Netværkssikkerhed

Dual home firewall
iptables - eksempel
# Flush all the rules and set the default policy for the FORWARD chain to deny all
iptables -F INPUT
iptables –F OUTPUT
iptables –F FORWARD
iptables -P FORWARD deny
# Block all incoming and outgoing traffic on eth0
iptables -A INPUT -i eth0 -j DROP
iptables -A OUTPUT -o eth0 -j DROP
# Instruct Netfilter to accept fragmented packets (-f)
iptables -A FORWARD -f -j ACCEPT
# Accept incoming TCP packets from established connections
iptables -A FORWARD -m state -p tcp --state ESTABLISHED,RELATED -j ACCEPT
# Accept incoming TCP connections to SSH arriving at eth0
iptables -A FORWARD -p tcp -i eth0 -d 208.209.210.0/24 --dport ssh -j ACCEPT
# Accept all outgoing TCP and UDP connections entering the private interface (eth1)
iptables -A FORWARD -p tcp -i eth1 -j ACCEPT
iptables -A FORWARD -p udp -i eth1 -j ACCEPT
# Accept incoming ICMP packet of "echo reply (=0)" type (ping replies)
iptables -A FORWARD -p icmp -i eth0 -d 208.209.210.0/24 --icmp-type 0 -j ACCEPT
# Accept all outgoing ICMP connections entering the private interface (eth1)
iptables -A FORWARD -p icmp -i eth1 -j ACCEPT
# Drop all other traffic in the FORWARD chain
iptables -A FORWARD -j DROP
iptables –A OUTPUT –j LOG
09/10/2012 ITU 7.33