🚀 go-pugleaf

On Wednesday 27 June 2001 19:17 Benno wrote:

> Anyone out there have some handy scripts for putting together a decent
> packet filtering firewall (read : pretty secure) using ipchains?

I've heard seawall is pretty good, but I've never used it myself, so I 
can't comment on it really.

"Benno" <ben@pilbaratech.com.au> writes:

> Anyone out there have some handy scripts for putting together a
> decent packet filtering firewall (read : pretty secure) using
> ipchains?
> 
> Platform is redHat 6.2 (7.1 was a pain to setup!).
> 
> Config is PII233 256MB Ram 5.1 GB HDD (512 Swap, small /boot, 1024
> /, and the rest assigned to /user) Later I plan to put /var on a
> separate partition but or now, I just want to get my head around
> ipchains firewalling.

As a starting point you could use the ipchains ruleset from:
        <http://logi.cc/linux/athome-firewall.php3>

then test it using:
        <http://scan.sygatetech.com/>

Hope this helps
-- 
Manfred
----------------------------------------------------------------
NetfilterLogAnalyzer, NetCalc, whois at: <http://logi.cc/linux/>

Hey, nice links.. Thanks..

>As a starting point you could use the ipchains ruleset from:
>        <http://logi.cc/linux/athome-firewall.php3>
>
>then test it using:
>        <http://scan.sygatetech.com/>


Oh and by the way spammers.. check my website for spam policies and
penalties..
www.pilbaratech.com.au
Sending me spam indicates you agree to my conditions.

>then test it using:
>        <http://scan.sygatetech.com/>
This mentions stealth ports during tests and probes.
Anyone know if ipchains DENY rules will make this happen?

In article <3b3a793d@usenet.per.paradox.net.au>, Benno wrote:

>  Anyone out there have some handy scripts for putting together a decent
>  packet filtering firewall (read : pretty secure) using ipchains?
>  

I have used pmfirewall. It's a good starter kit
and gives you a framework that you can add to.

On Thursday 28 June 2001 07:21 Benno wrote:

> This mentions stealth ports during tests and probes.
> Anyone know if ipchains DENY rules will make this happen?

Yes.  REJECT will treat the packet just as if the port was closed, and 
send back the appropriate ICMP packet.  DENY will simply drop the packet 
and ignore it and the sender.

On Thursday 28 June 2001 18:04 Manfred Bartz wrote:

> Kaden <sfam@mailandnews.com> writes:
> 
>> Yes.  REJECT will treat the packet just as if the port was closed,
>> and send back the appropriate ICMP packet.
> 
> Except that an ICMP response is correct for a closed UDP port but
> not for a closed TCP port.

It seems to me I heard this somewhere before.  I had forgotten about it 
when I replied, though.  Thanks for the reminder.  However, it looks as 
if you need to update your site to show exactly what you just said.  It 
doesn't make a distinction between TCP or UDP ports.  It just says 
exactly what I said in my original reply.  The difference is implied at 
the end under "Revealing the existance of a firewall" but if it were me, 
I'd put that information right up top under the "reject" heading.  Just 
my opinion.

> To produce a genuine TCP reset response for selected ports, the best
> method is to pick a port that is guaranteed to not have a server
> listening on it (f.e. 65534), leave it open and redirect other ports
> to it.
 
This I hadn't heard of before.  I'd heard of redirecting to a port that 
was listening, but had fake services, or syslog set to listen to it or 
something like that, but not to an unopen port in the attempt to 
simulate closed TCP ports.

Funny how the simple things such as this tend to escape you as 
posibilites, isn't it?

Kaden <sfam@mailandnews.com> writes:

> Yes.  REJECT will treat the packet just as if the port was closed,
> and send back the appropriate ICMP packet.

Except that an ICMP response is correct for a closed UDP port but 
not for a closed TCP port.

    <http://logi.cc/linux/reject_or_deny.php3>

To produce a genuine TCP reset response for selected ports, the best
method is to pick a port that is guaranteed to not have a server
listening on it (f.e. 65534), leave it open and redirect other ports
to it.

This method works for ipchains as well as netfilter.
I need to update my webpage for that.

> DENY will simply drop the packet and ignore it and the sender.

Yes.  DENY (DROP for netfilter) is probably best for most systems.

-- 
Manfred
----------------------------------------------------------------
NetfilterLogAnalyzer, NetCalc, whois at: <http://logi.cc/linux/>