Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My home network consists of a desktop PC running Slackware 64 [192.168.1.10]. My Windows PC [192.168.1.20] is routed through the Slackware PC via a direct ethernet connection. In addition to iptables, I run snort, psad, fail2ban and some other related software. On the Windows PC I have Comodo Firewall and HIPS enabled, Windows 8 Firewall Control, Avast and Sax2 NIDS.

It seems that whenever I lose connectivity for too long [1 min+], incoming ip addresses endlessly get routed to the lowest available "high port" like 1024,1025,etc. The only resolution seems to be to restart the Slackware PC, but I'm unable to confirm that as sometimes when I reboot it still happens.

Because of the way I setup psad, it will eventually block most of those incoming connections. I use Firewall Builder to setup the firewall. I'm interested in moving to shorewall with webmin for more flexibility but I'm not certain how to replicate the current firewall precisely.

I believe it may have something to do with the way the firewall is setup.

In Wireshark I can see that the firewall is sending ICMP Type 3, Code 2 messages [Destination Unreachable, Protocol Unreachable]. Perhaps it should be sending Port Unreachable instead, because incoming traffic doesn't seem to be getting the message.

These are the significant rules that should be routing the network. The entire firewall is too long so I've removed some of Firewall Builder's script.

IPV6 is disabled on both PC's. On the Slackware PC I had to partially allow ipv6 for netstat --inet

root@darkstar:/etc/modprobe.d#cat ipv6.conf
blacklist ipv6
#install ipv6 /bin/true

Some data about my ethernet devices:

Slackware PC    [eth1, 192.168.1.10] [eth0, My-IP]
Windows PC      [192.168.1.20]

root@darkstar:~# ifconfig

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST      mtu 1500
        inet My-IP  netmask 255.255.248.0  broadcast 255.255.255.255
        inet6 xxxxxxxxxxxxxxxxxxxxxxx prefixlen 64  scopeid 0x20<link    
        ether My-Mac-0  txqueuelen 1000  (Ethernet)
        RX packets 61735724  bytes 27728786435 (25.8 GiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 56726264  bytes 41655425971 (38.7 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST      mtu 1500
        inet 192.168.1.10  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 xxxxxxxxxxxxxxxxxxxxxxx prefixlen 64  scopeid 0x20<link    
        ether My-Mac-1  txqueuelen 1000  (Ethernet)
        RX packets 120480206  bytes 134096600150 (124.8 GiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 72007475  bytes 30033187281 (27.9 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 19  memory 0xf0400000-f0420000

lo: flags=73<UP,LOOPBACK,RUNNING      mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host    
        loop  txqueuelen 0  (Local Loopback)
        RX packets 1606474  bytes 142255818 (135.6 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1606474  bytes 142255818 (135.6 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


root@darkstar:~# ethtool eth0
Settings for eth0:
        Supported ports: [ TP MII ]
        Supported link modes:   10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
                                1000baseT/Half 1000baseT/Full
        Supported pause frame use: No
        Supports auto-negotiation: Yes
        Advertised link modes:  10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
                                1000baseT/Half 1000baseT/Full
        Advertised pause frame use: Symmetric Receive-only
        Advertised auto-negotiation: Yes
        Link partner advertised link modes:  10baseT/Half 10baseT/Full
                                             100baseT/Half 100baseT/Full
        Link partner advertised pause frame use: No
        Link partner advertised auto-negotiation: Yes
        Speed: 100Mb/s
        Duplex: Full
        Port: MII
        PHYAD: 0
        Transceiver: internal
        Auto-negotiation: on
        Supports Wake-on: pumbg
        Wake-on: g
        Current message level: 0x00000033 (51)
                               drv probe ifdown ifup
        Link detected: yes

root@darkstar:~# ethtool eth1
Settings for eth1:
        Supported ports: [ TP ]
        Supported link modes:   10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
                                1000baseT/Full
        Supported pause frame use: No
        Supports auto-negotiation: Yes
        Advertised link modes:  10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
                                1000baseT/Full
        Advertised pause frame use: No
        Advertised auto-negotiation: Yes
        Speed: 1000Mb/s
        Duplex: Full
        Port: Twisted Pair
        PHYAD: 1
        Transceiver: internal
        Auto-negotiation: on
        MDI-X: off (auto)
        Supports Wake-on: pumbg
        Wake-on: g
        Current message level: 0x00000007 (7)
                               drv probe link
        Link detected: yes

