Never Ending Security

Building the Ultimate VirtualBox Lab – Intro

./sqlassie -s /var/run/mysql/mysqld.sock -l 3307

$wgDBServer = "127.0.0.1:3307"

mysql -u <user> -p -h 127.0.0.1 -P 3307 -C

SELECT * FROM foo;

SELECT first_name, last_name, age FROM user WHERE id = 1323 UNION SELECT User, Password, 1 FROM mysql.user;

cd src

ln -s Makefile.gcc Makefile

apt-get install make g++ bison flex libboost-regex-dev libboost-thread-dev libboost-program-options-dev libboost-test-dev libboost-filesystem-dev libmysqlclient-dev

make

  class my_fw::pre {
    Firewall {
      require => undef,
    }

    # Default firewall rules
    firewall { '000 accept all icmp':
      proto   => 'icmp',
      action  => 'accept',
    }->
    firewall { '001 accept all to lo interface':
      proto   => 'all',
      iniface => 'lo',
      action  => 'accept',
    }->
    firewall { "002 reject local traffic not on loopback interface":
      iniface     => '! lo',
      proto       => 'all',
      destination => '127.0.0.1/8',
      action      => 'reject',
    }->
    firewall { '003 accept related established rules':
      proto   => 'all',
      state => ['RELATED', 'ESTABLISHED'],
      action  => 'accept',
    }
  }
  class my_fw::post {
    firewall { '999 drop all':
      proto   => 'all',
      action  => 'drop',
      before  => undef,
    }
  }
  firewallchain { 'INPUT:filter:IPv4':
    ensure => present,
    policy => drop,
    before => undef,
  }
  resources { 'firewall':
    purge => true
  }
  resources { 'firewallchain':
    purge => true
  }
  Firewall {
    before  => Class['my_fw::post'],
    require => Class['my_fw::pre'],
  }
  class { ['my_fw::pre', 'my_fw::post']: }
  class { 'firewall': }
puppet module upgrade puppetlabs/firewall

firewall { "000 accept all icmp requests":
  proto  => "icmp",
  action => "accept",
}
firewall { "999 drop all other requests":
  action => "drop",
}
firewall { "006 Allow inbound SSH (v6)":
  port     => 22,
  proto    => tcp,
  action   => accept,
  provider => 'ip6tables',
}
class profile::apache {
  include apache
  apache::vhost { 'mysite': ensure => present }

  firewall { '100 allow http and https access':
    port   => [80, 443],
    proto  => tcp,
    action => accept,
  }
}
firewall { '001 disallow esp protocol':
  action => 'accept',
  proto  => '! esp',
}
firewall { '002 drop NEW external website packets with FIN/RST/ACK set and SYN unset':
  chain     => 'INPUT',
  state     => 'NEW',
  action    => 'drop',
  proto     => 'tcp',
  sport     => ['! http', '! 443'],
  source    => '! 10.0.0.0/8',
  tcp_flags => '! FIN,SYN,RST,ACK SYN',
}
node 'some.node.com' {
  firewall { '111 open port 111':
    dport => 111
  }
}
firewall { '100 snat for network foo2':
  chain    => 'POSTROUTING',
  jump     => 'MASQUERADE',
  proto    => 'all',
  outiface => "eth0",
  source   => '10.1.2.0/24',
  table    => 'nat',
}
firewall { '100 forward to MY_CHAIN':
  chain   => 'INPUT',
  jump    => 'MY_CHAIN',
}
# The namevar here is in the format chain_name:table:protocol
firewallchain { 'MY_CHAIN:filter:IPv4':
  ensure  => present,
}
firewall { '100 my rule':
  chain   => 'MY_CHAIN',
  action  => 'accept',
  proto   => 'tcp',
  dport   => 5000,
}
puppet describe firewall

puppet doc -r type
(and search for firewall)

