Re: Trying to make extremely secure firewall

Path	csiph.com!newsfeed.xs4all.nl!newsfeed7.news.xs4all.nl!bofh.it!news.nic.it!robomod
From	Robert Ricardo Ikaka <ikaka.robert.online@gmail.com>
Newsgroups	linux.debian.security
Subject	Re: Trying to make extremely secure firewall
Date	Sat, 15 Jan 2022 04:30:02 +0100
Message-ID	<DFHVo-7C2-5@gated-at.bofh.it> (permalink)
References	<Dyouu-1r3-5@gated-at.bofh.it>
X-Original-To	linux_forum1 <linux_forum1@protonmail.com>
X-Mailbox-Line	From debian-security-request@lists.debian.org Sat Jan 15 03:20:46 2022
Old-Return-Path	<ikaka.robert.online@gmail.com>
X-Amavis-Spam-Status	No, score=-1.557 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FOURLA=0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=2, LDO_WHITELIST=-5, NORMAL_HTTP_TO_IP=2.3, NUMERIC_HTTP_ADDR=1.242, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no autolearn_force=no
X-Policyd-Weight	using cached result; rate: -5.5
X-Gm-Message-State	AOAM533isbMVAwsfGTP3oZttXgwddPLJrcoGSqZf4oWajRUDMXoZRB3Y H4JMILf7U2rQ/PlPJVijKv/jaFrzGTT/4lG2YSY=
X-Google-SMTP-Source	ABdhPJyQPqLil2W+NU7e1WcfCxBytpBnOONczBIwiMxVZLhfL9nSsyWBKKEHmhvmX6uzjkam7LrMQhvWGVL0O/EklsU=
X-Received	by 2002:a63:ab01:: with SMTP id p1mr10197867pgf.437.1642216825046; Fri, 14 Jan 2022 19:20:25 -0800 (PST)
MIME-Version	1.0
Content-Type	multipart/alternative; boundary="000000000000804c4005d5966665"
X-Mailing-List	<debian-security@lists.debian.org> archive/latest/29139
List-ID	<debian-security.lists.debian.org>
List-URL	<https://lists.debian.org/debian-security/>
List-Archive	https://lists.debian.org/msgid-search/CAPg0vjqCwiUrd3EtD5uM_P+wr-G3ZkGH+jVU7vMhR5EnPzoB3g@mail.gmail.com
Approved	robomod@news.nic.it
Lines	136
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Cc	debian-security@lists.debian.org
X-Original-Date	Sat, 15 Jan 2022 06:20:13 +0300
X-Original-Message-ID	<CAPg0vjqCwiUrd3EtD5uM_P+wr-G3ZkGH+jVU7vMhR5EnPzoB3g@mail.gmail.com>
X-Original-References	<WXIteMZMhVsXhXPIIiAbvq77Yu70bdleq1hRhJn9AArQ51tXwLSni253DNSDe-dgMybJrsgdT15sRug4dVt1SGpw2cimPkL7efbzGoXOm7g=@protonmail.com>
Xref	csiph.com linux.debian.security:5995

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

https://chng.it/jJvMChbdsJ

вс, 26 дек. 2021 г., 02:13 linux_forum1 <linux_forum1@protonmail.com>:

> Hello, I'm trying to make the most specific, secure and restrictive
> iptables possible for a simple VPN connection on Debian. Could you have a
> quick look if those are OK? Thanks so much!
>
> VPN Server Port:1194
>
> VPN Server IP: 189.174.135.110
>
> -P INPUT DROP
> -P FORWARD DROP
> -P OUTPUT DROP
>
> #no fragmented packets
> -A INPUT -f -j DROP
> #localhost
> -A INPUT -s 127.0.0.0/8 ! -i lo -j DROP
> -A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
> -A OUTPUT -o lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
> # first packet has to be TCP syn
> -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
> #drop sop icmp
> -A INPUT -p icmp --icmp-type address-mask-request -j DROP
> -A INPUT -p icmp --icmp-type timestamp-request -j DROP
> #Ping from inside to outside
>  -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
>  -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
> #drop broadcast, multicast anycast
> -A INPUT -m addrtype --dst-type BROADCAST -j DROP
> -A INPUT -m addrtype --dst-type MULTICAST -j DROP
> -A INPUT -m addrtype --dst-type ANYCAST -j DROP
> -A INPUT -d 224.0.0.0/4 -j DROP
> #drop invalid
> -A INPUT -m state --state INVALID -j DROP
> #drop spoofed packets
> -A INPUT -s 0.0.0.0/8 -j DROP
> -A INPUT -d 0.0.0.0/8 -j DROP
> -A INPUT -d 239.255.255.0/24 -j DROP
> -A INPUT -d 255.255.255.255 -j DROP
> # DROP RFC1918 PACKETS
> -A INPUT -s 10.0.0.0/8 -j DROP
> -A INPUT -s 172.16.0.0/12 -j DROP
> -A INPUT -s 192.168.0.0/16 -j DROP
> #Allow VPN
>
> - A INPUT -i eth0 -p udp -m udp -s 189.174.135.110 -d 192.168.1.0/24 --sport
> 1194 --dport 32768:65535 -m conntrack --ctstate ESTABLISHED -j ACCEPT
> -A OUTPUT -o eth0 -p udp -m udp -s 192.168.1.0/24 -d 189.174.135.110 --dport
> 1194 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
>
>
>
>
>
>

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Trying to make extremely secure firewall linux_forum1 <linux_forum1@protonmail.com> - 2021-12-26 00:20 +0100
  Re: Trying to make extremely secure firewall Robert Ricardo Ikaka <ikaka.robert.online@gmail.com> - 2022-01-15 04:30 +0100

csiph-web