My Firewall:

$IPTABLES -A FORWARD -i eth0   -o eth0 -j DROP
$IPTABLES -A FORWARD -i eth1   -o eth1 -j DROP

$IPTABLES -F

$IPSET flush
$IPSET destroy blacklist
$IPSET create blacklist hash:ip hashsize 4096
$IPSET restore < /usr/local/.../blacklist

# Don?t accept or send ICMP redirects.
for i in / proc/sys/net/ipv4/conf/all/send_redirects; do echo 0 > $i; done
# Disable multicast routing
# permission denied on write access, cannot be disabled easily, but already disabled
#for i in / proc/sys/net/ipv4/conf/all/mc_forwarding; do echo 0 > $i; done
# Disable proxy_arp.
for i in / proc/sys/net/ipv4/conf/all/proxy_arp; do echo 0 > $i; done
# Enable secure redirects, ie only accept ICMP redirects for gateways
# Helps against MITM attacks.
for i in / proc/sys/net/ipv4/conf/all/secure_redirects; do echo 1 > $i; done
# Disable bootp_relay
for i in / proc/sys/net/ipv4/conf/all/bootp_relay; do echo 0 > $i; done

/usr/sbin/ip6tables -P INPUT DROP 2> /dev/null
/usr/sbin/ip6tables -P FORWARD DROP 2> /dev/null
/usr/sbin/ip6tables -P OUTPUT DROP 2> /dev/null
# The mangle table can pass everything
/usr/sbin/ip6tables -t mangle -P FORWARD ACCEPT 2> /dev/null
/usr/sbin/ip6tables -t mangle -P OUTPUT ACCEPT 2> /dev/null
/usr/sbin/ip6tables -t mangle -P POSTROUTING ACCEPT 2> /dev/null
# Delete all rules.
/usr/sbin/ip6tables -F 2> /dev/null
/usr/sbin/ip6tables -t mangle -F 2> /dev/null
# Delete all chains.
/usr/sbin/ip6tables -X 2> /dev/null
/usr/sbin/ip6tables -t mangle -X 2> /dev/null
# Zero all packets and counters.
/usr/sbin/ip6tables -Z 2> /dev/null
/usr/sbin/ip6tables -t mangle -Z 2> /dev/null

# Load necessary modules
OPTS=$1
MODULES_DIR="/lib/modules/`uname -r`/kernel/net/"
MODULES=$(find $MODULES_DIR -name '*conntrack*' \! -name '*ipv6*'|sed  -e 's/^.*\///' -e 's/\([^\.]\)\..*/\1/')
echo $OPTS | grep -q nat && {
    MODULES="$MODULES $(find $MODULES_DIR -name '*nat*'|sed  -e 's/^.*\///' -e 's/\([^\.]\)\..*/\1/')"
}
echo $OPTS | grep -q ipv6 && {
    MODULES="$MODULES $(find $MODULES_DIR -name nf_conntrack_ipv6|sed  -e 's/^.*\///' -e 's/\([^\.]\)\..*/\1/')"
}
for module in $MODULES; do
    if $LSMOD | grep ${module} w>/dev/null; then continue; fi
    $MODPROBE ${module} ||  exit 1
done