class { 'firewall': }

firewall { '000 this runs first':
  # this rule will run first
}
firewall { '999 this runs last':
  # this rule will run last
}
# If anyone's appeared on the 'badguy' blacklist within
# the last 60 seconds, drop their traffic, and update the timestamp.
firewall { '100 Drop badguy traffic':
  recent   => 'update',
  rseconds => 60,
  rsource  => true,
  rname    => 'badguy',
  action   => 'DROP',
  chain    => 'FORWARD',
}
# No-one should be sending us traffic on eth0 from localhost
# Blacklist them
firewall { '101 blacklist strange traffic':
  recent      => 'set',
  rsource     => true,
  rname       => 'badguy',
  destination => '127.0.0.0/8',
  iniface     => 'eth0',
  action      => 'DROP',
  chain       => 'FORWARD',
}
firewallchain { 'INPUT:filter:IPv4':
  purge  => true,
  ignore => [
    # ignore the fail2ban jump rule
    '-j fail2ban-ssh',
    # ignore any rules with "ignore" (case insensitive) in the comment in the rule
    '--comment "[^"](?i:ignore)[^"]"',
    ],
}
resources { 'firewallchain':
  purge => true
}
bundle install

rake test

RS_SET=ubuntu-1404-x64 rspec spec/acceptance
RS_SET=centos-64-x64 rspec spec/acceptance

More information can be found on: https://github.com/puppetlabs/puppetlabs-firewall and on http://forge.puppetlabs.com/puppetlabs/firewall

:afw =>
  :rules =>
    'MongoDB App Entry Point' => {
      :protocol => 'tcp',
      :direction => 'in',
      :interface => 'default',
      :user => 'mongodb',
      :source => ['(roles:*webserver-node OR roles:*database-node OR roles:*api-node) AND SAMETAG',
                  '10.4.76.2',
                  'backup-server.example.net']
      :dport => '27017'
    },
}

:afw =>
  :rules =>
    '<rule name>' =>
      :direction => '<in|out>',
      :protocol => '<udp|tcp|icmp>',
      :user => '<local user from /etc/passwd>',
      :interface => '<default|all|eth0|eth1|br0|...>',
      :source => '<ip|fqdn|chef search>|['<ip|fqdn|chef search>',...]'>',
      :sport => '<integer(:integer))>',
      :destination => '<ip|fqdn|chef search>|['<ip|fqdn|chef search>',...]'>',
      :dport => '<integer(:integer)>',
      :env => '<production|staging|...>',
      :options => ['disable_env_limit', 'disable_syntax_check', ...]
}

'AMQP Producers' => {
  :direction => 'in',
  :user => 'rabbitmq',
  :protocol => 'tcp',
  :interface => 'default',
  :source => ['producer1.internal.domain.com',
              'producer2.internal.domain.com',
              '192.168.1.1',
              'roles:megaserver'],
  :dport => '5672'
}

      'Production Worker to Staging BackendDB' => {
        :protocol => 'tcp',
        :direction => 'out',
        :user => 'application-user',
        :destination => 'roles:*backenddb* AND SAMETAG AND chef_environment:staging',
        :dport => '15017',
        :env => 'production',
        :options => ['disable_env_limit']
      }

      'API calls from servers' => {
        :protocol => 'tcp',
        :direction => 'in',
        :user => 'www-data',
        :dport => '80',
        :options => ['disable_syntax_check']
      },

node[:afw][:rules]['API calls from servers'][:source] = []
ip_list = ['1.2.3.4', '4.5.6.7', '12.32.43.54']
ip_list.each do |ip|
  node[:afw][:rules]['API calls from servers'][:source].push(ip)
end

[...]
depends 'AFW'

 # Call the AFW module to create the rule
 AFW.create_rule(node,
                 "Haproxy outbound to #{destination}:#{port}",
                 {'protocol' => 'tcp',
                  'direction' => 'out',
                  'user' => 'haproxy',
                  'destination' => "#{destination}",
                  'dport' => "#{port}"
                 })

node['afw']['enable_rules_cleanup'] = false

  :afw => {
    :rules => {

      'Accept all packets router through the bridge' => {
        :table => 'filter',
        :rule => '-I FORWARD -o br0 -m physdev --physdev-is-bridged -j ACCEPT'
      },

      'Drop connection to the admin panel on the eth0 interface' => {
        :table => 'mangle',
        :rule => '-A INPUT -i eth0 -p tcp --dport 80 -m string --string "get /admin http/1.1" --icase --algo bm -m conntrack --ctstate ESTABLISHED -j DROP'
      },

