IPTABLES doesn't work

[smoothmilk]

Why doesn't redhat-config-securitylevel's iptables rules work?

If I turn off EVERYTHING (www, ftp, ssh, etc) and save, and even
manually restart iptables (# /sbin/service iptables restart) other
computers on my network can access www (even on weird, non-standard
ports with http servers on them) ftp, ssh, etc. 

So whats the point of even including that tool if it doesn't do
anything? I dont understand how it just flat out doesn't work. I have no
idea how iptables works, and because there's no documentation out there
for beginners who just want a script that's for eth0 with a simple www,
ssh and ftp server(s), Im stuck using rh's tools, which don't do
anything. there's no security here. 

Can anyone help?

[VJ]

Instead of writing what you are feeling about your lack of initiative to
get the help by just typing 'man iptables' you could have provided a
list of requirements and your present setup. May be I would have helped
you in writing a small script to implement security.

You ask 'So what's the point of even including a tool if it doesn't do
anything?' ? If YOU could not get it working does not mean it does not
work at all.

And above all, there is google.

VJ

On Thu, 2004-01-29 at 21:34, smoothmilk wrote:
>  Why doesn't redhat-config-securitylevel's iptables rules
> work?
>  
>  If I turn off EVERYTHING (www, ftp, ssh, etc) and save, and even
>  manually restart iptables (# /sbin/service iptables restart) other
>  computers on my network can access www (even on weird, non-standard
>  ports with http servers on them) ftp, ssh, etc. 
>  
>  So whats the point of even including that tool if it doesn't do
>  anything? I dont understand how it just flat out doesn't work. I have no
>  idea how iptables works, and because there's no documentation out there
>  for beginners who just want a script that's for eth0 with a simple www,
>  ssh and ftp server(s), Im stuck using rh's tools, which don't do
>  anything. there's no security here. 
>  
>  Can anyone help?
>

[Andy Green]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thursday 29 January 2004 21:34, smoothmilk wrote:

>  Why doesn't redhat-config-securitylevel's iptables rules
> work? 
Works here.  Why don't you try (as root)

iptables -L

and copy the result here.  This lists the active rules.

- -Andy
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.3 (GNU/Linux)
>
> iD8DBQFAGX/5jKeDCxMJCTIRAgXEAJ9m1KugkZnD0QixWergNwgDLWPYVgCfScyV
> 3Bz07P6Vl+TbnAopl1UYDko=
> =1PzY
> -----END PGP SIGNATURE-----

[Guy Fraser]

1) Read the FAQ, and learn how to ask a question.
2) Don't spoof your email address.
3) If your a troll, go bother someone else.

Have a nice day.

[Bevan C. Bennett]

smoothmilk wrote:
>  Why doesn't redhat-config-securitylevel's iptables rules
> work? 
I don't know. I've never used the GUI.

>  If I turn off EVERYTHING (www, ftp, ssh, etc) and save, and even
>  manually restart iptables (# /sbin/service iptables restart) other
>  computers on my network can access www (even on weird, non-standard
>  ports with http servers on them) ftp, ssh, etc.  
What are the contents of /etc/sysconfig/iptables?

>  So whats the point of even including that tool if it doesn't do
>  anything? I dont understand how it just flat out doesn't work. I have no
>  idea how iptables works, and because there's no documentation out there
>  for beginners who just want a script that's for eth0 with a simple www,
>  ssh and ftp server(s), Im stuck using rh's tools, which don't do
>  anything. there's no security here.  
For www and ssh, the standard starting config looks like:

# Firewall configuration written by redhat-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

ftp can be a little trickier, due to the control and data split, but
-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT
should be sufficient if the RELATED filter is working properly. (place 
this rule above the one for ssh (port 22).