$IPTABLES -P OUTPUT  DROP
$IPTABLES -P INPUT   DROP
$IPTABLES -P FORWARD DROP
$IP6TABLES -P OUTPUT  DROP
$IP6TABLES -P INPUT   DROP
$IP6TABLES -P FORWARD DROP

echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# accept established sessions
$IPTABLES -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# drop TCP sessions opened prior firewall restart
$IPTABLES -A INPUT   -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
$IPTABLES -A OUTPUT  -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
$IPTABLES -A FORWARD -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
# drop packets that do not match any valid state and log them
$IPTABLES -N drop_invalid
$IPTABLES -A OUTPUT   -m state --state INVALID  -j drop_invalid
$IPTABLES -A INPUT    -m state --state INVALID  -j drop_invalid
$IPTABLES -A FORWARD  -m state --state INVALID  -j drop_invalid
$IPTABLES -A drop_invalid -j LOG --log-level debug --log-prefix "INVALID state -- DENY "
$IPTABLES -A drop_invalid -j DROP

$IPTABLES -t nat -A POSTROUTING -o eth0 -s 192.168.1.20 -j MASQUERADE
$IPTABLES -t nat -A PREROUTING -i eth0 -p udp -m udp --dport 9999 -j DNAT --to-destination 192.168.1.20:9999
... a few more DNATS ...

$IPTABLES -N TCP
$IPTABLES -N In_TCP_0
$IPTABLES -A TCP -i +  -p tcp -m tcp  -j In_TCP_0
$IPTABLES -A In_TCP_0  -j LOG  --log-level info --log-prefix "RULE 0 -- REJECT "
$IPTABLES -A In_TCP_0 -p tcp -m tcp  -j REJECT  --reject-with tcp-reset

$IPTABLES -N UDP
$IPTABLES -N In_UDP_0
$IPTABLES -A UDP -i +  -p udp -m udp  -j In_UDP_0
$IPTABLES -A In_UDP_0  -j LOG  --log-level info --log-prefix "RULE 0 -- REJECT "
$IPTABLES -A In_UDP_0  -j REJECT  --reject-with icmp-port-unreachable

$IPTABLES -N RULE_0
$IPTABLES -A OUTPUT  -m set --match-set blacklist src  -j RULE_0
$IPTABLES -A INPUT  -m set --match-set blacklist src  -j RULE_0
$IPTABLES -A FORWARD  -m set --match-set blacklist src  -j RULE_0
$IPTABLES -A RULE_0  -j LOG  --log-level info --log-prefix "RULE 0 -- DENY "
$IPTABLES -A RULE_0  -j DROP

$IPTABLES -N Out_RULE_1
$IPTABLES -A OUTPUT -o eth0   -m owner --gid-owner 1005  -j Out_RULE_1
$IPTABLES -A Out_RULE_1  -j LOG  --log-level info --log-prefix "RULE 1 -- REJECT "
$IPTABLES -A Out_RULE_1  -j REJECT

$IPTABLES -N Out_RULE_2
$IPTABLES -A OUTPUT -o lo  -p tcp -m tcp  -s 127.0.0.1   -d 127.0.0.1   --dport 2000  -j Out_RULE_2
$IPTABLES -A Out_RULE_2  -j LOG  --log-level info --log-prefix "RULE 2 -- ACCEPT "
$IPTABLES -A Out_RULE_2  -j ACCEPT

$IPTABLES -N In_RULE_3
$IPTABLES -A INPUT -i lo  -p tcp -m tcp  -s 127.0.0.1   -d 127.0.0.1   --dport 2000  -j In_RULE_3
$IPTABLES -A In_RULE_3  -j LOG  --log-level info --log-prefix "RULE 3 -- ACCEPT "
$IPTABLES -A In_RULE_3  -j ACCEPT

$IPTABLES -N RULE_4
$IPTABLES -A OUTPUT -p tcp -m tcp  --dport 2000  -j RULE_4
$IPTABLES -A INPUT -p tcp -m tcp  --dport 2000  -j RULE_4
$IPTABLES -A FORWARD -p tcp -m tcp  --dport 2000  -j RULE_4
$IPTABLES -A RULE_4  -j LOG  --log-level info --log-prefix "RULE 4 -- DENY "
$IPTABLES -A RULE_4  -j DROP

