mi sono dimenticato di mettere nel 
portatile... per questo accedo in ssh o sftp al mio router e poi mi 
muovo nella mia lan...
non credo sia molto pericoloso.
in /etc/services avevo trovato la porta 22/udp abbinata a ssh:
...
ssh             22/tcp              # SSH Remote Login Protocol
ssh             22/udp              # SSH Remote Login Protocol
...
nemmeno secondo me seerve a qualcosa, ma visto che non c'e' comunque 
nulla la lasio aperta