ファイアウォール IPTABLES 設定

ヒント

iptablesとは
Linuxに実装されたパケットフィルタリング、ファイアウォール機能です。

[root@ns1 ~]# vi iptables_setup.sh

↓下記を記入
#!/bin/bash

################
### 初期設定 ###
################
LOCALNET=192.168.1.0/24

#####################
### IPTABLES STOP ###
#####################
/etc/rc.d/init.d/iptables stop

####################
### Default Rule ###
####################
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

####################
### LOCAL ACCEPT ###
####################
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -s $LOCALNET -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#####################
### FRAGMENT DROP ###
#####################
iptables -A INPUT -f -j LOG --log-level debug --log-prefix 'FRAGMENT DROP:'
iptables -A INPUT -f -j DROP

####################
### NetBIOS DROP ###
####################
iptables -A INPUT -s ! $LOCALNET -p tcp -m multiport --dports 135,137,138,139,445 -j DROP
iptables -A INPUT -s ! $LOCALNET -p udp -m multiport --dports 135,137,138,139,445 -j DROP
iptables -A OUTPUT -d ! $LOCALNET -p tcp -m multiport --sports 135,137,138,139,445 -j DROP
iptables -A OUTPUT -d ! $LOCALNET -p udp -m multiport --sports 135,137,138,139,445 -j DROP

#####################
### PING OF DEATH ###
#####################
iptables -N PINGOFDEATH
iptables -A PINGOFDEATH -m limit --limit 1/s --limit-burst 4 -j ACCEPT
iptables -A PINGOFDEATH -j LOG --log-level debug --log-prefix 'PINGDEATH DROP:'
iptables -A PINGOFDEATH -j DROP
iptables -A INPUT -p icmp --icmp-type echo-request -j PINGOFDEATH

########################
### BROAD MULTI DROP ###
########################
iptables -A INPUT -d 255.255.255.255 -j DROP
iptables -A INPUT -d 224.0.0.1 -j DROP

################
### 113IDENT ###
################
iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset

###########
### SSH ###
###########
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

###########
### DNS ###
###########
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT

############
### HTTP ###
############
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

###########
### SSL ###
###########
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

###########
### FTP ###
###########
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 4000:4029 -j ACCEPT

############
### SMTP ###
############
iptables -A INPUT -p tcp --dport 25 -j ACCEPT

#############
### SMTPS ###
#############
iptables -A INPUT -p tcp --dport 465 -j ACCEPT

############
### POP3 ###
############
iptables -A INPUT -p tcp --dport 110 -j ACCEPT

#############
### POP3S ###
#############
iptables -A INPUT -p tcp --dport 995 -j ACCEPT

############
### IMAP ###
############
iptables -A INPUT -p tcp --dport 143 -j ACCEPT

#############
### IMAPS ###
#############
iptables -A INPUT -p tcp --dport 993 -j ACCEPT

###############
### logging ###
###############
iptables -A INPUT -m limit --limit 1/s -j LOG --log-level debug --log-prefix 'INPUT DROP:'
iptables -A INPUT -j DROP
iptables -A FORWARD -m limit --limit 1/s -j LOG --log-level debug --log-prefix 'FORWARD DROP:'
iptables -A FORWARD -j DROP

/etc/rc.d/init.d/iptables save

/etc/rc.d/init.d/iptables start


[root@ns1 ~]# sh iptables_setup.sh
[root@ns1 ~]# rm -f iptables_setup.sh

[root@ns1 ~]# chkconfig iptables on
[root@ns1 ~]# chkconfig --list iptables
iptables        0:off   1:off   2:on    3:on    4:on    5:on    6:off

[root@ns1 ~]# vi /etc/sysctl.conf

↓最終行に下記を記入
net.ipv4.tcp_syncookies = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1


[root@ns1 ~]# sysctl -p
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 4294967295
kernel.shmall = 268435456
kernel.exec-shield = 2
net.ipv4.tcp_syncookies = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

ヒント

「net.ipv4.tcp_syncookies = 1」syn flood攻撃防御。
「net.ipv4.icmp_echo_ignore_broadcasts = 1」Smurf攻撃防御。
「net.ipv4.icmp_ignore_bogus_error_responses = 1」ICMPエラー無視。