$IPTABLES -N PSAD_BLOCK_INPUT
$IPTABLES -A FORWARD -i +   -j PSAD_BLOCK_INPUT    
$IPTABLES -N PSAD_BLOCK_OUTPUT
$IPTABLES -A FORWARD -o +   -j PSAD_BLOCK_OUTPUT

$IPTABLES -A INPUT -i eth1  -p tcp -m tcp  -s 192.168.1.20   -d 192.168.1.10   --dport 3000  -j ACCEPT    
$IPTABLES -A FORWARD -i eth0   -o eth1 -m state --state ESTABLISHED,RELATED  -j ACCEPT    
$IPTABLES -A FORWARD -i eth1   -o eth0  -j ACCEPT

$IPTABLES -A OUTPUT -o eth0  -p tcp -m tcp  -d SOMEIPADDR   --dport 4000  -j ACCEPT    
$IPTABLES -A OUTPUT -o eth0  -p tcp -m tcp  -d SOMEIPADDR/22   --dport 5000  -j ACCEPT

$IPTABLES -N Cid47016X23463.0
$IPTABLES -A OUTPUT -o eth0  -p udp -m udp  --dport 67  -j Cid47016X23463.0
$IPTABLES -A Cid47016X23463.0  -d MYISP   -j ACCEPT
$IPTABLES -A Cid47016X23463.0  -d MYISP   -j ACCEPT

$IPTABLES -N Cid9266X4275.0
$IPTABLES -A OUTPUT -o eth0  -p tcp -m tcp  --dport 53  -j Cid9266X4275.0
$IPTABLES -A OUTPUT -o eth0  -p udp -m udp  --dport 53  -j Cid9266X4275.0
$IPTABLES -A Cid9266X4275.0  -d 4.4.4.4   -j ACCEPT
$IPTABLES -A Cid9266X4275.0  -d 8.8.8.8   -j ACCEPT
$IPTABLES -A Cid9266X4275.0  -d MYISP   -j ACCEPT
$IPTABLES -A Cid9266X4275.0  -d MYISP   -j ACCEPT
$IPTABLES -A Cid9266X4275.0  -d 208.67.220.220   -j ACCEPT
$IPTABLES -A Cid9266X4275.0  -d 208.67.222.222   -j ACCEPT

$IPTABLES -A OUTPUT -o eth0  -p icmp  -m icmp  --icmp-type 8/0   -j ACCEPT
$IPTABLES -A OUTPUT -o eth0  -p tcp -m tcp  -m multiport  --dports 21,80,443,143,993,110,995,25,465  -j ACCEPT
$IPTABLES -A OUTPUT -o eth0  -p udp -m udp  --dport 123  -j ACCEPT

$IPTABLES -N Cid810017X9998.0
$IPTABLES -A FORWARD -o eth0   -s 192.168.1.20   -j Cid810017X9998.0
$IPTABLES -A Cid810017X9998.0 -p icmp  -m icmp  --icmp-type 8/0   -j ACCEPT
$IPTABLES -A Cid810017X9998.0 -p tcp -m tcp  -m multiport  --dports 21,80,8080,443,143,993,110,995,25,465  -j ACCEPT
$IPTABLES -A Cid810017X9998.0 -p udp -m udp  -m multiport  --dports 8000,123  -j ACCEPT

$IPTABLES -N Cid47072X23463.0
$IPTABLES -A INPUT -i eth0  -p udp -m udp  --dport 68  -j Cid47072X23463.0
$IPTABLES -A Cid47072X23463.0  -s MYISP   -j ACCEPT
$IPTABLES -A Cid47072X23463.0  -s MYISP   -j ACCEPT

