🚀 go-pugleaf

Peter McDermott <peter@petermc.demon.co.uk> wrote:
> > /sbin/ipchains -D input -j REJECT -p udp -d gammon domain
> > /sbin/ipchains -I input -j REJECT -p udp -d gammon domain
> 
> You put this in ip-up and then remove it in ip-down? Or
> does it stay in place the whole time?

The first one goes in ip-up (to delete the rule) and the second goes
in ip-down reinstate the rule.


> Does anyone have an example of a full firewall
> set-up for a home network connected to Demon that
> I could take a look at?

Might have.

Paul

==========================================================================
#!/bin/sh

# Masquerading rules - internal networks are 192.168.x.x
/sbin/ipchains -P forward DENY
/sbin/ipchains -F forward
/sbin/ipchains -A forward -j MASQ -s 192.168.0.0/16 -d ! 192.168.0.0/16
/sbin/ipchains -P forward ACCEPT

# Input rules
/sbin/ipchains -P input DENY
/sbin/ipchains -F input
/sbin/ipchains -I input -j REJECT -p udp -d gammon domain

# Accept "local" traffic
/sbin/ipchains -A input -j ACCEPT -i eth0
/sbin/ipchains -A input -j ACCEPT -i plip0
/sbin/ipchains -A input -j ACCEPT -i lo

# Deny anything then pretending to be "local" traffic
/sbin/ipchains -A input -j DENY -s localhost          -l
/sbin/ipchains -A input -j DENY -s darwin.demon.co.uk -l

# Prevent X access
/sbin/ipchains -A input -j DENY -d /0 6000 -p tcp     -l

# Allow the punts to connect
/sbin/ipchains -A input -j ACCEPT -s 194.217.242.0/24 -d darwin.demon.co.uk smtp -p tcp

# And FTP data connections
/sbin/ipchains -A input -j ACCEPT -s /0 ftp-data -d /0 1024:65535 -p tcp

# Need DNS
/sbin/ipchains -A input -j ACCEPT -d /0 domain -p udp
/sbin/ipchains -A input -j ACCEPT -d /0 domain -p tcp

# Reject auth connections - don't want them knowing who I am!
/sbin/ipchains -A input -j REJECT -d /0 auth -p tcp

# Allow nslookup to work for remote servers
/sbin/ipchains -A input -j ACCEPT -d /0 1024:65535 -s /0 domain -p udp

# We want to know the time
/sbin/ipchains -A input -j ACCEPT -d /0 1024:65535 -s /0 time -p udp

# Accept masqueraded UDP (Real Audio)
/sbin/ipchains -A input -j ACCEPT -d /0 61000:65096 -p udp

# Don't admit to incoming TCP connection requets or UDP
/sbin/ipchains -A input -j DENY -p tcp -y -l
/sbin/ipchains -A input -j DENY -p udp -l
/sbin/ipchains -P input ACCEPT

# Output rules
/sbin/ipchains -P output DENY
/sbin/ipchains -F output

# Local stuff is good
/sbin/ipchains -A output -j ACCEPT -i eth0
/sbin/ipchains -A output -j ACCEPT -i plip0
/sbin/ipchains -A output -j ACCEPT -i lo

# If someone pings, pretend not to hear
/sbin/ipchains -A output -j DENY -p icmp -s /0 echo-reply
/sbin/ipchains -P output ACCEPT

# So we don't print out when booting up
if [ ! "$1" = "noprint" ]; then
    /sbin/ipchains -L
fi