      'DNAT a source IP to change the destination port' => {
        :table => 'nat',
        :rule => '-A PREROUTING -i eth3 -s 201.23.72.3 -p tcp --dport 8008 -j DNAT --to-destination 127.0.0.1:1234'
      },

      'Dont do conntrack on this specific user's UDP packets' => {
        :table => 'raw',
        :rule => '-A OUTPUT -o eth0 -p udp -m owner --uid-owner 105 -j NOTRACK'
      }
    }
  }

# Generated by AFW on Tue Sep 25 02:55:32 +0000 2012

*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A OUTPUT -o lo -j NOTRACK
-A PREROUTING -i lo -j NOTRACK
COMMIT

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# some default rules we want to open everywhere
-A INPUT -p tcp --dport 22 -s 1.0.0.0/8 -j ACCEPT
-A INPUT -p tcp --dport 22 -s 12.30.0.0/16 -j ACCEPT
-A OUTPUT -p udp --dport 53 -d 1.0.0.0/8 -j ACCEPT

:app-user - [0:0]
-A OUTPUT -m owner --uid-owner 999 -m state --state NEW -j app-user
-A app-user -o eth0 -p tcp --dport 2003 -d 1.2.3.4 -m conntrack --ctstate NEW -j ACCEPT
-A app-user -o eth0 -p tcp --dport 27017 -d 1.1.4.3 -m conntrack --ctstate NEW -j ACCEPT
-A app-user -o eth0 -p tcp --dport 5672 -d 1.1.4.9 -m conntrack --ctstate NEW -j ACCEPT
-A app-user -o eth0 -p tcp --dport 80 -d 1.1.4.10 -m conntrack --ctstate NEW -j ACCEPT
-A app-user -o eth0 -p udp --dport 8125 -d 1.1.4.74 -m conntrack --ctstate NEW -j ACCEPT
-A app-user -j LOG --log-prefix "DROP_AFW_OUTPUT_app-user " --log-uid --log-tcp-sequence

:haproxy - [0:0]
-A OUTPUT -m owner --uid-owner 110 -m state --state NEW -j haproxy
-A INPUT -i eth0 -p tcp --dport 10097 -s 0.0.0.0/0 -m conntrack --ctstate NEW -j ACCEPT
-A haproxy -o eth0 -p tcp --dport 2003 -d 1.1.0.25 -m conntrack --ctstate NEW -j ACCEPT
-A haproxy -o eth0 -p tcp --dport 2003 -d 1.1.0.37 -m conntrack --ctstate NEW -j ACCEPT
-A haproxy -o eth0 -p tcp --dport 80 -d 1.1.4.58 -m conntrack --ctstate NEW -j ACCEPT
-A haproxy -j LOG --log-prefix "DROP_AFW_OUTPUT_haproxy " --log-uid --log-tcp-sequence

:nagios - [0:0]
-A OUTPUT -m owner --uid-owner 105 -m state --state NEW -j nagios
-A INPUT -i eth0 -p tcp --dport 5666 -s 1.1.0.33 -m conntrack --ctstate NEW -j ACCEPT
-A nagios -j LOG --log-prefix "DROP_AFW_OUTPUT_nagios " --log-uid --log-tcp-sequence

:ntp - [0:0]
-A OUTPUT -m owner --uid-owner 104 -m state --state NEW -j ntp
-A ntp -o eth0 -p udp --dport 123 -d ntp.example.net -m conntrack --ctstate NEW -j ACCEPT
-A ntp -j LOG --log-prefix "DROP_AFW_OUTPUT_ntp " --log-uid --log-tcp-sequence

:root - [0:0]
-A OUTPUT -m owner --uid-owner 0 -m state --state NEW -j root
-A INPUT  -p icmp -s 0.0.0.0/0 -m conntrack --ctstate NEW -j ACCEPT
-A root -o eth0 -p tcp --dport 514 -d 1.1.3.18 -m conntrack --ctstate NEW -j ACCEPT
-A root -o eth0 -p udp --dport 514 -d 1.1.3.18 -m conntrack --ctstate NEW -j ACCEPT
-A root -p icmp -d 0.0.0.0/0 -m conntrack --ctstate NEW -j ACCEPT
-A root -j LOG --log-prefix "DROP_AFW_OUTPUT_root " --log-uid --log-tcp-sequence