[Luciano Miguel Ferreira Rocha]

On Thu, Jan 29, 2004 at 01:34:34PM -0800, smoothmilk wrote:
>  anything? I dont understand how it just flat out doesn't work. I
> have no
>  idea how iptables works, and because there's no documentation out there
>  for beginners who just want a script that's for eth0 with a simple www,
>  ssh and ftp server(s), Im stuck using rh's tools, which don't do
>  anything. there's no security here.  
Shameless plug: http://strange.nsk.pt/mine/ipconf

Or a simple script:

#! /bin/sh
/sbin/modprobe ip_conntrack_ftp &> /dev/null
/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -P FORWARD DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -A INPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -p IMCP -j ACCEPT
/sbin/iptables -A INPUT -p TCP --syn --dport http -j ACCEPT
/sbin/iptables -A INPUT -p TCP --syn --dport ssh -j ACCEPT
/sbin/iptables -A INPUT -p TCP --syn --dport ftp -j ACCEPT
/sbin/iptables -A INPUT -p TCP --syn --dport ftp-data -j ACCEPT

Regards,
Luciano Rocha

[Alexander Dalloz]

Am Do, den 29.01.2004 schrieb Luciano Miguel Ferreira Rocha um 22:58:
>  On Thu, Jan 29, 2004 at 01:34:34PM -0800, smoothmilk wrote:
>  > anything? I dont understand how it just flat out doesn't work. I have no
>  > idea how iptables works, and because there's no documentation out there
>  > for beginners who just want a script that's for eth0 with a simple www,
>  > ssh and ftp server(s), Im stuck using rh's tools, which don't do
>  > anything. there's no security here. 
>  
>  Shameless plug: http://strange.nsk.pt/mine/ipconf
>  
>  Or a simple script: 
short annotations

>  #! /bin/sh
>  /sbin/modprobe ip_conntrack_ftp &> /dev/null 
modprobe has the parameter "-q" to be quiet.

>  /sbin/iptables -F
>  /sbin/iptables -X
>  /sbin/iptables -P FORWARD DROP
>  /sbin/iptables -P INPUT DROP 
To set policies to DROP and have no final REJECT rule is bad. DROP is no
good general rule.

>  /sbin/iptables -P OUTPUT ACCEPT
>  /sbin/iptables -A INPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT
>  /sbin/iptables -A INPUT -p IMCP -j ACCEPT
>  /sbin/iptables -A INPUT -p TCP --syn --dport http -j ACCEPT
>  /sbin/iptables -A INPUT -p TCP --syn --dport ssh -j ACCEPT
>  /sbin/iptables -A INPUT -p TCP --syn --dport ftp -j ACCEPT
>  /sbin/iptables -A INPUT -p TCP --syn --dport ftp-data -j ACCEPT
>  
>  Regards,
>  Luciano Rocha 
Alexander


-- 
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 1 (Yarrow) on Athlon CPU kernel 2.4.22-1.2149.nptl
Sirendipity 12:10:34 up 20:58, 7 users, 0.68, 0.28, 0.15 
                   [ Γνωθι σ'αυτον - gnothi seauton ]

[Luciano Miguel Ferreira Rocha]

On Fri, Jan 30, 2004 at 12:13:18PM +0100, Alexander Dalloz wrote:
>  > /sbin/modprobe ip_conntrack_ftp &> /dev/null
>  
>  modprobe has the parameter "-q" to be quiet. 
Thanks, I didn't know.

>  > /sbin/iptables -F
>  > /sbin/iptables -X
>  > /sbin/iptables -P FORWARD DROP
>  > /sbin/iptables -P INPUT DROP
>  
>  To set policies to DROP and have no final REJECT rule is bad. DROP is no
>  good general rule. 
That's a matter of opinion, but for completion I do use rejects, but I tried
to simplify the script:

/sbin/iptables -A INPUT -p TCP -m limit --limit 20/minute -j REJECT --reject-with
tcp-reset
/sbin/iptables -A INPUT -p UDP -m limit --limit 20/minute -j REJECT --reject-with
icmp-port-unreachable

(I don't like the default reject method.)

