ファイアウォール IPTABLES 設定

ヒント
iptablesとは Linuxに実装されたパケットフィルタリング、ファイアウォール機能です。
IPTABLES実行ディレクトリ作成
[root@centos ~]# mkdir /root/iptables
CKFILTER(中国・韓国を弾く)を使用する場合
[root@centos ~]# vi /root/iptables/ckfilter_setup.sh
↓下記を記入
#!/bin/bash

COUNTRYLIST='CN KR'
wget -q http://ftp.apnic.net/stats/apnic/delegated-apnic-latest
for country in $COUNTRYLIST
do
	for ip in `cat delegated-apnic-latest | grep "apnic|$country|ipv4|"`
	do
		COUNTRY=`echo $ip | awk -F"|" '{ print $2 }'`
		DROP_IP=`echo $ip | awk -F"|" '{ print $4 }'`
		TMPCIDR=`echo $ip | awk -F"|" '{ print $5 }'`

		FLTCIDR=32
		while [ $TMPCIDR -ne 1 ];
		do
			TMPCIDR=$((TMPCIDR/2))
			FLTCIDR=$((FLTCIDR-1))
		done
		echo "$DROP_IP/$FLTCIDR" >> /root/iptables/ckip
	done
done
[root@centos ~]# chmod 700 /root/iptables/ckfilter_setup.sh [root@centos ~]# /root/iptables/ckfilter_setup.sh [root@centos ~]# rm -f /root/iptables/ckfilter_setup.sh
iptables設定
[root@centos ~]# vi /root/iptables/iptables_setup.sh
↓下記を記入
#!/bin/bash

################
### 初期設定 ###
################
LOCALNET=192.168.1.0/24

#####################
### IPTABLES STOP ###
#####################
/etc/rc.d/init.d/iptables stop

####################
### Default Rule ###
####################
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

####################
### LOCAL ACCEPT ###
####################
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -s $LOCALNET -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#####################
### FRAGMENT DROP ###
#####################
iptables -A INPUT -f -j LOG --log-level debug --log-prefix 'FRAGMENT DROP:'
iptables -A INPUT -f -j DROP

####################
### NetBIOS DROP ###
####################
iptables -A INPUT ! -s $LOCALNET -p tcp -m multiport --dports 135,137,138,139,445 -j DROP
iptables -A INPUT ! -s $LOCALNET -p udp -m multiport --dports 135,137,138,139,445 -j DROP
iptables -A OUTPUT ! -d $LOCALNET -p tcp -m multiport --sports 135,137,138,139,445 -j DROP
iptables -A OUTPUT ! -d $LOCALNET -p udp -m multiport --sports 135,137,138,139,445 -j DROP

#####################
### PING OF DEATH ###
#####################
iptables -N PINGOFDEATH
iptables -A PINGOFDEATH -m limit --limit 1/s --limit-burst 4 -j ACCEPT
iptables -A PINGOFDEATH -j LOG --log-level debug --log-prefix 'PINGDEATH DROP:'
iptables -A PINGOFDEATH -j DROP
iptables -A INPUT -p icmp --icmp-type echo-request -j PINGOFDEATH

########################
### BROAD MULTI DROP ###
########################
iptables -A INPUT -d 255.255.255.255 -j DROP
iptables -A INPUT -d 224.0.0.1 -j DROP

################
### 113IDENT ###
################
iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset

###########
### SSH ###
###########
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

############
### HTTP ###
############
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

###########
### SSL ###
###########
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

###########
### FTP ###
###########
iptables -A INPUT -p tcp --sport 20 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 4000:4029 -j ACCEPT

############
### SMTP ###
############
iptables -A INPUT -p tcp --dport 25 -j ACCEPT

#############
### SMTPS ###
#############
iptables -A INPUT -p tcp --dport 465 -j ACCEPT

############
### POP3 ###
############
iptables -A INPUT -p tcp --dport 110 -j ACCEPT

#############
### POP3S ###
#############
iptables -A INPUT -p tcp --dport 995 -j ACCEPT

############
### IMAP ###
############
iptables -A INPUT -p tcp --dport 143 -j ACCEPT

