Path: csiph.com!newsfeed.xs4all.nl!newsfeed7.news.xs4all.nl!bofh.it!news.nic.it!robomod From: Robert Ricardo Ikaka Newsgroups: linux.debian.security Subject: Re: Trying to make extremely secure firewall Date: Sat, 15 Jan 2022 04:30:02 +0100 Message-ID: References: X-Original-To: linux_forum1 X-Mailbox-Line: From debian-security-request@lists.debian.org Sat Jan 15 03:20:46 2022 Old-Return-Path: X-Amavis-Spam-Status: No, score=-1.557 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FOURLA=0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=2, LDO_WHITELIST=-5, NORMAL_HTTP_TO_IP=2.3, NUMERIC_HTTP_ADDR=1.242, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no autolearn_force=no X-Policyd-Weight: using cached result; rate: -5.5 X-Gm-Message-State: AOAM533isbMVAwsfGTP3oZttXgwddPLJrcoGSqZf4oWajRUDMXoZRB3Y H4JMILf7U2rQ/PlPJVijKv/jaFrzGTT/4lG2YSY= X-Google-SMTP-Source: ABdhPJyQPqLil2W+NU7e1WcfCxBytpBnOONczBIwiMxVZLhfL9nSsyWBKKEHmhvmX6uzjkam7LrMQhvWGVL0O/EklsU= X-Received: by 2002:a63:ab01:: with SMTP id p1mr10197867pgf.437.1642216825046; Fri, 14 Jan 2022 19:20:25 -0800 (PST) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="000000000000804c4005d5966665" X-Mailing-List: archive/latest/29139 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/CAPg0vjqCwiUrd3EtD5uM_P+wr-G3ZkGH+jVU7vMhR5EnPzoB3g@mail.gmail.com Approved: robomod@news.nic.it Lines: 136 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: debian-security@lists.debian.org X-Original-Date: Sat, 15 Jan 2022 06:20:13 +0300 X-Original-Message-ID: X-Original-References: Xref: csiph.com linux.debian.security:5995 --000000000000804c4005d5966665 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable https://chng.it/jJvMChbdsJ =D0=B2=D1=81, 26 =D0=B4=D0=B5=D0=BA. 2021 =D0=B3., 02:13 linux_forum1 : > Hello, I'm trying to make the most specific, secure and restrictive > iptables possible for a simple VPN connection on Debian. Could you have a > quick look if those are OK? Thanks so much! > > VPN Server Port:1194 > > VPN Server IP: 189.174.135.110 > > -P INPUT DROP > -P FORWARD DROP > -P OUTPUT DROP > > #no fragmented packets > -A INPUT -f -j DROP > #localhost > -A INPUT -s 127.0.0.0/8 ! -i lo -j DROP > -A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT > -A OUTPUT -o lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT > # first packet has to be TCP syn > -A INPUT -p tcp ! --syn -m state --state NEW -j DROP > #drop sop icmp > -A INPUT -p icmp --icmp-type address-mask-request -j DROP > -A INPUT -p icmp --icmp-type timestamp-request -j DROP > #Ping from inside to outside > -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT > -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT > #drop broadcast, multicast anycast > -A INPUT -m addrtype --dst-type BROADCAST -j DROP > -A INPUT -m addrtype --dst-type MULTICAST -j DROP > -A INPUT -m addrtype --dst-type ANYCAST -j DROP > -A INPUT -d 224.0.0.0/4 -j DROP > #drop invalid > -A INPUT -m state --state INVALID -j DROP > #drop spoofed packets > -A INPUT -s 0.0.0.0/8 -j DROP > -A INPUT -d 0.0.0.0/8 -j DROP > -A INPUT -d 239.255.255.0/24 -j DROP > -A INPUT -d 255.255.255.255 -j DROP > # DROP RFC1918 PACKETS > -A INPUT -s 10.0.0.0/8 -j DROP > -A INPUT -s 172.16.0.0/12 -j DROP > -A INPUT -s 192.168.0.0/16 -j DROP > #Allow VPN > > - A INPUT -i eth0 -p udp -m udp -s 189.174.135.110 -d 192.168.1.0/24 --sp= ort > 1194 --dport 32768:65535 -m conntrack --ctstate ESTABLISHED -j ACCEPT > -A OUTPUT -o eth0 -p udp -m udp -s 192.168.1.0/24 -d 189.174.135.110 --dp= ort > 1194 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT > > > > > > --000000000000804c4005d5966665 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
=D0=B2=D1=81, 26 =D0=B4=D0=B5=D0=BA. 2021 =D0=B3., 02:13 linux_= forum1 <linux_forum1@prot= onmail.com>:
Hello, I&#= 39;m trying to make the most specific, secure and restrictive iptables poss= ible for a simple VPN connection on Debian. Could you have a quick look if = those are OK? Thanks so much!

VPN Server Port:= 1194

VPN Server IP: 189.174.135.110


=
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DR= OP

#no fragmented packets
-A INP= UT -f -j DROP
#localhost
-A INPUT -s 127.0.0.0/8 != -i lo -j DROP
-A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j AC= CEPT
-A OUTPUT -o lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
<= /div>
# first packet has to be TCP syn
-A INPUT -p tcp ! = --syn -m state --state NEW -j DROP
#drop sop icmp
-A INPUT -p icmp --icmp-type address-mask-request -j DROP
= -A INPUT -p icmp --icmp-type timestamp-request -j DROP
#Ping = from inside to outside
=C2=A0-A OUTPUT -p icmp --icmp-type ec= ho-request -j ACCEPT
=C2=A0-A INPUT -p icmp --icmp-type echo-= reply -j ACCEPT
#drop broadcast, multicast anycast
<= div>-A INPUT -m addrtype --dst-type BROADCAST -j DROP
-A INPU= T -m addrtype --dst-type MULTICAST -j DROP
-A INPUT -m addrty= pe --dst-type ANYCAST -j DROP
-A INPUT -d 224.0.0.0/4 -j DROP
#drop invalid
-A INPUT -m state --state INVALID -= j DROP
#drop spoofed packets
-A INPUT -s 0.0.0.0/8 -= j DROP
-A INPUT -d 0.0.0.0/8 -j DROP
-A INPUT -d 239.2= 55.255.0/24 -j DROP
-A INPUT -d 255.255.255.255 -j DROP
# DROP RFC1918 PACKETS
-A INPUT -s 10.0.0.0/8 -j DRO= P
-A INPUT -s 172.16.0.0/12 -j DROP
-A INPUT -s = 192.= 168.0.0/16 -j DROP
#Allow VPN

- A= INPUT -i eth0 -p udp -m udp -s=C2=A0189.174.135.110= =C2=A0-d=C2=A0192.168.1.0/24=C2=A0--sport 1194 --dport= 32768:65535 -m conntrack --ctstate=C2=A0ESTABLISHED -j ACCEPT=C2=A0

-A OUTPUT -o eth0 -p udp -m udp -s=C2=A0192.168.1.0/24=C2=A0-d=C2=A0189.174.135.110=C2= =A0--dport 1194 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT=C2=A0=C2= =A0





--000000000000804c4005d5966665--