Diese Seite (Version-45) wurde zuletzt am 29-Dez.-2024 12:08 von Administrator geändert.

Diese Seite wurde am 23-Dez.-2024 12:59 von Administrator erstellt.

Du bist nicht autorisiert, diese Seite umzubenennen.

Du bist nicht autorisiert, diese Seite zu löschen.

Versionsgeschichte der Seite

Version Zuletzt geändert Größe Autor Änderungen Kommentar
45 29-Dez.-2024 12:08 10 KB Administrator zur vorherigen
44 29-Dez.-2024 12:06 10 KB Administrator zur vorherigen | zur neuesten
43 29-Dez.-2024 12:05 10 KB Administrator zur vorherigen | zur neuesten
42 29-Dez.-2024 12:02 9 KB Administrator zur vorherigen | zur neuesten
41 29-Dez.-2024 12:01 9 KB Administrator zur vorherigen | zur neuesten

Links

Eingehende Links Ausgehende Links
Firewall with iptables
Firewall with iptables

Versionsunterschiede

Unterschiede zwischen Version und .

Zeile 4: 50 Zeilen gelöscht.
[{TableOfContents }]
!! Scope
Raspberry is exposed to the internet for my backup solution. I want to enable ipv6 access only and enable access only from my home computer. \\
Steps:
# register your home computer (Windows) at a dyndns service to provide the current ipv6, see [dynv6.com|https://dynv6.com]
# Windows: create windows batch script to update dynv6
# Windows schedule script to run each time the PC is booted, see "Aufgabenplanung" (task scheduler)
# Raspberry: create and set iptables ruleset
# Raspberry: use python script to query the current ipv6 from dynv6 (Windows) and replace in iptables ruleset
# Raspberry: schedule the ipv6 update in firewall (ip6tables)
!2. Windows batch script to update dynv6 service
{{{
REM update_dynv6.bat
REM set utf-8
chcp 65001
echo off
set domain=<your.domain.here>
set token=<youtTokenHere>
echo ---- check and update local ipv6 address at dynv6.com for %domain% ----
rem ping -n 1 -6 %domain%
for /F "tokens=3" %%i in ('"ping -n 1 -6 %domain% | findstr Antwort"') do set dynv6_ipv6=%%i
rem cut last colon, example 2a02:5a0:4110:f590:29f6:40ba:51b4:b4da:
set dynv6_ipv6=%dynv6_ipv6:~0,-1%
echo dynv6 ipv6= %dynv6_ipv6%
rem ipconfig
rem echo ---------- extracting Temporäre IPv6-Adresse ----------
for /F "tokens=9" %%i in ('"ipconfig | findstr Temp | findstr 2a02"') do set local_ipv6=%%i
echo local ipv6= %local_ipv6%
if %local_ipv6% == %dynv6_ipv6% (
echo ipv6 at dynv6 is up to date, update skipped
) else (
set url="https://dynv6.com/api/update?hostname=%domain%^&token=%token%&ipv6=%ipv6%"
ECHO updating IPv6
curl "%url%"
)
echo:
echo done
pause
}}}
!! iptables
Zeile 63: Eine Zeile geändert.
* all iptables commands (for ipv4) have an ip__6__tabbles* equivalent (for ipv6)
* all iptables commands (for ipv4 only) have an ip__6__tables* equivalent for ipv6
Zeile 69: 2 Zeilen gelöscht.
> sudo ip6tables -L -v # list all ipv6 rules
> sudo ip6tables -n -v --line-numbers -L # list all ipv6 rules with numeric IPs and rule number
Zeile 21: 12 Zeilen hinzugefügt.
! Logging
{{{
> iptables -A INPUT -j LOG --log-level 4 --log-prefix 'IP INPUT '
}}}
! Load rules after reboot
{{{
> sudo apt-get install iptables-persistent
}}}
* Current iptables rules can be saved to the configuration file /etc/iptables/rules.v4. These rules will then be loaded automatically during system startup.
