SmoothWall防火墙规则的使用

王朝other·作者佚名  2006-12-16
窄屏简体版  字體: |||超大  

Adding iptables Rules

[These modifications only apply to Smoothwall Express 2.0, as GPL 1.0 uses ipchains.]

This page describes how to add additional firewall rules to the Smoothwall Express 2.0 firewall script.

For information on making similar changes to a Smoothwall GPL 1.0 box (using ipchains), refer to Hilton's web site.

Requirements:

You'll need:

A Smoothwall Express 2.0 installation (obviously...).

A way of getting a command-line prompt on your Smoothwall box (either by logging directly onto your Smoothwall box, using a SSH client such as PuTTY or SSH Secure Shell, or via the Smoothwall web interface).

Editing the Firewall Script:

Smoothwall's iptables firewall configuration is stored in /etc/rc.d/rc.firewall.up, so to make changes to the firewall, you'll need to edit this script.

Note that you can use various aliases in the firewall script to reference the red and green network interfaces (ie, $RED_DEV, $GREEN_DEV), ip addresses (ie, $GREEN_ADDRESS), network addresses (ie, $GREEN_NETADDRESS), and subnets (ie, $GREEN_NETMASK).

These aliases are defined in /var/smoothwall/ethernet/settings and this file should not be edited, as it's generated by Smoothwall's setup program.

Note that if your red interface is a modem, ISDN, or using PPPoE or PPPoA, you can't use the $RED_DEV alias, but need to specify the actual interface name, for example, ppp0.

As with any modifications to your Smoothwall, make a backup copy of this file before making any changes to it, so you can easily revert back to a known working version.

Applying Your Changes:

Any changes you make to the firewall script will not take effect immediately.

After making changes to the firewall script, you can either reboot your Smoothwall, or run the following from a command line:

/etc/rc.d/rc.netaddress.down; /etc/rc.d/rc.netaddress.up

This will re-apply the firewall (as well as restart Snort, any VPNs, etc), and your modifications to the firewall script should be taking effect.

If you see any iptables errors immediately after the line

Setting up firewall

then you've probably made a typo or other mistake in the firewall script, and you'll have to make the appropriate corrections.

Note that you need execute this as a single line if you're accessing your Smoothwall via SSH - otherwise your SSH connection will be terminated, and you won't be able to re-establish it without logging onto Smoothwall's console to run the up script!

Stop Logging Blaster Hits:

This will stop your firewall logs from filling up with hits on TCP port 135 from the Blaster worm.

Note that Smoothwall will still block all incoming traffic on port 135 - it's just not logging the hits anymore.

Edit /etc/rc.d/rc.firewall.up and immediately after the line containing

/sbin/iptables -P OUTPUT ACCEPT

insert the following

# drop hits from Blaster worm

/sbin/iptables -A INPUT -p TCP -i $RED_DEV --dport 135 -s 0/0 -j DROP

Stop Logging Netbios Hits:

This will stop your firewall logs from filling up with hits on UDP port 137.

Note that Smoothwall will still block all incoming traffic on port 137 - it's just not logging the hits anymore.

Edit /etc/rc.d/rc.firewall.up and immediately after the line containing

/sbin/iptables -P OUTPUT ACCEPT

insert the following

# drop netbios traffic

/sbin/iptables -A INPUT -p UDP -i $RED_DEV --dport 137 -s 0/0 -j DROP

Block Outbound Traffic From Specific PCs:

If you want to prevent one or more specific PCs on your green network from accessing the internet, edit /etc/rc.d/rc.firewall.up and immediately after the line containing

/sbin/iptables -P OUTPUT ACCEPT

insert the following

# block all outgoing traffic from this PC

/sbin/iptables -A FORWARD -p ALL -i $GREEN_DEV -s 192.168.0.3 -j DROP

To block specific traffic from a PC on your green network (ie, web traffic on port 80), use

# block all outgoing web traffic from this PC

/sbin/iptables -A FORWARD -p TCP -i $GREEN_DEV -s 192.168.0.3 --dport 80 -j DROP

Note that blocking outbound traffic in this way won't have any effect if you have Smoothwall's web proxy enabled, and the user configures their browser to use the proxy. To block this traffic too, you'll either need to block incoming traffic from that user on port 800 (the web proxy port), or implement an ACL in Squid.

You can also block traffic based on the source MAC address:

# block all outgoing traffic from this PC

/sbin/iptables -A FORWARD -p ALL -i $GREEN_DEV -m mac --mac-source XX:XX:XX:XX:XX:XX -j DROP

Only Allow Outbound Traffic From Specific PCs:

If you want to block all outbound traffic from your green network, and only allow one or more specific PCs to access the intenet, edit /etc/rc.d/rc.firewall.up and immediately after the line containing

/sbin/iptables -P OUTPUT ACCEPT

insert the following

# allow outgoing traffic from these PCs

/sbin/iptables -A FORWARD -p ALL -i $GREEN_DEV -s 192.168.0.3 -j ACCEPT

/sbin/iptables -A FORWARD -p ALL -i $GREEN_DEV -s 192.168.0.4 -j ACCEPT

# block all other outgoing traffic

/sbin/iptables -A FORWARD -p ALL -i $GREEN_DEV -s 0/0 -j DROP

Note that blocking outbound traffic in this way won't have any effect if you have Smoothwall's web proxy enabled, and the user configures their browser to use the proxy. To block this traffic too, you'll either need to block incoming traffic from that user on port 800 (the web proxy port), or implement an ACL in Squid.

Note:

Note that some of the Smoothwall fixes may overwrite rc.firewall.up with a newer version, so if you install a new fix, it may overwrite your changes, so always keep a backup copy of your rc.firewall.up before patching your Smoothie, so you can reapply the changes to the new rc.firewall.up.

Similarly, when doing a fresh installation of Smoothwall, only make these changes once you've fully patched the installation.

References:

netfilter/iptables project

last updated 7 Jan 2004

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
 
 
© 2005- 王朝網路 版權所有 導航