Diese Seite (Version-45) wurde zuletzt am 29-Dez.-2024 12:08 von Administrator geändert.

Diese Seite wurde am 23-Dez.-2024 12:59 von Administrator erstellt.

Du bist nicht autorisiert, diese Seite umzubenennen.

Du bist nicht autorisiert, diese Seite zu löschen.

Versionsgeschichte der Seite

Version Zuletzt geändert Größe Autor Änderungen Kommentar
45 29-Dez.-2024 12:08 10 KB Administrator zur vorherigen
44 29-Dez.-2024 12:06 10 KB Administrator zur vorherigen | zur neuesten
43 29-Dez.-2024 12:05 10 KB Administrator zur vorherigen | zur neuesten
42 29-Dez.-2024 12:02 9 KB Administrator zur vorherigen | zur neuesten
41 29-Dez.-2024 12:01 9 KB Administrator zur vorherigen | zur neuesten

Links

Eingehende Links Ausgehende Links
Firewall with iptables
Firewall with iptables

Versionsunterschiede

Unterschiede zwischen Version und .

Zeile 21: 12 Zeilen hinzugefügt.
! Logging
{{{
> iptables -A INPUT -j LOG --log-level 4 --log-prefix 'IP INPUT '
}}}
! Load rules after reboot
{{{
> sudo apt-get install iptables-persistent
}}}
* Current iptables rules can be saved to the configuration file /etc/iptables/rules.v4. These rules will then be loaded automatically during system startup.
* Rules are only saved automatically during package installation. See the manual page of iptables-save(8) for instructions on keeping the rules file up-to-date.
Zeile 56: Eine Zeile geändert.
** -j : jump to ~[ACCEPT, DROP, QUEUE, RETURN~] (or others added with modules)
** -j : jump to ~[ACCEPT, DROP, QUEUE, RETURN~] (or others added with modules), REJECT= notify other end, DROP= silently ignore
Zeile 78: 10 Zeilen hinzugefügt.
! [Examples|https://www.iitk.ac.in/LDP/HOWTO/Linux+IPv6-HOWTO/ch18s03.html]
{{{
ip6tables -A INPUT -i eth0 -p tcp -s 2001:0db8:100::1/128 --sport 512:65535 --dport 22 -j ACCEPT #Allow incoming SSH from 2001:0db8:100::1/128
ip6tables -A OUTPUT -o eth0 -p tcp -d 2001:0db8:100::1/128 --dport 512:65535 --sport 22 ! --syn -j ACCEPT #Allow response packets (no longer needed if connection tracking is used!)
ip6tables -I INPUT -i eth0 -p tcp --syn -j DROP #Block incoming TCP connection requests to this host
ip6tables -I FORWARD -i eth0 -p tcp --syn -j DROP #Block incoming TCP connection requests to hosts behind this router
ip6tables -I INPUT -i eth0 -p udp ! --dport 32768:60999 -j DROP #Block incoming UDP packets which cannot be responses of outgoing requests of this host
ip6tables -I FORWARD -i eth0 -p udp ! --dport 32768:60999 -j DROP #Block incoming UDP packets which cannot be responses of forwarded requests of hosts behind this router
ip6tables -A INPUT --protocol icmpv6 --icmpv6-type echo-request -j ACCEPT --match limit --limit 30/minute #Rate-limiting
}}}
Zeile 67: Eine Zeile geändert.
! Example RuleSet
{{{
-A RH-Firewall-1-INPUT -p icmpv6 -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited
}}}
Zeile 100: 17 Zeilen hinzugefügt.
more {examples|https://www.linux.com/topic/networking/iptables-rules-ipv6/]
{{{
ipt6="/sbin/ip6tables" # Define your command variables
$ipt6 -A INPUT -i lo -j ACCEPT # Must allow loopback interface
$ipt6 -A INPUT -p tcp --syn -j DROP # Reject connection attempts not initiated from the host
$ipt6 -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Allow return connections initiated from the host
$ipt6 -A INPUT -p icmpv6 -j ACCEPT # Accept all ICMP v6 packets
# to services. Delete $ipt6 -A INPUT -p tcp --syn -j DROP # Optional rules to allow other LAN hosts access
$ipt6 -A INPUT -m state --state NEW -m udp -p udp # Allow DHCPv6 from LAN only
-s fe80::/10 --dport 546 -j ACCEPT
$ipt6 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT # Allow connections from SSH clients
$ipt6 -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT # Allow HTTP and HTTPS traffic
$ipt6 -A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT # Allow HTTP and HTTPS traffic
}}}
! My RuleSet
Diese Seite (Version-45) wurde zuletzt am 29-Dez.-2024 12:08 von Administrator geändert.Top