IPTABLES

iptables with Network Card Aliases

At some point you may be interested in building a firewall for your dedicated server that you lease from a hosting company.  Once you do that you will be faced with trying to work with the assigned IP Addresses to the server.  Typically hosting companies will assign a subnet and use aliases for the one Ethernet card that is used on the server.  It will look something like what you see in the image below.  The problem is, iptables will not recognize aliases for the Ethernet card.

Here is an example subnet for building the firewall.
IP Usable Range 192.168.0.1-6
Gateway 192.168.0.1
Subnet Mask 255.255.255.248
subnet ID 192.168.0.0
Broadcast 192.168.0.7
The main thing to remember with your firewall is that you only have one Lan Interface, eth0 and so you cannot reference eth0:0 because iptables will not recognize it.  All IP Addresses are on eth0 in reality and that is how iptables will see it.
You will need to enter all of the IP Addresses.  Here you can see each IP is assigned a variable so you can use it later in the script.
LAN_IP=”192.168.0.2″
LAN_IP1=”192.168.0.3″
LAN_IP2=”192.168.0.4″
LAN_IP3=”192.168.0.5″
LAN_IP4=”192.168.0.6″
This section shows you that you can now manage each of the IP Addresses separately.  So for example, you can allow port 80 connections on four IP Addresses but not on the last.
# Web Services
iptables -A INPUT -p tcp –destination $LAN_IP –dport 80 -j ACCEPT
iptables -A INPUT -p tcp –destination $LAN_IP1 –dport 80 -j ACCEPT
iptables -A INPUT -p tcp –destination $LAN_IP2 –dport 80 -j ACCEPT
iptables -A INPUT -p tcp –destination $LAN_IP3 –dport 80 -j ACCEPT
iptables -A INPUT -p tcp –destination $LAN_IP4 –dport 80 -j DROP
#!/bin/bash
# This script comes with no warranty …use at own risk
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program or from the site that you downloaded it
# from; if not, write to the Free Software Foundation, Inc., 59 Temple
# Place, Suite 330, Boston, MA  02111-1307   USA
########################################
LAN_INTERFACE=”eth0″
LOOPBACK_INTERFACE=”lo”
########################################
# Enter Your LAN IP Address            #
########################################
LAN_IP=”192.168.0.2″
LAN_IP1=”192.168.0.3″
LAN_IP2=”192.168.0.4″
LAN_IP3=”192.168.0.5″
LAN_IP4=”192.168.0.6″
########################################
# Enter LAN Subnet                     #
########################################
LAN_ADDRESSES=”192.168.0.0/29″
LAN_NET=”192.168.0.0/255.255.255.248″
########################################
# Enter Broadcast Address              #
########################################
LAN_BROADCAST=”192.168.0.7″
########################################
# Enter Your Netmask                   #
########################################
LAN_NETMASK=”255.255.255.248″
########################################
# Enter Your DNS Server                #
########################################
NAMESERVER=”192.168.0.200″
LOOPBACK=”127.0.0.0/8″
CLASS_A=”10.0.0.0/8″
CLASS_B=”172.16.0.0/12″
CLASS_C=”192.168.0.0/16″
CLASS_D_MULTICAST=”224.0.0/4″
CLASS_E_RESERVED_NET=”240.0.0/5″
BROADCAST_SRC=”0.0.0.0″
BROADCAST_DEST=”255.255.255.255″
#############################################
# Enter the IP Address of the Administrator #
# The only IP to Access the Hardware Node   #
#############################################
ADMIN=”192.168.0.10″
#############################################
# Special Temporary Access Site             #
#############################################
SPECIAL=”192.168.0.11″
#############################################
# Disable source routed packets
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
echo 0 > $f
done
# Disable ICMP Redirect Acceptance
for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
echo 0 > $f
done
# Don’t send redirect messages
for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
echo 0 > $f
done
#Drop spoofed packets
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $f
done
##################################################
# remove existing rules
iptables –flush
iptables -t mangle –flush
# Unlimited traffic on the loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Set default policy to Drop
iptables –policy INPUT DROP
iptables –policy OUTPUT DROP
# Remove pre-existent chains
iptables –delete-chain