:snmp - [0:0]
-A OUTPUT -m owner --uid-owner 108 -m state --state NEW -j snmp
-A snmp -o eth0 -p udp --dport 162 -d 1.1.0.23 -m conntrack --ctstate NEW -j ACCEPT
-A snmp -j LOG --log-prefix "DROP_AFW_OUTPUT_snmp " --log-uid --log-tcp-sequence

:www-data - [0:0]
-A OUTPUT -m owner --uid-owner 33 -m state --state NEW -j www-data
-A INPUT -i eth0 -p tcp --dport 80 -s 1.1.4.4 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -i eth0 -p tcp --dport 80 -s 1.1.4.1 -m conntrack --ctstate NEW -j ACCEPT
-A www-data -j LOG --log-prefix "DROP_AFW_OUTPUT_www-data " --log-uid --log-tcp-sequence

-A INPUT -j LOG --log-prefix "DROP_AFW_INPUT " --log-uid --log-tcp-sequence
-A INPUT -j DROP

-A OUTPUT -j LOG --log-prefix "DROP_AFW_OUTPUT " --log-uid --log-tcp-sequence
COMMIT

provides "network"

require_plugin "hostname"
require_plugin "#{os}::network"

network['interfaces'].each do |iface, addrs|

  addrs['addresses'].each do |ip, params|
    network["ipaddress_#{iface}"] = ip if params['family'].eql?('inet')
    network["ipaddress6_#{iface}"] = ip if params['family'].eql?('inet6')
    network["macaddress_#{iface}"] = ip if params['family'].eql?('lladdr')
  end

end

laniface = from("[ -e /vagrant ] && echo eth1 || echo eth0")

network['lanip'] = network["ipaddress_#{laniface}"]
network['laniface'] = laniface

network

 +-------------------------------------------------------------------------+
 | Advanced FireWall (AFW) Cookbook for Opscode Chef                       |
 |                                                                         |
 | Copyright (C) 2012, AWeber, Julien Vehent                               |
 |                                                                         |
 | This program is free software; you can redistribute it and/or modify    |
 | it under the terms of the GNU General Public License version 2          |
 | as published by the Free Software Foundation.                           |
 |                                                                         |
 | This program is distributed in the hope that it will be useful,         |
 | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
 | GNU General Public License for more details.                            |
 |                                                                         |
 | You should have received a copy of the GNU General Public License along |
 | with this program; if not, write to the Free Software Foundation, Inc., |
 | 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.             |
 |                                                                         |
 +-------------------------------------------------------------------------+

More information can be found on:https://github.com/jvehent/AFW
$ sudo pip install libnfldap
$ python setup.py bdist_rpm
$ time python example_allusers.py '(uid=jvehent)'
IPTables rules written in /tmp/tmpT7JgOW
IPSet rules written in /tmp/tmpJYtWM5

real    0m0.605s
user    0m0.061s
sys     0m0.014s
$ python example.py 2297
#Generating rules for user ID 1664
#====== ACL details ======
jvehent has access to .....
cd /usr/local/src

wget http://download.configserver.com/csf.tgz

tar -xzf csf.tgz

cd csf

sh install.sh
perl /usr/local/csf/bin/csftest.pl
sh /usr/local/csf/bin/remove_apf_bfd.sh
vi /etc/csf.conf
vi /etc/csf/csf.blocklist
vi /etc/csf/csf.ignore

If you end up blocking yourself you will have to login at the console to stop LFD  through init.  
/etc/init.d/lfd stop
vi /etc/csf/csf.conf
HTACCESS_LOG = "/var/log/apache2/error.log"

MODSEC_LOG = "/var/log/apache2/error.log"

SSHD_LOG = "/var/log/auth.log"

SU_LOG = "/var/log/messages"

FTPD_LOG = "/var/log/proftpd/proftpd.log"

SMTPAUTH_LOG = "/var/log/mail.log"