* Rules are only saved automatically during package installation. See the manual page of iptables-save(8) for instructions on keeping the rules file up-to-date.
Zeile 76: 6 Zeilen geändert.
> sudo iptables -L -v
> sudo iptables -n -v --line-numbers -L
> sudo service iptables start # activate firewalling
> sudo service ip6tables start
> sudo chkconfig iptables on # enable after reboot
> sudo chkconfig ip6tables on
> sudo ip6tables -L -v
> sudo ip6tables -nvL # thjis is most compact
> sudo ip6tables -n -v --line-numbers -L # list all ipv6 rules with numeric IPs and rule number
> sudo service ip6tables start # activate firewalling
> sudo chkconfig ip6tables on # enable after reboot
Zeile 85: Eine Zeile geändert.
iptables [-t <table-name>] <command> <chain-name> <parameter-1> <option-1> <parameter-n> <option-n>
ip6tables [-t <table-name>] <command> <chain-name> <parameter-1> <option-1> <parameter-n> <option-n>
Zeile 109: Eine Zeile geändert.
** -j : jump to ~[ACCEPT, DROP, QUEUE, RETURN~] (or others added with modules)
** -j : jump to ~[ACCEPT, DROP, QUEUE, RETURN~] (or others added with modules), REJECT= notify other end, DROP= silently ignore
Zeile 78: 10 Zeilen hinzugefügt.
! [Examples|https://www.iitk.ac.in/LDP/HOWTO/Linux+IPv6-HOWTO/ch18s03.html]
{{{
ip6tables -A INPUT -i eth0 -p tcp -s 2001:0db8:100::1/128 --sport 512:65535 --dport 22 -j ACCEPT #Allow incoming SSH from 2001:0db8:100::1/128
ip6tables -A OUTPUT -o eth0 -p tcp -d 2001:0db8:100::1/128 --dport 512:65535 --sport 22 ! --syn -j ACCEPT #Allow response packets (no longer needed if connection tracking is used!)
ip6tables -I INPUT -i eth0 -p tcp --syn -j DROP #Block incoming TCP connection requests to this host
ip6tables -I FORWARD -i eth0 -p tcp --syn -j DROP #Block incoming TCP connection requests to hosts behind this router
ip6tables -I INPUT -i eth0 -p udp ! --dport 32768:60999 -j DROP #Block incoming UDP packets which cannot be responses of outgoing requests of this host
ip6tables -I FORWARD -i eth0 -p udp ! --dport 32768:60999 -j DROP #Block incoming UDP packets which cannot be responses of forwarded requests of hosts behind this router
ip6tables -A INPUT --protocol icmpv6 --icmpv6-type echo-request -j ACCEPT --match limit --limit 30/minute #Rate-limiting
}}}
Zeile 120: 4 Zeilen gelöscht.
! 4. my general ruleset
We also need to enable the local interface and the DNS nameservers.\\
I use a custom DNS server setting, because the fritzbox does not resolve my dynv6 domains (?).
Zeile 125: 2 Zeilen geändert.
> sudo nmcli -o device show # show interfaces settings
> sudo nmcli -p connection show # show interface status
-A RH-Firewall-1-INPUT -p icmpv6 -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited
}}}
Zeile 128: 6 Zeilen geändert.
#THIS IS NECESSARY
> sudo nmcli con mod "Wired connection 1" ipv4.dns "1.1.1.1,8.8.8.8" # add cloudflare and google dns
> sudo nmcli con mod "Wired connection 1" ipv4.ignore-auto-dns no # this adds "search fritz.box" to get ips at all from frit.box
> sudo nmcli con mod "Wired connection 1" ipv6.ignore-auto-dns yes # we skip ipv6 dns
> sudo nmcli c down "Wired connection 1" && sudo nmcli c up "Wired connection 1" # restart
> sudo vi /etc/resolv.conf # validate settings
more {examples|https://www.linux.com/topic/networking/iptables-rules-ipv6/]
{{{