###################################################
# DNS to SERVER                                   #
###################################################
iptables -A INPUT -p udp –sport 53 -j ACCEPT
iptables -A OUTPUT -p udp -j ACCEPT
##################################################
# Stealth Scans and TCP State Flags              #
##################################################
# All bits cleared
iptables -A INPUT -p tcp –tcp-flags ALL NONE -j DROP
# SYN and FIN are both set
iptables -A INPUT -p tcp –tcp-flags SYN,FIN SYN,FIN -j DROP
# SY and RSY set
iptables -A INPUT -p tcp –tcp-flags SYN,RST SYN,RST -j DROP
# FIN and RST set
iptables -A INPUT -p tcp –tcp-flags FIN,RST FIN,RST -j DROP
# FIN is inly bit set, without ACK
iptables -A INPUT -p tcp –tcp-flags ACK,FIN FIN -j DROP
# PSH isn only bit set, without ACK
iptables -A INPUT -p tcp –tcp-flags ACK,PSH PSH -j DROP
# URG is only bit without ACK
iptables -A INPUT -p tcp –tcp-flags ACK,URG URG -j DROP
#######################################################
# Connection State to By-Pass Rule Checking
iptables -I INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
iptables -I OUTPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
#####################################################
# SSH ACCESS TO SERVER                               #
######################################################
iptables -A INPUT -p tcp -s $ADMIN –dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp –destination $ADMIN -j ACCEPT
iptables -A INPUT -p tcp -s $SPECIAL –dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp –destination $SPECIAL -j ACCEPT
######################################################
# Web Services
iptables -A INPUT -p tcp –destination $LAN_IP –dport 80 -j ACCEPT
iptables -A INPUT -p tcp –destination $LAN_IP1 –dport 80 -j ACCEPT
iptables -A INPUT -p tcp –destination $LAN_IP2 –dport 80 -j ACCEPT
iptables -A INPUT -p tcp –destination $LAN_IP3 –dport 80 -j ACCEPT
iptables -A INPUT -p tcp –destination $LAN_IP4 –dport 80 -j DROP
#########################################################
#Source Address Spoofing/Bad Addresses
# Refuse spoofed packets
iptables -A INPUT -s $LAN_IP -j DROP
iptables -A INPUT -s $LAN_IP1 -j DROP
iptables -A INPUT -s $LAN_IP2 -j DROP
iptables -A INPUT -s $LAN_IP3 -j DROP
iptables -A INPUT -s $LAN_IP4 -j DROP
iptables -A OUTPUT -o $LAN_INTERFACE -s ! $LAN_IP -j DROP
iptables -A OUTPUT -o $LAN_INTERFACE -s ! $LAN_IP1 -j DROP
iptables -A OUTPUT -o $LAN_INTERFACE -s ! $LAN_IP2 -j DROP
iptables -A OUTPUT -o $LAN_INTERFACE -s ! $LAN_IP3 -j DROP
iptables -A OUTPUT -o $LAN_INTERFACE -s ! $LAN_IP4 -j DROP
# Refuse malformed broadcast packets
iptables -A INPUT -i $LAN_INTERFACE -d $BROADCAST_SRC -j DROP
# Don’t forward limited broadcast either way
iptables -A INPUT -p ! udp -d $CLASS_D_MULTICAST -j DROP
#########################################################
# ICMP control and status messages
# Log and drop initial ICMP fragments
iptables -A INPUT –fragment -p icmp -j LOG –log-prefix “Fragmented incoming ICMP: ”
iptables -A INPUT –fragment -p icmp -j DROP
iptables -A OUTPUT –fragment -p icmp -j LOG –log-prefix “Fragmented outgoing ICMP: ”
iptables -A OUTPUT –fragment -p icmp -j DROP
iptables -A INPUT  -p icmp –icmp-type source-quench -d $LAN_IP -j ACCEPT
iptables -A INPUT  -p icmp –icmp-type source-quench -d $LAN_IP1 -j ACCEPT
iptables -A INPUT  -p icmp –icmp-type source-quench -d $LAN_IP2 -j ACCEPT
iptables -A INPUT  -p icmp –icmp-type source-quench -d $LAN_IP3 -j ACCEPT
iptables -A INPUT  -p icmp –icmp-type source-quench -d $LAN_IP4 -j ACCEPT
iptables -A OUTPUT -p icmp –icmp-type source-quench -j ACCEPT
iptables -A INPUT -p icmp –icmp-type parameter-problem -j ACCEPT
iptables -A OUTPUT -p icmp –icmp-type parameter-problem -j ACCEPT
iptables -A INPUT -p icmp –icmp-type destination-unreachable -j ACCEPT
iptables -A OUTPUT -o $LAN_INTERFACE -p icmp –icmp-type destination-unreachable -d $LAN_ADDRESSES -j ACCEPT
iptables -A OUTPUT -p icmp –icmp-type fragmentation-needed -j ACCEPT
# Don’t Log outgoing ICMP error messages
iptables -A OUTPUT -p icmp –icmp-type destination-unreachable -j DROP
#################################################
# LOGS                                          #
#################################################
iptables -A INPUT -i $LAN_INTERFACE -j LOG