#############
### IMAPS ###
#############
iptables -A INPUT -p tcp --dport 993 -j ACCEPT

################
### CKFILTER ###
################
if [ -e "/root/iptables/ckip" ]; then
	iptables -N CKFILTER
	iptables -A CKFILTER -j DROP

	for ip in `cat /root/iptables/ckip`
	do
		iptables -I INPUT -s $ip -j CKFILTER
	done
fi

###############
### logging ###
###############
iptables -A INPUT -m limit --limit 1/s -j LOG --log-level debug --log-prefix 'INPUT DROP:'
iptables -A INPUT -j DROP
iptables -A FORWARD -m limit --limit 1/s -j LOG --log-level debug --log-prefix 'FORWARD DROP:'
iptables -A FORWARD -j DROP

/etc/rc.d/init.d/iptables save

/etc/rc.d/init.d/iptables start
[root@centos ~]# chmod 700 /root/iptables/iptables_setup.sh [root@centos ~]# /root/iptables/iptables_setup.sh
ヒント
WARNING: Deprecated config file /etc/modprobe.conf, all config files belong into /etc/modprobe.d/. /etc/modprobe.confが存在する場合はこのエラーが出ます。 CentOS6から「/etc/modprobe.conf」は必要なくなり「/etc/modprobe.d/」以下のファイルで設定するようになったので下記のコマンドで削除してください。 rm -f /etc/modprobe.conf
CKFILTERを定期自動アップデートする場合
[root@centos ~]# vi /etc/cron.daily/ckfilter_update.sh
↓下記を記入
#!/bin/bash

COUNTRYLIST='CN KR'
wget -q -N http://ftp.apnic.net/stats/apnic/delegated-apnic-latest
switch=0
for country in $COUNTRYLIST
do
	for ip in `cat delegated-apnic-latest | grep "apnic|$country|ipv4|"`
	do
		COUNTRY=`echo $ip | awk -F"|" '{ print $2 }'`
		DROP_IP=`echo $ip | awk -F"|" '{ print $4 }'`
		TMPCIDR=`echo $ip | awk -F"|" '{ print $5 }'`

		FLTCIDR=32
		while [ $TMPCIDR -ne 1 ];
		do
			TMPCIDR=$((TMPCIDR/2))
			FLTCIDR=$((FLTCIDR-1))
		done
		echo "$DROP_IP/$FLTCIDR" >> /root/iptables/ckip_new
	done
done

diff /root/iptables/ckip /root/iptables/ckip_new > /dev/null 2>&1

if [ $? -ne 0 ]; then
	mv /root/iptables/ckip_new /root/iptables/ckip
	/root/iptables/iptables_setup.sh > /dev/null
else
	rm -f /root/iptables/ckip_new
fi
[root@centos ~]# chmod +x /etc/cron.daily/ckfilter_update.sh
iptables起動設定
[root@centos ~]# chkconfig iptables on
[root@centos ~]# chkconfig --list iptables
iptables        0:off   1:off   2:on    3:on    4:on    5:on    6:off
DoS攻撃防御
[root@centos ~]# vi /etc/sysctl.conf
↓最終行に下記を記入
net.ipv4.tcp_syncookies = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
[root@centos ~]# sysctl -p net.ipv4.ip_forward = 0 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.default.accept_source_route = 0 kernel.sysrq = 0 kernel.core_uses_pid = 1 net.ipv4.tcp_syncookies = 1 kernel.msgmnb = 65536 kernel.msgmax = 65536 kernel.shmmax = 4294967295 kernel.shmall = 268435456 kernel.exec-shield = 2 net.ipv4.tcp_syncookies = 1 net.ipv4.icmp_echo_ignore_broadcasts = 1 net.ipv4.icmp_ignore_bogus_error_responses = 1
ヒント
「net.ipv4.tcp_syncookies = 1」syn flood攻撃防御。 「net.ipv4.icmp_echo_ignore_broadcasts = 1」Smurf攻撃防御。 「net.ipv4.icmp_ignore_bogus_error_responses = 1」ICMPエラー無視。
Home PageTop