$IPTABLES -A INPUT -i eth0  -p icmp  -m icmp  --icmp-type 3  -j ACCEPT
$IPTABLES -A INPUT -i eth0  -p icmp  -m icmp  --icmp-type 0/0   -j ACCEPT
$IPTABLES -A INPUT -i eth0  -p icmp  -m icmp  --icmp-type 11/0   -j ACCEPT
$IPTABLES -A INPUT -i eth0  -p icmp  -m icmp  --icmp-type 11/1   -j ACCEPT

$IPTABLES -N Cid371118X9998.0
$IPTABLES -A FORWARD -i eth0   -d 192.168.1.20   -j Cid371118X9998.0
$IPTABLES -A Cid371118X9998.0 -p icmp  -m icmp  --icmp-type 3  -j ACCEPT
$IPTABLES -A Cid371118X9998.0 -p icmp  -m icmp  --icmp-type 0/0   -j ACCEPT
$IPTABLES -A Cid371118X9998.0 -p icmp  -m icmp  --icmp-type 11/0   -j ACCEPT
$IPTABLES -A Cid371118X9998.0 -p icmp  -m icmp  --icmp-type 11/1   -j ACCEPT
$IPTABLES -A Cid371118X9998.0 -p tcp -m tcp  -m multiport  --dports 6000,7000  -j ACCEPT
$IPTABLES -A Cid371118X9998.0 -p udp -m udp  -m multiport  --dports 6000,8000,7000  -j ACCEPT

$IPTABLES -A INPUT -i lo   -j ACCEPT
$IPTABLES -A OUTPUT -o lo   -j ACCEPT

$IPTABLES -A FORWARD -i +   -j UDP    
$IPTABLES -A FORWARD -i +   -j TCP

$IPTABLES -N In_RULE_22
$IPTABLES -A INPUT -i eth0   -s 224.0.0.0/4   -j In_RULE_22
$IPTABLES -A INPUT -i eth0   -s 255.255.255.255   -j In_RULE_22
$IPTABLES -A INPUT -i eth0   -s 0.0.0.0/8   -j In_RULE_22
$IPTABLES -A INPUT -i eth0   -s 10.0.0.0/8   -j In_RULE_22
$IPTABLES -A INPUT -i eth0   -s 127.0.0.0/8   -j In_RULE_22
$IPTABLES -A INPUT -i eth0   -s 168.254.0.0/16   -j In_RULE_22
$IPTABLES -A INPUT -i eth0   -s 169.254.0.0/16   -j In_RULE_22
$IPTABLES -A INPUT -i eth0   -s 172.16.0.0/12   -j In_RULE_22
$IPTABLES -A INPUT -i eth0   -s 192.0.2.0/24   -j In_RULE_22
$IPTABLES -A INPUT -i eth0   -s 192.168.0.0/16   -j In_RULE_22
$IPTABLES -A INPUT -i eth0   -s 240.0.0.0/5   -j In_RULE_22
$IPTABLES -A INPUT -i eth0   -s 248.0.0.0/5   -j In_RULE_22
$IPTABLES -A FORWARD -i eth0   -s 224.0.0.0/4   -j In_RULE_22
$IPTABLES -A FORWARD -i eth0   -s 255.255.255.255   -j In_RULE_22
$IPTABLES -A FORWARD -i eth0   -s 0.0.0.0/8   -j In_RULE_22
$IPTABLES -A FORWARD -i eth0   -s 10.0.0.0/8   -j In_RULE_22
$IPTABLES -A FORWARD -i eth0   -s 127.0.0.0/8   -j In_RULE_22
$IPTABLES -A FORWARD -i eth0   -s 168.254.0.0/16   -j In_RULE_22
$IPTABLES -A FORWARD -i eth0   -s 169.254.0.0/16   -j In_RULE_22
$IPTABLES -A FORWARD -i eth0   -s 172.16.0.0/12   -j In_RULE_22
$IPTABLES -A FORWARD -i eth0   -s 192.0.2.0/24   -j In_RULE_22
$IPTABLES -A FORWARD -i eth0   -s 192.168.0.0/16   -j In_RULE_22
$IPTABLES -A FORWARD -i eth0   -s 240.0.0.0/5   -j In_RULE_22
$IPTABLES -A FORWARD -i eth0   -s 248.0.0.0/5   -j In_RULE_22
$IPTABLES -A In_RULE_22  -j LOG  --log-level info --log-prefix "RULE 22 -- DENY "
$IPTABLES -A In_RULE_22  -j DROP
$IPTABLES -N Out_RULE_22
$IPTABLES -A OUTPUT -o eth0   -s 224.0.0.0/4   -j Out_RULE_22
$IPTABLES -A OUTPUT -o eth0   -s 255.255.255.255   -j Out_RULE_22
$IPTABLES -A OUTPUT -o eth0   -s 0.0.0.0/8   -j Out_RULE_22
$IPTABLES -A OUTPUT -o eth0   -s 10.0.0.0/8   -j Out_RULE_22
$IPTABLES -A OUTPUT -o eth0   -s 127.0.0.0/8   -j Out_RULE_22
$IPTABLES -A OUTPUT -o eth0   -s 168.254.0.0/16   -j Out_RULE_22
$IPTABLES -A OUTPUT -o eth0   -s 169.254.0.0/16   -j Out_RULE_22