ipt6="/sbin/ip6tables" # Define your command variables
$ipt6 -A INPUT -i lo -j ACCEPT # Must allow loopback interface
$ipt6 -A INPUT -p tcp --syn -j DROP # Reject connection attempts not initiated from the host
$ipt6 -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Allow return connections initiated from the host
$ipt6 -A INPUT -p icmpv6 -j ACCEPT # Accept all ICMP v6 packets
# to services. Delete $ipt6 -A INPUT -p tcp --syn -j DROP # Optional rules to allow other LAN hosts access
$ipt6 -A INPUT -m state --state NEW -m udp -p udp # Allow DHCPv6 from LAN only
-s fe80::/10 --dport 546 -j ACCEPT
$ipt6 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT # Allow connections from SSH clients
$ipt6 -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT # Allow HTTP and HTTPS traffic
$ipt6 -A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT # Allow HTTP and HTTPS traffic
Zeile 115: 7 Zeilen hinzugefügt.
! My RuleSet
This one is
* allowing dhcp, dns and router traffic
* not allowing ipv4
* allowing ipv6 for 3 distinct ipv6 addresses, these are the first three ipv6 rules, which we replace at [Exposing Raspberry to Internet]
Zeile 138: Eine Zeile geändert.
# MARKUS
Zeile 147: 2 Zeilen geändert.
# drop all ipv4 traffic, we want to use ipv6 only
iptables -A INPUT -s 1.1.1.1 -j ACCEPT
# enable dns nameserver
iptables -A INPUT -s 1.1.1.1 -j ACCEPT # cloudflare
Zeile 150: Eine Zeile geändert.
iptables -A INPUT -s 8.8.8.8 -j ACCEPT
iptables -A INPUT -s 8.8.8.8 -j ACCEPT # google
Zeile 139: 24 Zeilen hinzugefügt.
# connection
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
# enable router for dhcp
iptables -A INPUT -s 192.168.188.1/24 -j ACCEPT
iptables -A OUTPUT -d 192.168.188.1/24 -j ACCEPT
# enable dns
iptables -A INPUT -p udp -m multiport --sport 53,67,68,90,135,853,5353,8245 -j ACCEPT
iptables -A OUTPUT -p udp -m multiport --dport 53,67,68,90,135,853,5353,8245 -j ACCEPT
#iptables -A INPUT -i eth0 -p udp --dport 67:68 --sport 67:68 -j ACCEPT
#iptables -A INPUT -i eth0 -p udp -m udp -m multiport --dports 67:68 -j ACCEPT
#iptables -A OUTPUT -o eth0 -p udp -m udp -m multiport --dports 67:68 -j ACCEPT
# enable dhcp
iptables -A INPUT -i eth0 -p icmp -j ACCEPT
iptables -A OUTPUT -o eth0 -p icmp -j ACCEPT
iptables -A INPUT -i eth0 -p icmp -m icmp --icmp-type 134 -m comment --comment router-advertisement -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type 135 -m comment --comment neighbor-solicitation -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type 136 -m comment --comment neighbor-advertisement -j ACCEPT
# allow local loopback
Zeile 155: 3 Zeilen gelöscht.
iptables -A INPUT -j DROP
iptables -A FORWARD -j DROP
iptables -A OUTPUT -j DROP
Zeile 166: 5 Zeilen hinzugefügt.
# drop everything else
iptables -A INPUT DROP
iptables -P FORWARD -j DROP
iptables -A OUTPUT -j DROP
Zeile 165: Eine Zeile geändert.
# drop all ipv6 traffic, except EbelStube
# drop all ipv6 traffic, except special ipv6, see below
Zeile 180: 2 Zeilen hinzugefügt.
# placeholder for first device
Zeile 171: 3 Zeilen geändert.
# allow ipv6 local loopback
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT
# placeholder for second device
ip6tables -A INPUT -s $SOURCE -j ACCEPT
ip6tables -A OUTPUT -d $SOURCE -j ACCEPT
Zeile 175: 4 Zeilen geändert.
