To turn IPTABLES on every boot automaticaly:
/sbin/chkconfig iptables on
To check status IPTABLES: iptables -L
To delete all parameters in IPTABLES: iptables -D
# Drop ICMP echo-request messages sent to broadcast or multicast addresses
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Drop source routed packets
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
# Enable TCP SYN cookie protection from SYN floods
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
# Reject ICMP redirect messages, system will not reply when get ping
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
# Reject ICMP redirect messages
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
# Enable source address spoofing protection, any package that pretend from internal network will be rejected
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
# Log packets with impossible source addresses
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
Opening port for some common service, edit file /etc/sysconfig/iptables:
HTTP web, standard port 80 TCP:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
HTTPS secure web, standard port 143 TCP:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 143 -j ACCEPT
SMTP email outgoing/send, standard port 25 TCP:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
POP3 email incoming/receive, standard port 110 TCP:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 110 -j ACCEPT
DNS service, standard port 53 UDP:
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT
NAT (Network Address Trslation):
-t nat -A POSTROUTING -o eth0 -j MASQUERADE //eth0 is outer ethernet that facing Internet
-A FORWARD -i eth1 -j ACCEPT //eth1 is inner ethernet that facing LAN
Don't forget to reload IPTABLES after make changes:
/etc/init.d/iptables restart
In Red Hat and its derivatives, you may use command: system-config-securitylevel to setting common service HTTP, HTTPS, SMTP and FTP with standard port. To set manualy: vi /etc/sysconfig/iptables, please be careful, don't change any value unless you know what you are doing! Ah no :), you are on VirtualBox, right? Explore it to what ever you like.
IPTABLES is installed by default by most GNU/Linux distribution for Firewall system.
 |
| Example setting Firewall in CentOS |
Further reading: www.iptables.org
Useful tools to configure IPTABLES: www.shorewall.net
Fill comment box below, don't be shy :)