$IPTABLES -A OUTPUT -o eth0   -s 172.16.0.0/12   -j Out_RULE_22
$IPTABLES -A OUTPUT -o eth0   -s 192.0.2.0/24   -j Out_RULE_22
$IPTABLES -A OUTPUT -o eth0   -s 192.168.0.0/16   -j Out_RULE_22
$IPTABLES -A OUTPUT -o eth0   -s 240.0.0.0/5   -j Out_RULE_22
$IPTABLES -A OUTPUT -o eth0   -s 248.0.0.0/5   -j Out_RULE_22
$IPTABLES -A FORWARD -o eth0   -s 0.0.0.0/8   -j Out_RULE_22
$IPTABLES -A FORWARD -o eth0   -s 10.0.0.0/8   -j Out_RULE_22
$IPTABLES -A FORWARD -o eth0   -s 127.0.0.0/8   -j Out_RULE_22
$IPTABLES -A FORWARD -o eth0   -s 168.254.0.0/16   -j Out_RULE_22
$IPTABLES -A FORWARD -o eth0   -s 169.254.0.0/16   -j Out_RULE_22
$IPTABLES -A FORWARD -o eth0   -s 172.16.0.0/12   -j Out_RULE_22
$IPTABLES -A FORWARD -o eth0   -s 192.0.2.0/24   -j Out_RULE_22
$IPTABLES -A FORWARD -o eth0   -s 192.168.0.0/16   -j Out_RULE_22
$IPTABLES -A FORWARD -o eth0   -s 240.0.0.0/5   -j Out_RULE_22
$IPTABLES -A FORWARD -o eth0   -s 248.0.0.0/5   -j Out_RULE_22
$IPTABLES -A Out_RULE_22  -j LOG  --log-level info --log-prefix "RULE 22 -- DENY "
$IPTABLES -A Out_RULE_22  -j DROP

