Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #167047

Re: Firewall - basic config?

Show all headers | View raw

On Sun, 24 Apr 2016 00:17:51 -0500
Michael Milliman <michael.e.milliman@gmail.com> wrote:
> >>   Any suggestions/comments would be much appreciated. Thanks
> >> very much.
> > Assuming you'd want to keep ufw, you'd need to worry about:
> >
> >> Chain ufw-after-input (1 references)
> >> target     prot opt source               destination
> >> ufw-skip-to-policy-input  udp  --  anywhere anywhere             udp
> >> dpt:netbios-ns
> >> ufw-skip-to-policy-input  udp  --  anywhere anywhere             udp
> >> dpt:netbios-dgm
> >> ufw-skip-to-policy-input  tcp  --  anywhere anywhere             tcp
> >> dpt:netbios-ssn
> >> ufw-skip-to-policy-input  tcp  --  anywhere anywhere             tcp
> >> dpt:microsoft-ds
> > There's no reason to accept these unless you're using Samba (either
> > the server or client).
> However, if you look at the ufw-skip-to-policy-input chain, it simply 
> DROPs everything, so there is no hole here, as far as I can tell.  
> Indeed, this chain specifies all protocols, from anywhere to anywhere, 
> target DROP. So, in the end, all packets to these destination ports 
> (dpt) are DROPed.

Good catch. I agree here. Although it would help to see if these rules
apply to a certain network interface (see below).


> >> ACCEPT     udp  --  anywhere             anywhere             udp
> >> spt:bootps dpt:bootpc
> > So, first they compose a perfectly good rule for DHCP client
> > (ufw-before-input chain), but then they allow udp:68 unconditionally in
> > ufw-after-input chain. I'll assume that something very clever is going
> > on here.
> Correct me if I'm wrong, however, the ufw-before-input chain concerns me 
> greatly.  The first rule here ACCEPTs all packets of all protocols 
> coming from anywhere and going to anywhere.  This appears to be an 
> incredibly big hole.  The above rule Reco mentions, will never be seen 
> as it is quite a bit further down the chain, after everything has 
> already been ACCEPTed.  Surely, I'm reading something wrong?:-\

I believe this to be an artifact of 'iptables -L', and the actual rule
refers to lo interface only. For example, on my system this scary rule:

# iptables -nL INPUT | head -3
...
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0 

Actually means this:

# iptables -nvL INPUT | head -3
...
ACCEPT     all  --  lo     * 0.0.0.0/0            0.0.0.0/0  

Reco

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Firewall - basic config? Harris Paltrowitz <harrisupstate@yahoo.com> - 2016-04-23 19:10 +0200
  Re: Firewall - basic config? Reco <recoverym4n@gmail.com> - 2016-04-23 20:10 +0200
    Re: Firewall - basic config? Michael Milliman <michael.e.milliman@gmail.com> - 2016-04-24 07:20 +0200
      Re: Firewall - basic config? Reco <recoverym4n@gmail.com> - 2016-04-24 11:00 +0200
        Re: Firewall - basic config? Michael Milliman <michael.e.milliman@gmail.com> - 2016-04-26 04:10 +0200
  Re: Firewall - basic config? Joe <joe@jretrading.com> - 2016-04-23 22:00 +0200
    Re: Firewall - basic config? shawn wilson <ag4ve.us@gmail.com> - 2016-04-25 15:50 +0200
  Re: Firewall - basic config? cbannister@slingshot.co.nz - 2016-04-27 10:40 +0200
  Re: Firewall - basic config? Jonathan Dowland <jmtd@debian.org> - 2016-04-27 11:30 +0200
    Re: Firewall - basic config? Harris Paltrowitz <harrisupstate@yahoo.com> - 2016-04-27 13:50 +0200

csiph-web