POP3D_LOG = "/var/log/mail.log"

IMAPD_LOG = "/var/log/mail.log"

IPTABLES_LOG = "/var/log/syslog"

SUHOSIN_LOG = "/var/log/syslog"

BIND_LOG = "/var/log/syslog"

SYSLOG_LOG = "/var/log/syslog"

WEBMIN_LOG = "/var/log/auth.log"
CUSTOM1_LOG = "/var/log/mail.log"
vi /usr/local/csf/bin/regex.custom.pm
if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /^\S+\s+\d+\s+\S+ \S+ postfix\/smtpd\[\d+\]: warning:.*\[(\d+\.\d+\.\d+\.\d+)\]: SASL [A-Z]*? authentication failed/)) {

return ("Failed SASL login from",$1,"mysaslmatch","1","25","6000");

}
csf -r
vi /etc/csf/csf.allow

###############################################################################
# Copyright 2006-2014, Way to the Web Limited
# URL: http://www.configserver.com
# Email: sales@waytotheweb.com
###############################################################################
# The following IP addresses will be allowed through iptables.
# One IP address per line.
# CIDR addressing allowed with a quaded IP (e.g. 192.168.254.0/24).
# Only list IP addresses, not domain names (they will be ignored)
#
# Advanced port+ip filtering allowed with the following format
# tcp/udp|in/out|s/d=port|s/d=ip
# See readme.txt for more information
#
# Note: IP addressess listed in this file will NOT be ignored by lfd, so they
# can still be blocked. If you do not want lfd to block an IP address you must
# add it to csf.ignore
123.123.123.124 # csf SSH installation/upgrade IP address - Wed Feb 26 13:16:28 2014
123.123.123.125 # Home IP address
csf -e
csf -x
csf -e
csf -r
apt-get install vim
ssh -l root proxmox-server-ip
cd /etc/network
vi interfaces
## this is for pfSense WAN nic

auto vmbr1
iface vmbr1 inet manual
bridge_ports eth1
bridge_stp off
bridge_fd 0
:wq
reboot
vi /boot/loader.conf
virtio_load="YES"
virtio_pci_load="YES"
if_vtnet_load="YES"
virtio_blk_load="YES"
:wq
https://172.16.2.6  (Replace with your own LAN IP)
vi /etc/fstab
/dev/ad0s1a       /           ufs       rw     1     1
/dev/ad0s1b       none    swap   rw      0    0
/dev/vtbd0s1a    /            ufs       rw    1     1
/dev/vtbd0s1b    none     swap   sw    0     0
:wq
cd /etc/pve/qemu-server/
cp 198.conf 198.conf.orig
vi 198.conf
virtio0: local:198/vm-198-disk-1.raw,format=raw,size=10G
bootdisk: virtio0
:wq
apt-get install vim
ssh -l root proxmox-server-ip
cd /etc/network
## this is for IPCop WAN nic

auto vmbr1
iface vmbr1 inet manual
bridge_ports eth1
bridge_stp off
bridge_fd 0
:wq
# reboot
vi /etc/network/interfaces
## this is for IPCop DMZ nic
auto vmbr2
iface vmbr2 inet manual
bridge_ports eth2
bridge_stp off
bridge_fd 0
:wq
/usr/local/bin/setreservedports.pl --gui 5445
 $ git clone git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/bridge-utils.git
 $ cd bridge-utils
 $ autoconf
 $ ./configure

# brctl
# commands:
        addbr           <bridge>                add bridge
        delbr           <bridge>                delete bridge
        addif           <bridge> <device>       add interface to bridge
        delif           <bridge> <device>       delete interface from bridge
        setageing       <bridge> <time>         set ageing time
        setbridgeprio   <bridge> <prio>         set bridge priority
        setfd           <bridge> <time>         set bridge forward delay
        sethello        <bridge> <time>         set hello time
        setmaxage       <bridge> <time>         set max message age
        setpathcost     <bridge> <port> <cost>  set path cost
        setportprio     <bridge> <port> <prio>  set port priority
        show                                    show a list of bridges
        showmacs        <bridge>                show a list of mac addrs
        showstp         <bridge>                show bridge stp info
        stp             <bridge> <state>        turn stp on/off

 brctl addbr "bridgename"

 brctl delbr bridgename

 brctl addif bridgename device

 brctl delif  bridgename device

 # brctl addbr br549
 # brctl addif br549 eth0
 # brctl addif br549 eth1
 # brctl show
 bridge name     bridge id               STP enabled     interfaces
 br549           8000.00004c9f0bd2       no              eth0
                                                         eth1