# drop everthing else
ip6tables -P FORWARD DROP # as policy generally
ip6tables -A INPUT -j DROP
ip6tables -A OUTPUT -j DROP
# placeholder for third device
ip6tables -A INPUT -s $SOURCE -j ACCEPT
ip6tables -A OUTPUT -d $SOURCE -j ACCEPT
Zeile 180: 3 Zeilen gelöscht.
# update first ip6tables rules and enable my computer
python update_ip6tables.py
}}}
Zeile 184: 4 Zeilen geändert.
!! Python
* package "python3-iptables" manages legacy ones only, [docu1|https://python-iptables.readthedocs.io/en/latest/examples.html], [docu2|https://ldx.github.io/python-iptables/]
* package "python3-nftables" manages nft tables, [docu|https://ral-arturo.org/2020/11/22/python-nftables-tutorial.html]
* alternatively you can use subprocess.run to call the original system commands
# dns nameserver
ip6tables -A INPUT -s 2606:4700:4700::1111 -j ACCEPT # cloudflare
ip6tables -A OUTPUT -d 2606:4700:4700::1111 -j ACCEPT
ip6tables -A INPUT -s 2001:4860:4860::8888 -j ACCEPT # google
ip6tables -A OUTPUT -d 2001:4860:4860::8888 -j ACCEPT
Zeile 189: 4 Zeilen geändert.
! 5. subprocess
{{{
import socket # determine ipv6
import subprocess
# connection
ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
ip6tables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
Zeile 194: 3 Zeilen geändert.
tupel = socket.getaddrinfo('your.pc.com', None, socket.AF_INET6)
# tupel like [(<AddressFamily.AF_INET6: 23>, 0, 0, '', ('2a02:5a0:4110:f590:4670:d3e6:f2bc:ee', 8384, 0, 0))]
print("tupel=", tupel)
# enable dhcp
ip6tables -A INPUT -s fd94::/16 -j ACCEPT
ip6tables -A OUTPUT -d fd94::/16 -j ACCEPT
ip6tables -A INPUT -s fe80::/16 -j ACCEPT
ip6tables -A OUTPUT -d fe80::/16 -j ACCEPT
Zeile 198: 2 Zeilen geändert.
ipv6=tupel[0][4][0]
print("ipv6=", ipv6)
# enable dns
ip6tables -A INPUT -p udp -m multiport --sport 53,67,68,90,135,853,5353,8245 -j ACCEPT
ip6tables -A OUTPUT -p udp -m multiport --dport 53,67,68,90,135,853,5353,8245 -j ACCEPT
Zeile 201: 3 Zeilen geändert.
subprocess.run(["/usr/sbin/ip6tables", "-R", "INPUT", "1", "-s", ipv6, "-j", "ACCEPT"])
subprocess.run(["/usr/sbin/ip6tables", "-R", "OUTPUT", "1", "-d", ipv6, "-j", "ACCEPT"])
}}}
# enable dhcp
ip6tables -A INPUT -p ipv6-icmp -j ACCEPT
ip6tables -A OUTPUT -p ipv6-icmp -j ACCEPT
Zeile 205: Eine Zeile geändert.
! 6. Schedule script with crontab
#ip6tables -A INPUT -i eth0 -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m comment --comment router-advertisement -j ACCEPT
#ip6tables -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m comment --comment neighbor-solicitation -j ACCEPT
#ip6tables -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m comment --comment neighbor-advertisement -j ACCEPT
Zeile 207: 4 Zeilen gelöscht.
Run every 15 minutes
{{{
*/15 * * * mon /home/markus/yourscript.sh
}}}
Zeile 223: 18 Zeilen hinzugefügt.
# allow ipv6 local loopback
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT
# drop everthing else
ip6tables -P FORWARD DROP # as policy generally
ip6tables -A INPUT -j DROP
ip6tables -A OUTPUT -j DROP
# update first ip6tables rules and enable my computers
/home/markus/update_ip6tables.py
echo "---- iptables ----"
iptables -vnL
echo
echo "---- ip6tables ----"
ip6tables -vnL
}}}
Diese Seite (Version-45) wurde zuletzt am 29-Dez.-2024 12:08 von Administrator geändert.Top