Hello,
I am trying to setup an iptables firewall on a slackware 9 box, running the 2.6.4. kernel. I want to upgrade from ipchains on slack 2, running on my old 486 :)
I would like to allow internal traffic out, allow for ssh, ping and ftp on both interfaces, and I would like to my web, ftp and e-mail servers behind the firewall. The firewall will also be doing dhcp for the inside, and nat from the inside to the outside. I am also running dns on the firewall (secondary dns at another location) that needs to be visible to the outside. I have a second web server inside that I would like to be able to make certain areas available to the outside, what do I need in my firewall rules to do this? (I know I will have to configure apache for specific access, and reconfigure my dns once the server is moved inside the firewall)
eth0 is the outside interface, and is connected to dsl (216.126.xxx.xxx) and is using dhcp.
eth1 is the indise interface and is fixed to 192.168.3.60
192.168.3.19 will be webserver/email server 1
192.168.3.17 is webserver 2
Here is what I currently have, I know it is not complete, and does not do any port forwarding, and it does not allow me to connect anything on the internet :(
#- Flush all the rules in filter and nat tables
iptables --flush
iptables --table nat --flush
#- Delete all chains that are not in default filter and nat table
iptables --delete-chain
iptables --table nat --delete-chain
# Set up IP FORWARDing and Masquerading
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --append FORWARD --in-interface eth1 -j ACCEPT
#- Enables packet forwarding by kernel
echo 1 > /proc/sys/net/ipv4/ip_forw
ard
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
#- Allow self access by loopback interface
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A OUTPUT -o lo -p all -j ACCEPT
#- Accept established connections
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --tcp-option ! 2 -j REJECT --reject-with tcp-reset
# Allow ping replies on BOTH interface
iptables -A INPUT -p ICMP -i eth0 -j ACCEPT
iptables -A INPUT -p ICMP -i eth1 -j ACCEPT
#- Open ftp port OUTSIDE interface
iptables -A INPUT -p tcp -i eth0 --dport 21 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -i eth1 --dport 21 -j ACCEPT
iptables -A INPUT -p udp -i eth1 --dport 21 -j ACCEPT
#- Open secure shell port BOTH Interfaces
iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -i eth1 --dport 22 -j ACCEPT
iptables -A INPUT -p udp -i eth1 --dport 22 -j ACCEPT
#- Open HTTP port BOTH Interface
iptables -A INPUT -p tcp -i eth0 --dport 80 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -i eth1 --dport 80 -j ACCEPT
iptables -A INPUT -p udp -i eth1 --dport 80 -j ACCEPT
# webmin both interfaces
iptables -A INPUT -p tcp -i eth1 --dport 10000 -j ACCEPT
iptables -A INPUT -p udp -i eth1 --dport 10000 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 10000 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --dport 10000 -j ACCEPT
#OUTPUT ruleset
any suggestions would be great.
Thanks