$IPTABLES -N In_RULE_23
$IPTABLES -A INPUT -i eth0   -d 224.0.0.0/4   -j In_RULE_23
$IPTABLES -A INPUT -i eth0   -d 255.255.255.255   -j In_RULE_23
$IPTABLES -A INPUT -i eth0   -d 0.0.0.0/8   -j In_RULE_23
$IPTABLES -A INPUT -i eth0   -d 10.0.0.0/8   -j In_RULE_23
$IPTABLES -A INPUT -i eth0   -d 0.0.0.0/8   -j In_RULE_23
$IPTABLES -A INPUT -i eth0   -d 10.0.0.0/8   -j In_RULE_23
$IPTABLES -A INPUT -i eth0   -d 127.0.0.0/8   -j In_RULE_23
$IPTABLES -A INPUT -i eth0   -d 168.254.0.0/16   -j In_RULE_23
$IPTABLES -A INPUT -i eth0   -d 169.254.0.0/16   -j In_RULE_23
$IPTABLES -A INPUT -i eth0   -d 172.16.0.0/12   -j In_RULE_23
$IPTABLES -A INPUT -i eth0   -d 192.0.2.0/24   -j In_RULE_23
$IPTABLES -A INPUT -i eth0   -d 192.168.0.0/16   -j In_RULE_23
$IPTABLES -A INPUT -i eth0   -d 240.0.0.0/5   -j In_RULE_23
$IPTABLES -A INPUT -i eth0   -d 248.0.0.0/5   -j In_RULE_23
$IPTABLES -A FORWARD -i eth0   -d 0.0.0.0/8   -j In_RULE_23
$IPTABLES -A FORWARD -i eth0   -d 10.0.0.0/8   -j In_RULE_23
$IPTABLES -A FORWARD -i eth0   -d 127.0.0.0/8   -j In_RULE_23
$IPTABLES -A FORWARD -i eth0   -d 168.254.0.0/16   -j In_RULE_23
$IPTABLES -A FORWARD -i eth0   -d 169.254.0.0/16   -j In_RULE_23
$IPTABLES -A FORWARD -i eth0   -d 172.16.0.0/12   -j In_RULE_23
$IPTABLES -A FORWARD -i eth0   -d 192.0.2.0/24   -j In_RULE_23
$IPTABLES -A FORWARD -i eth0   -d 192.168.0.0/16   -j In_RULE_23
$IPTABLES -A FORWARD -i eth0   -d 240.0.0.0/5   -j In_RULE_23
$IPTABLES -A FORWARD -i eth0   -d 248.0.0.0/5   -j In_RULE_23
$IPTABLES -A In_RULE_23  -j LOG  --log-level info --log-prefix "RULE 23 -- DENY "
$IPTABLES -A In_RULE_23  -j DROP
$IPTABLES -N Out_RULE_23
$IPTABLES -A OUTPUT -o eth0   -d 224.0.0.0/4   -j Out_RULE_23
$IPTABLES -A OUTPUT -o eth0   -d 255.255.255.255   -j Out_RULE_23
$IPTABLES -A OUTPUT -o eth0   -d 0.0.0.0/8   -j Out_RULE_23
$IPTABLES -A OUTPUT -o eth0   -d 10.0.0.0/8   -j Out_RULE_23
$IPTABLES -A OUTPUT -o eth0   -d 127.0.0.0/8   -j Out_RULE_23
$IPTABLES -A OUTPUT -o eth0   -d 168.254.0.0/16   -j Out_RULE_23
$IPTABLES -A OUTPUT -o eth0   -d 169.254.0.0/16   -j Out_RULE_23
$IPTABLES -A OUTPUT -o eth0   -d 172.16.0.0/12   -j Out_RULE_23
$IPTABLES -A OUTPUT -o eth0   -d 192.0.2.0/24   -j Out_RULE_23
$IPTABLES -A OUTPUT -o eth0   -d 192.168.0.0/16   -j Out_RULE_23
$IPTABLES -A OUTPUT -o eth0   -d 240.0.0.0/5   -j Out_RULE_23
$IPTABLES -A OUTPUT -o eth0   -d 248.0.0.0/5   -j Out_RULE_23
$IPTABLES -A FORWARD -o eth0   -d 0.0.0.0/8   -j Out_RULE_23
$IPTABLES -A FORWARD -o eth0   -d 10.0.0.0/8   -j Out_RULE_23
$IPTABLES -A FORWARD -o eth0   -d 127.0.0.0/8   -j Out_RULE_23
$IPTABLES -A FORWARD -o eth0   -d 168.254.0.0/16   -j Out_RULE_23
$IPTABLES -A FORWARD -o eth0   -d 169.254.0.0/16   -j Out_RULE_23
$IPTABLES -A FORWARD -o eth0   -d 172.16.0.0/12   -j Out_RULE_23
$IPTABLES -A FORWARD -o eth0   -d 192.0.2.0/24   -j Out_RULE_23
$IPTABLES -A FORWARD -o eth0   -d 192.168.0.0/16   -j Out_RULE_23
$IPTABLES -A FORWARD -o eth0   -d 240.0.0.0/5   -j Out_RULE_23
$IPTABLES -A FORWARD -o eth0   -d 248.0.0.0/5   -j Out_RULE_23
$IPTABLES -A Out_RULE_23  -j LOG  --log-level info --log-prefix "RULE 23 -- DENY "
$IPTABLES -A Out_RULE_23  -j DROP

