diff options
| -rw-r--r-- | core/conf/iptables/ipt-client.sh | 20 | ||||
| -rw-r--r-- | core/conf/iptables/ipt-firewall.sh | 6 |
2 files changed, 24 insertions, 2 deletions
diff --git a/core/conf/iptables/ipt-client.sh b/core/conf/iptables/ipt-client.sh index 65df9e4..77de218 100644 --- a/core/conf/iptables/ipt-client.sh +++ b/core/conf/iptables/ipt-client.sh @@ -19,13 +19,21 @@ $IPT -A INPUT -i ${PUB_IF} -j cli_https_in $IPT -A INPUT -i ${PUB_IF} -j cli_git_in $IPT -A INPUT -i ${PUB_IF} -j cli_ssh_in $IPT -A INPUT -i ${PUB_IF} -j srv_icmp +$IPT -A INPUT -i ${PUB_IF} -j srv_ntp $IPT -A INPUT -i ${PUB_IF} -j cli_pops_in $IPT -A INPUT -i ${PUB_IF} -j cli_smtps_in $IPT -A INPUT -i ${PUB_IF} -j cli_irc_in $IPT -A INPUT -i ${PUB_IF} -j cli_ftp_in $IPT -A INPUT -i ${PUB_IF} -j cli_gpg_in -$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -j ACCEPT +$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -j DROP +$IPT -A INPUT -p tcp --dport 1024:65535 --sport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT +$IPT -A INPUT -p udp --dport 1024:65535 --sport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT + +# allow all established and related +$IPT -A INPUT -p tcp --dport 1024:65535 --sport 1:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT +$IPT -A INPUT -p udp --dport 1024:65535 --sport 1:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT +$IPT -A INPUT -p icmp -j ACCEPT ####### Output Chain ###### $IPT -A OUTPUT -j blocker @@ -36,12 +44,20 @@ $IPT -A OUTPUT -o ${PUB_IF} -j cli_ssh_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out $IPT -A OUTPUT -o ${PUB_IF} -j srv_icmp +$IPT -A OUTPUT -o ${PUB_IF} -j srv_ntp $IPT -A OUTPUT -o ${PUB_IF} -j cli_pops_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_smtps_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_irc_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_ftp_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_gpg_out -$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:655335 --dport 1024:65535 -j ACCEPT + +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT +$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 1024:65535 -j ACCEPT + +# allow all out (make nmap and others happy) +$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 1:65535 -j ACCEPT +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1:65535 -j ACCEPT +$IPT -A OUTPUT -p icmp -j ACCEPT ## log everything else and drop ipt_log diff --git a/core/conf/iptables/ipt-firewall.sh b/core/conf/iptables/ipt-firewall.sh index 12c3834..086b864 100644 --- a/core/conf/iptables/ipt-firewall.sh +++ b/core/conf/iptables/ipt-firewall.sh @@ -18,6 +18,7 @@ ipt_clear () { iptables -N srv_dhcp iptables -N srv_rip iptables -N srv_icmp + iptables -N srv_ntp iptables -N srv_dns_in iptables -N srv_dns_out iptables -N srv_http_in @@ -251,6 +252,11 @@ ipt_tables () { ####### ICMP Server $IPT -A srv_icmp -p icmp -j ACCEPT $IPT -A srv_icmp -j RETURN + + ####### NTP Client and Server + $IPT -A srv_ntp -p udp --sport 123 --dport 123 -j ACCEPT + $IPT -A srv_ntp -j RETURN + } |