[SOLVED] Normal iptables rules

Jason.nix · 02-15-2023, 04:34 AM

Hello,
Suppose your computer is in the internal network of an organization where a number of technicians and hackers are working there, are the following firewall rules sufficient?

Code:

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -N SYN_FLOOD
iptables -A INPUT -p tcp --syn -j SYN_FLOOD
iptables -A SYN_FLOOD -m limit --limit 5/s --limit-burst 10 -j RETURN
iptables -A SYN_FLOOD -j DROP

I know there are many parameters to consider, but I wanted to know what rules are enough for a firewall. I use Tor on my Debian box.

Thank you.

Ser Olmy · 02-15-2023, 06:44 AM

Seems reasonable enough; all inbound traffic is rejected except ESTALISHED and RELATED, and you've remembered to ACCEPT everything going to "lo".

The SYN_FLOOD chain is redundant as you've already defined DROP as the default policy, but if it's intended as a framework for later rules that may accept certain inbound traffic, it makes sense.

boughtonp · 02-15-2023, 08:37 AM

The netfilter wiki has various example default configs.

Jason.nix · 03-14-2023, 12:47 AM

Hello,
Thank you so much for all replies.

sundialsvcs · 03-15-2023, 01:33 PM

I will be the first to admit that I have no confidence in my own ability to set up "iptables rules" correctly. Namely, that I would not expose myself to some vulnerability that I did not know about. Or, "patch" some vulnerability but actually fail to do so [correctly].

Instead, I use open tools such as Shorewall to do the heavy-lifting for me. (And I have been very surprised at the complex set of rules that such tools have put in place.)

Shorewall allows me to describe "what I want," in terms that I can understand, and it then undertakes to do the "voodoo" for me. I like it that way. Because, to me, "iptables is(!) 'voodoo!'"

zeebra · 03-22-2023, 07:06 AM

Quote:

Originally Posted by Jason.nix

Hello,
I know there are many parameters to consider, but I wanted to know what rules are enough for a firewall. I use Tor on my Debian box.

Does that work well without a conntrack rule?

ForestuX · 03-31-2023, 07:49 PM

Hello all.
There are sereval "iptables rules generators" in the web.
I still use this Slackware adaptation:
http://www.slackware.com/~alien/efg/