$IPTABLES -N In_RULE_24
$IPTABLES -A INPUT -i eth1   -s 192.168.1.10   -j In_RULE_24
$IPTABLES -A FORWARD -i eth1   -s 192.168.1.10   -j In_RULE_24
$IPTABLES -A In_RULE_24  -j LOG  --log-level info --log-prefix "RULE 24 -- DENY "
$IPTABLES -A In_RULE_24  -j DROP

$IPTABLES -N In_RULE_25
for i_eth0 in $i_eth0_list
do
test -n "$i_eth0" && $IPTABLES -A INPUT -i eth0   -s $i_eth0   -j In_RULE_25
done
for i_eth0 in $i_eth0_list
do
test -n "$i_eth0" && $IPTABLES -A FORWARD -i eth0   -s $i_eth0   -j In_RULE_25
done
$IPTABLES -A In_RULE_25  -j LOG  --log-level info --log-prefix "RULE 25 -- DENY "
$IPTABLES -A In_RULE_25  -j DROP    

$IPTABLES -N In_RULE_26
$IPTABLES -A INPUT  -s 168.254.0.0/16   -j In_RULE_26
$IPTABLES -A INPUT  -s 169.254.0.0/16   -j In_RULE_26
$IPTABLES -A FORWARD -i +   -s 168.254.0.0/16   -j In_RULE_26
$IPTABLES -A FORWARD -i +   -s 169.254.0.0/16   -j In_RULE_26
$IPTABLES -A In_RULE_26  -j LOG  --log-level info --log-prefix "RULE 26 -- DENY "
$IPTABLES -A In_RULE_26  -j DROP

$IPTABLES -N RULE_27
$IPTABLES -A OUTPUT -p icmp  -m icmp  --icmp-type any  -j RULE_27
$IPTABLES -A INPUT -p icmp  -m icmp  --icmp-type any  -j RULE_27
$IPTABLES -A FORWARD -p icmp  -m icmp  --icmp-type any  -j RULE_27
$IPTABLES -A RULE_27  -j LOG  --log-level info --log-prefix "RULE 27 -- DENY "
$IPTABLES -A RULE_27  -j DROP

$IPTABLES -N RULE_28
$IPTABLES -A OUTPUT  -j RULE_28
$IPTABLES -A INPUT  -j RULE_28
$IPTABLES -A FORWARD  -j RULE_28
$IPTABLES -A RULE_28  -j LOG  --log-level info --log-prefix "RULE 28 -- REJECT "
$IPTABLES -A RULE_28  -j REJECT  --reject-with icmp-proto-unreachable   


# These rules are here for use by Psad. Psad requires logging and for some reason ignores the above format of logging.

iptables -A INPUT -j LOG 
iptables -A FORWARD -j LOG
ip6tables -A INPUT -j LOG
ip6tables -A FORWARD -j LOG

echo 1 > /proc/sys/net/ipv4/ip_forward
echo 0 > /proc/sys/net/ipv6/conf/all/forwarding
share|improve this question

migrated from serverfault.com Feb 19 at 11:53

This question came from our site for system and network administrators.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.