Firewall

[Chipp]

Hi all ,

I would Like to setup a firewall to Do the Following if some one can help i will grateful :

i want to block all except certain Ips that use a certain port .

thanks in advanced

[sarumont]

http://www.netfilter.org

[KraZyMan]

I hope this helps... this is a quick script that I put together for you. Remember, it is based on DENY ALL and then accept what you want...

Oh, this is just a template for you to write your own firewall with, btw...

#-----Linux Firewall script---------------------------------
#- Template for a packet filter.
#-----------------------------------------------------------

IPT=/sbin/iptables

#-----Clear old rules
echo Clearing any pre-existing IPTABLES.
$IPT -F INPUT
$IPT -F OUTPUT
$IPT -F FORWARD

$IPT -P INPUT DROP
$IPT -P INPUT DROP
$IPT -P FORWARD DROP

#----Start adding allow rules here....
# Without connection tracking... Basically this gives full trust to traffic from remote port 80 connection via tcp.

$IPT -A INPUT -s <insert remote ip here> -p tcp --source-port 80 -j ACCEPT
$IPT -A OUTPUT -d <insert remote ip here> -p tcp --destination-port 80 -j ACCEPT

# Or .. With connection tracking.... Basically the same thing as above, however, this will deny incomming connection requests, and only allow the connection if you start it first.

$IPT -A INPUT -s <remote ip> -p tcp --source-port 80 -m --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -d <remote ip> -p tcp --destination-port 80 -m --state NEW, ESTABLISHED -j ACCEPT


Hope this helps... tried to keep it simple. You can do this with all IPs, protocols and ports... just mix and match if you need a really specific packet filter. (btw, ignore the typos if there are any...

[stathisx]

good job KraZyMan!you can also use man iptables to configure security manually...

[llamasmurf]

If you are looking for an easy setup, yet full linux install...

Try out Mandrake's Multi Network Firewall (MNF)

they have just released the new version based on Mandrake 10.1.


Nice easy install... under 400mb..

Full control over your firewall goodness is provided via a nice web interface.

Im actually inlove with this product, iv been using it for over 2 years now.