 # brctl showmacs br549
 port no mac addr                is local?       ageing timer
   1     00:00:4c:9f:0b:ae       no                17.84
   1     00:00:4c:9f:0b:d2       yes                0.00
   2     00:00:4c:9f:0b:d3       yes                0.00
   1     00:02:55:1a:35:09       no                53.84
   1     00:02:55:1a:82:87       no                11.53
  ...

  # brctl setageing bridgename time

 # brctl stp br549 on

 # brctl showstp br549
 br549
  bridge id              8000.00004c9f0bd2
  designated root        0000.000480295a00
  root port                 1                    path cost                104
  max age                  20.00                 bridge max age           200.00
  hello time                2.00                 bridge hello time         20.00
  forward delay           150.00                 bridge forward delay      15.00
  ageing time             300.00                 gc interval                0.00
  hello timer               0.00                 tcn timer                  0.00
  topology change timer     0.00                 gc timer                   0.33
  flags

 eth0 (1)
  port id                8001                    state                   forwarding
  designated root        0000.000480295a00       path cost                100
  designated bridge      001e.00048026b901       message age timer         17.84
  designated port        80c1                    forward delay timer        0.00
  designated cost           4                    hold timer                 0.00
  flags

 eth1 (2)
  port id                8002                    state                   disabled
  designated root        8000.00004c9f0bd2       path cost                100
  designated bridge      8000.00004c9f0bd2       message age timer          0.00
  designated port        8002                    forward delay timer        0.00
  designated cost           0                    hold timer                 0.00
  flags

  # brctl setbridgeprio bridgename priority

 # brctl setpathcost bridge port cost

 #  brctl setfd bridgename time

 # brctl sethello bridgename time

 # brctl maxage  bridgename time

multicast_snooping

multicast_router

hash_{max,elasticity}

remaining multicast_* options

 # ifconfig eth0 0.0.0.0
 # ifconfig eth1 0.0.0.0
 # brctl addbr mybridge
 # brctl addif mybridge eth0
 # brctl addif mybridge eth1 
 # ifconfig mybridge up

 # ifconfig mybridge 192.168.100.5 netmask 255.255.255.0

 # ifconfig eth0 0.0.0.0
 # ifconfig eth1 0.0.0.0
 # brctl addbr mybridge
 # brctl addif mybridge eth0
 # brctl addif mybridge eth1 
 # dhclient mybridge

 # cat >> /etc/net/iftab
 port0 mac 00:13:46:66:01:5e
 port1 mac 00:13:46:66:01:5f
 ^D
 # mkdir /etc/net/ifaces/port0
 # cat > /etc/net/ifaces/port0/options
 TYPE=eth
 MODULE=via-rhine
 # mkdir /etc/net/ifaces/port1
 # cat > /etc/net/ifaces/port1/options
 TYPE=eth
 MODULE=via-rhine
 ^D

 # mkdir /etc/net/ifaces/mybridge
 # cat > /etc/net/ifaces/mybridge/options
 TYPE=bri
 HOST='port0 port1'
 ^D
 # cat > /etc/net/ifaces/mybridge/brctl
 stp AUTO on
 ^D

 # cd /proc/sys/net/bridge
 # ls
 bridge-nf-call-arptables  bridge-nf-call-iptables
 bridge-nf-call-ip6tables  bridge-nf-filter-vlan-tagged
 # for f in bridge-nf-*; do echo 0 > $f; done