Regards,
Luciano Rocha

[Alexander Dalloz]

Am Sa, den 31.01.2004 schrieb Luciano Miguel Ferreira Rocha um 17:58:
>  On Fri, Jan 30, 2004 at 12:13:18PM +0100, Alexander Dalloz wrote:
>  > > /sbin/modprobe ip_conntrack_ftp &> /dev/null
>  > 
>  > modprobe has the parameter "-q" to be quiet.
>  
>  Thanks, I didn't know.
>  
>  > > /sbin/iptables -F
>  > > /sbin/iptables -X
>  > > /sbin/iptables -P FORWARD DROP
>  > > /sbin/iptables -P INPUT DROP
>  > 
>  > To set policies to DROP and have no final REJECT rule is bad. DROP is no
>  > good general rule.
>  
>  That's a matter of opinion, but for completion I do use rejects, but I tried
>  to simplify the script:
>  
>  /sbin/iptables -A INPUT -p TCP -m limit --limit 20/minute -j REJECT --reject-with
> tcp-reset
>  /sbin/iptables -A INPUT -p UDP -m limit --limit 20/minute -j REJECT --reject-with
> icmp-port-unreachable
>  
>  (I don't like the default reject method.)
>  
>  Regards,
>  Luciano Rocha 
I know that many folks thinks that a DROP rule improves security and is
better than a REJECT. But that is at least just "security by obscurity"
and would take my attention as a cracker as it seems that someone tries
to hide something interesting or even critical. In addition DROP is
unsocial as it leads to time lag because connection trials have to wait
for timeouts and not just getting a "no, you can't connect".

The topic about DROP versus REJECT is often and long discussed and I
know of not any argument for DROPping. ;)

Regards

Alexander


-- 
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 1 (Yarrow) on Athlon CPU kernel 2.4.22-1.2149.nptl
Sirendipity 00:36:38 up 1 day, 23:36, load average: 0.33, 0.23, 0.19 
                   [ Γνωθι σ'αυτον - gnothi seauton ]

[Marian POPESCU]

Hi,
Try out Guarddog at http://www.simonzone.com/software/guarddog/
Is pretty straightforward ...

HTH
Marian

[jdow]

From: "smoothmilk" <smthmlk(a)fuckmicrosoft.com&gt;

>  Why doesn't redhat-config-securitylevel's iptables rules
> work?
>  
>  If I turn off EVERYTHING (www, ftp, ssh, etc) and save, and even
>  manually restart iptables (# /sbin/service iptables restart) other
>  computers on my network can access www (even on weird, non-standard
>  ports with http servers on them) ftp, ssh, etc. 
>  
>  So whats the point of even including that tool if it doesn't do
>  anything? I dont understand how it just flat out doesn't work. I have no
>  idea how iptables works, and because there's no documentation out there
>  for beginners who just want a script that's for eth0 with a simple www,
>  ssh and ftp server(s), Im stuck using rh's tools, which don't do
>  anything. there's no security here. 
>  
>  Can anyone help? 
http://www.netfilter.org/

And read, a LOT. Then check out the examples and analyze each line to
figure out what it is doing. That will put you on the first step or two
down the road towards understanding netfilters aka IPTables.

{^_^}   Be pickledif I know why I answered an email with gratuitous
        profanity as an email address. Ah well, must be I am trying
        to shirk off some tough work for a little while longer.

[Michael Kearey]

smoothmilk wrote:
>  Why doesn't redhat-config-securitylevel's iptables rules
> work?
>  
>  If I turn off EVERYTHING (www, ftp, ssh, etc) and save, and even
>  manually restart iptables (# /sbin/service iptables restart) other
>  computers on my network can access www (even on weird, non-standard
>  ports with http servers on them) ftp, ssh, etc.  
This is where it gets a little odd for me. 'Other computers on my 
network can access www' What are these other computers? Unless they 
gain access to Internet *through* your Fedora machine, the Fedora 
machines firewall has NOTHING to do with those machines.

The current redhat-config-securitylevel tool works on rules that 
control access to services running on the Fedora box, and cannot 
influence any other machine attached to the same network accessing 
other machines on that network.

>  
>  So whats the point of even including that tool if it doesn't do
>  anything? I dont understand how it just flat out doesn't work. I have no
>  idea how iptables works, and because there's no documentation out there
>  for beginners who just want a script that's for eth0 with a simple www,
>  ssh and ftp server(s), Im stuck using rh's tools, which don't do
>  anything. there's no security here.  
I can help. I suggest you go and seek the most basic understanding of 
the nature of tcp/ip and ethernet networks, and have a good think 
about it..

The redhat-config-securitylevel tool does pretty much exactly what it 
is designed to do - Set up iptables rules to assist in controlling 
access to services running on the host machine.

Cheers,
Michael