Re: Trying to make extremely secure firewall

From	Robert Ricardo Ikaka <ikaka.robert.online@gmail.com>
Newsgroups	linux.debian.security
Subject	Re: Trying to make extremely secure firewall
Date	2022-01-15 04:30 +0100
Message-ID	<DFHVo-7C2-5@gated-at.bofh.it> (permalink)
References	<Dyouu-1r3-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

https://chng.it/jJvMChbdsJ

вс, 26 дек. 2021 г., 02:13 linux_forum1 <linux_forum1@protonmail.com>:

> Hello, I'm trying to make the most specific, secure and restrictive
> iptables possible for a simple VPN connection on Debian. Could you have a
> quick look if those are OK? Thanks so much!
>
> VPN Server Port:1194
>
> VPN Server IP: 189.174.135.110
>
> -P INPUT DROP
> -P FORWARD DROP
> -P OUTPUT DROP
>
> #no fragmented packets
> -A INPUT -f -j DROP
> #localhost
> -A INPUT -s 127.0.0.0/8 ! -i lo -j DROP
> -A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
> -A OUTPUT -o lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
> # first packet has to be TCP syn
> -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
> #drop sop icmp
> -A INPUT -p icmp --icmp-type address-mask-request -j DROP
> -A INPUT -p icmp --icmp-type timestamp-request -j DROP
> #Ping from inside to outside
>  -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
>  -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
> #drop broadcast, multicast anycast
> -A INPUT -m addrtype --dst-type BROADCAST -j DROP
> -A INPUT -m addrtype --dst-type MULTICAST -j DROP
> -A INPUT -m addrtype --dst-type ANYCAST -j DROP
> -A INPUT -d 224.0.0.0/4 -j DROP
> #drop invalid
> -A INPUT -m state --state INVALID -j DROP
> #drop spoofed packets
> -A INPUT -s 0.0.0.0/8 -j DROP
> -A INPUT -d 0.0.0.0/8 -j DROP
> -A INPUT -d 239.255.255.0/24 -j DROP
> -A INPUT -d 255.255.255.255 -j DROP
> # DROP RFC1918 PACKETS
> -A INPUT -s 10.0.0.0/8 -j DROP
> -A INPUT -s 172.16.0.0/12 -j DROP
> -A INPUT -s 192.168.0.0/16 -j DROP
> #Allow VPN
>
> - A INPUT -i eth0 -p udp -m udp -s 189.174.135.110 -d 192.168.1.0/24 --sport
> 1194 --dport 32768:65535 -m conntrack --ctstate ESTABLISHED -j ACCEPT
> -A OUTPUT -o eth0 -p udp -m udp -s 192.168.1.0/24 -d 189.174.135.110 --dport
> 1194 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
>
>
>
>
>
>

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Trying to make extremely secure firewall linux_forum1 <linux_forum1@protonmail.com> - 2021-12-26 00:20 +0100
  Re: Trying to make extremely secure firewall Robert Ricardo Ikaka <ikaka.robert.online@gmail.com> - 2022-01-15 04:30 +0100

csiph-web