 # brctl setfd br0 0
 # brctl addif br0 eth0
 # dhclient eth0

target   prot   opt in  out source destination
ACCEPT   all    --  lo  any anywhere anywhere
ACCEPT   all    --  any any anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT   tcp    --  any any anywhere anywhere tcp dpt:ssh
ACCEPT   tcp    --  any any anywhere anywhere tcp dpt:http
ACCEPT   tcp    --  any any anywhere anywhere tcp dpt:https
DROP     all    --  any any anywhere anywhere
sudo iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

sudo iptables -S

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

sudo iptables -P INPUT ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -F

sudo iptables -F

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

sudo iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

sudo iptables -I INPUT 1 -i lo -j ACCEPT

sudo iptables -S

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

sudo iptables -P INPUT DROP

sudo iptables -P INPUT ACCEPT

sudo iptables -A INPUT -j DROP

sudo iptables -D INPUT -j DROP
sudo iptables -A INPUT new_rule
sudo iptables -A INPUT -j DROP

sudo iptables -I INPUT 4 new_rule

sudo iptables -L --line-numbers

Chain INPUT (policy DROP)
num  target     prot opt source               destination         
1    ACCEPT     all  --  anywhere             anywhere            
2    ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
3    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
4    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

# Delete at position 3
sudo iptables -D INPUT 3  # Or delete by the rule:
sudo iptables -D INPUT -p tcp --dport 22-j ACCEPT
sudo iptables -I INPUT 3-p tcp --dport 1234-j ACCEPT
sudo apt-get update
sudo apt-get install iptables-persistent

iptables -N LOG

iptables -A INPUT -j LOG

iptables -A LOG -m limit --limit 60/min -j LOG --log-prefix "IPTables DROP: " --log-level 7

sudo tail -f /var/log/syslog

sudo tail -f /var/log/messages

http_port 0.0.0.0:3128

Use firewall-cmd to enable, for example ssh:	# firewall-cmd –enable –service=ssh
Enable samba for 10 seconds: Enable samba for 10 seconds:	# firewall-cmd –enable –service=samba –timeout=10
Enable ipp-client:	# firewall-cmd –enable –service=ipp-client
Disable ipp-client:	# firewall-cmd –disable –service=ipp-client
To restore the static firewall with lokkit again simply use (after stopping and disabling Firewalld):	# lokkit –enabled

Category Archives: Firewall

SQLassie

Usage

Testing

Compiling

Building the Ultimate VirtualBox Lab – Introduction

Introduction: Ultimate VBox Setup

Building the Ultimate VirtualBox Lab – Configure VBox

Configure VBox

Building the Ultimate VirtualBox Lab – Install pfSense

Install pfSense in VirtualBox

Let’s Get Started

Building the Ultimate VirtualBox Lab – Install Windows 2012 Base

Setup Windows 2012 Base for Linked Clones

Windows 2012 ISO Download

Let’s begin

Configure a new Base VM

Install and Configure VM

Finish Configuring pfSense

Final Windows Configurations

Next Step

Building the Ultimate VirtualBox Lab – Prep VDI for Compacting

Prep VM for .vdi compacting

Let’s Begin

Windows Update

Clean-up storage

Compact vdi

Prepare VM to be a template

Create Base Snapshot

Set the Base VM not to boot

Next Step

Building the Ultimate VirtualBox Lab – Linked Clones

How to Setup Linked Clones

Let’s Begin

Setup a Linked Clone

Power-on Your New Linked Clone

Building the Ultimate VirtualBox Lab – RDP to VMs

Disable pfSense’s ‘Block Private Network’ option

Configure NAT rule to allow pfSense to port forward ports to VM’s 3389 MSRDP port

firewall

Table of Contents

Overview

Module Description

Setup

What firewall Affects

Setup Requirements

Beginning with firewall

Create the my_fw::pre and my_fw::post Classes

Create Firewall Rules

Upgrading

From version 0.2.0 and more recent

Usage

Default Rules

Examples of Default Rules

Example of an IPv6 rule

Application-Specific Rules

Rule inversion

Additional Uses for the Firewall Module

Additional Information

Reference

Class: firewall

ensure

package

service

Type: firewall

Providers

Features

Parameters

Type: firewallchain

Providers

Features

Parameters

Fact: ip6tables_version

Fact: iptables_version

Fact: iptables_persistent_version

Limitations

SLES

Oracle Enterprise Linux

Other

Development

Create the `my_fw::pre` and `my_fw::post` Classes