Re: Iptables udp problems
From: chris (chris@here.com)Date: 03/11/02
- Next message: sponge: "Re: TPF outgoing alert"
- Previous message: Dave Korn: "Re: Warning: Gibson's GENESIS is broken as published"
- In reply to: C-Pro: "Iptables udp problems"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: chris <chris@here.com> Date: Mon, 11 Mar 2002 17:52:31 GMT
In article <3C89D6AE.8010803@mail.ru>, C-Pro wrote:
> I am running iptables on my RH 7.1 (kernel 2.5.0) and when scanning from
> another computer on my local network, scanner shows all udp ports
> open. Why?
Because you seem to be wide open.
> my iptables script:
>
> #!/bin/bash
> /sbin/iptables -F
> /sbin/iptables -P INPUT ACCEPT
Are you sure about this? usually one would put up a deny policy by
default.
> /sbin/iptables -P OUTPUT ACCEPT
> /sbin/iptables -P FORWARD DROP
> /sbin/iptables -A INPUT -i lo -p ALL -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --tcp-flags SYN,ACK,RST,FIN RST -m limit
> --limit 3/second -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --tcp-flags SYN,ACK,RST,FIN RST -j DROP
> /sbin/iptables -A INPUT -p tcp --syn -m limit --limit 3/second --dport
> 137:139 -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --syn -j REJECT --reject-with tcp-reset
I am no expert on iptables, but the rules are read top down. With your
first INPUT -p tcp you accept all incoming traffic. Beside that,
you have no rules concerning udp traffic at all. With the default ACCEPT
policy of course your ports show open. You do not mention open tcp ports,
yet I suspect they are wide open as well.
I would definitely change the first INPUT -p tcp rule to LOG
(I think you meant this with your use of the limit matching) and the INPUT
policy to DROP.
Of course this would mean you have to add something for your LAN traffic.
Chris
> /sbin/iptables -A INPUT -p tcp -m state --state INVALID -j DROP
> /sbin/iptables -A INPUT -p tcp -m state --state NEW ! -i eth0 -j REJECT
> --reject-with tcp-reset
> /sbin/iptables -A INPUT -p ICMP -m limit --limit 4/second -j ACCEPT
> /sbin/iptables -A INPUT -p ICMP --icmp-type ! echo-reply -j DROP
>
>
> for blah in /proc/sys/net/ipv4/conf/*/rp_filter; do
> echo "1" > $blah
> done<EOF>
>
> Thank you. C-Pro.
>
- Next message: sponge: "Re: TPF outgoing alert"
- Previous message: Dave Korn: "Re: Warning: Gibson's GENESIS is broken as published"
- In reply to: C-Pro: "Iptables udp problems"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