iptables -A OUTPUT -j LOG
exit 0

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

In this example of a simple setup of a bridge firewall you see how a bridge can protect a server. The router of course, has both an external IP Address to the Internet and an internal address to the the 192.168.7.0/24 network. This means that the router is doing NAT, Network Address Translation.  The bridge is given an IP Address to be able to configure remotely. Note that the two network interfaces do not have IP Addresses. If you look using ifconfig all you will see are MAC Addresses. However you will see that the bridge br0 will have the IP Address 192.168.7.3. A switch is placed between the bridge and the mail server to act as an additional layer of security. This would be especially true if you added workstations or additional servers to that switch. Lesson 3 / Lesson 5 In order to  set this up create a file called rc.firewall and place it in the /etc directory.  Make it executable with: chmod 755 /etc/rc.firewall Here is a sample script, modify and use at your own risk. ############################################### #!/bin/bash # This script comes with no warranty ...use at own risk # Copyright (C) 2006  Mike Weber # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; version 2 of the License. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program or from the site that you downloaded it # from; if not, write to the Free Software Foundation, Inc., 59 Temple # Place, Suite 330, Boston, MA  02111-1307   USA ########################################### br0="192.168.7.3" GATEWAY_IP="192.168.7.2" LAN_NET="192.168.7.0/255.255.255.0" LAN_BROADCAST="192.168.7.255" CLASS_A="10.0.0.0/8" CLASS_B="172.16.0.0/12" CLASS_C="192.168.0.0/16" CLASS_D_MULTICAST="224.0.0/4" CLASS_E_RESERVED_NET="240.0.0/4" BROADCAST_SRC="O.O.O.0" BROADCAST_DEST="255.255.255.255" WEB="192.168.7.120" WEB2="192.168.7.122" WEB3="192.168.7.126" MAIL="192.168.7.123" ADMIN="192.168.7.119" ########################################### # Add protection from the kernel echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $f done for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $f done for f in /proc/sys/net/ipv4/conf/*/send_redirects; do echo 0 > $f done for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f done for f in /proc/sys/net/ipv4/conf/*/log_martians; do echo 1 > $f done ########################################### # Remove existing rules iptables --flush iptables -t nat --flush iptables -t mangle --flush # Unlimited loopback traffic iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Set Policies to drop iptables --policy INPUT DROP iptables --policy OUTPUT DROP iptables --policy FORWARD DROP # Remove pre-existing user defined iptables --delete-chain iptables -t nat --delete-chain iptables -t mangle --delete-chain ############################################# # Stop Stealth Scans and TCP State Flags iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP iptables -A FORWARD -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j DROP iptables -A FORWARD -p tcp --tcp-flags FIN,RST FIN,RST -j DROP iptables -A FORWARD -p tcp --tcp-flags ACK,FIN FIN -j DROP iptables -A FORWARD -p tcp --tcp-flags ACK,PSH PSH -j DROP iptables -A FORWARD -p tcp --tcp-flags ACK,URG URG -j DROP ############################################ # Connection State to By-Pass Rule Checking iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -m state --state INVALID -j DROP iptables -A OUTPUT -m state --state INVALID -j DROP iptables -A FORWARD -m state --state INVALID -j DROP ##################################################### # SPECIAL iptables -A INPUT -p tcp -s $ADMIN -m state --state NEW --dport 22 -j ACCEPT iptables -A INPUT -p tcp -s $ADMIN  --dport 22 -j ACCEPT ##################################################### #  No Matter What I Want to Block These Ports iptables -A FORWARD -p tcp --dport 4444 -j DROP iptables -A FORWARD -p tcp --dport 135 -j DROP # Don't forward limited broadcast either way iptables -A FORWARD -d $BROADCAST_DEST -j DROP iptables -A FORWARD -p ! udp -d $CLASS_D_MULTICAST -j DROP ######################################################### # ICMP control and status messages # Log and drop initial ICMP fragments iptables -A INPUT --fragment -p icmp -j DROP iptables -A OUTPUT --fragment -p icmp -j DROP iptables -A FORWARD --fragment -p icmp -j DROP # Flow Control - Mostly Used on LANs iptables -A FORWARD -p icmp --icmp-type source-quench -j ACCEPT # Unexpected Data in Header or Checksum Error iptables -A FORWARD -p icmp --icmp-type parameter-problem -j ACCEPT # STOP NMAP SCANS iptables -A FORWARD -p icmp --icmp-type destination-unreachable -j DROP # Disable Traceroute iptables -A FORWARD -p icmp --icmp-type time-exceeded -j DROP # Disable Ping iptables -I FORWARD -p icmp --icmp-type echo-request -j DROP # Block DHCP Port 68 iptables -A FORWARD -p tcp --dport 68 -j DROP iptables -A FORWARD -p tcp --dport 1434 -j DROP ############################################# # BLOCK COUNTRY ATTACKS BADIP=/etc/banned BANNED=$( grep -v -E "^#" $BADIP ) for ip in $BANNED do iptables -A INPUT -p tcp -s $ip -j DROP iptables -A FORWARD -p tcp -s $ip -j DROP done ############################################## # MAIL Web iptables -A FORWARD -p tcp -d $MAIL --dport 80 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --src $MAIL -m state --state NEW -j ACCEPT # WEB Web iptables -A FORWARD -p tcp -d $WEB --dport 80 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --src $WEB -m state --state NEW -j ACCEPT # WEB Web iptables -A FORWARD -p tcp -d $WEB --dport 80 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --src $WEB -m state --state NEW -j ACCEPT # WEB3 Web iptables -A FORWARD -p tcp -d $WEB3 --dport 80 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --src $WEB3 -m state --state NEW -j ACCEPT # WEB2 WEB iptables -A FORWARD -p tcp -d $WEB2 --dport 80 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --src $WEB2 -m state --state NEW -j ACCEPT # ADMIN Web iptables -A FORWARD -p tcp --src $ADMIN -m state --state NEW -j ACCEPT iptables -A FORWARD -p udp --src $ADMIN -m state --state NEW -j ACCEPT ############################################### # MAIL DNS includes settings for Client and Zone Transfers iptables -A FORWARD -p udp --sport 1024:65535 -d $MAIL --dport 53 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --sport 53 -d $MAIL --dport 1024:65535 -m state --state NEW -j ACCEPT iptables -A FORWARD -p udp --sport 53 -d $MAIL --dport 53 -m state --state NEW -j ACCEPT iptables -A FORWARD -p udp --src $MAIL --sport 1024:65535 --dport 53 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --src $MAIL --sport 1024:65535 --dport 53 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --src $MAIL --sport 53 --dport 1024:65535 -m state --state NEW -j ACCEPT iptables -A FORWARD -p udp --src $MAIL --sport 53 --dport 53 -m state --state NEW -j ACCEPT ################################## # MAIL SERVER AND CLIENTS FOR POP3 AND IMAP # MAIL MAIL SERVER SMTP iptables -A FORWARD -p tcp --sport 25 -d $MAIL --dport 1024:65535 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --src $MAIL --sport 1024:65535 --dport 25 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --sport 1024:65535 -d $MAIL --dport 25 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --src $MAIL --sport 25 --dport 1024:65535 -m state --state NEW -j ACCEPT # POP3 iptables -A FORWARD -p tcp --src $MAIL --sport 1024:65535 --dport 110 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --sport 110 -d $MAIL --dport 1024:65535 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --sport 1024:65535 -d $MAIL --dport 110 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --src $MAIL --sport 110 --dport 1024:65535 -m state --state NEW -j ACCEPT # IMAPS iptables -A FORWARD -p tcp --sport 1024:65535 -d $MAIL --dport 993 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --sport 1024:65535 -d $MAIL --dport 993 -j ACCEPT iptables -A FORWARD -p tcp ! --syn -s $MAIL --sport 993 --dport 1024:65535 -j ACCEPT # IMAP iptables -A FORWARD -p tcp --src $MAIL --sport 1024:65535 --dport 143 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --sport 143 -d $MAIL --dport 1024:65535 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --sport 1024:65535 -d $MAIL --dport 143 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp --src $MAIL --sport 143 --dport 1024:65535 -m state --state NEW -j ACCEPT ################################## # LOGS iptables -A FORWARD -j LOG iptables -A OUTPUT -j LOG iptables -A INPUT -j LOG ########################################## exit 0