Being the control freak I am, I wanted to have absolute control over the firewall settings on my Ubuntu box. There are many tools out there such as fwbuilder and firestarter, but I wanted to get a solid understanding of what it would take to reconfigure my Ubuntu settings manually.
The easy answer is to build a script which is launched as part of the boot sequence, which rebuilds your rules from scratch. This way, if you wish to control what computers can connect to your computer and how they connect, you can.
Here is the basic script I put together:
#!/bin/sh
#
# Variables
LAN_IP="192.168.1.111"
LAN_IP_RANGE="192.168.1.0/24"
LAN_IFACE="eth0"
LO_IFACE="lo"
LO_IP="127.0.0.1"
IPTABLES="/sbin/iptables"
$IPTABLES -F
$IPTABLES -X
# Policies
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
# Rules
$IPTABLES -A INPUT -p tcp --tcp-flags ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "FIREWALL: Invalid SYN:"
$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $LAN_IFACE --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $LAN_IFACE --dport 177 -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport 53 -j ACCEPT
$IPTABLES -A INPUT -p ICMP -i $LAN_IFACE --icmp-type 8 -j ACCEPT
$IPTABLES -A INPUT -p ICMP -i $LAN_IFACE --icmp-type 11 -j ACCEPT
# Log weird packets that don't match the above.
$IPTABLES -A INPUT -m limit --limit 10/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "FIREWALL: Abnormal INPUT packet "
$IPTABLES -A OUTPUT -p tcp -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
# Log weird packets that don't match the above.
$IPTABLES -A OUTPUT -m limit --limit 10/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "FIREWALL: Abnormal OUTPUT packet "
You may need to change some of the variables at the start of the script as well as some of the ports you want to have open. Port 22 is used for SSH and 177 for XDMCP (X11).
I then saved this in the /etc/init.d folder. Change the execution bit by typing:
sudo chmod +x
Using the filename you saved this file as. Now, using the update-rc.d command make this launch at boot time.
sudo ln -s /etc/init.d/firewall.iptables /etc/rc2.d/S13firewall
Then…
sudo update-rc.d /etc/init.d/firewall.iptables defaults 13
I suggest reading up on the iptables command to get a better feeling for the power you have over your firewall.
-Zog
