more help with ipchains

["I'm a Swinger" <imaswinger () hotmail com>]

Thank you very much to all that helped me out with suggestions!
I'm still not on the list, but I did search through the archives to get your 
responses.
It is very much appreciated as I know my questions are quite 'beneath you', 
but I did read the HOWTO and other documents, but had trouble understanding 
them.
Here is what I have come up with after taking into account people's 
suggestions.
Extra thanx to warchild (I think?) for most of the entries here...
Keep in mind this is a stand-alone Linux server with no network behind it 
that is just hosting DNS and WWW.

my comments/questions are typed in ever-so-unannoying ALL-CAPS.

So does this look good enough to go live?

Very many thanx for all the help!

Curtis

# deny incoming packets, allow SYN requests and sessions, allow local host
# ** DO I NEED LOCALHOST SESSIONS IF IT'S JUST THE ONE MACHINE? **
$IPCHAINS -P input DENY
$IPCHAINS -A input -p TCP ! -y -j ACCEPT
$IPCHAINS -A input -i lo -j ACCEPT

# define eth cards - (I only have one though)
$IPCHAINS -N public
$IPCHAINS -N internal  # I DON'T THINK I NEED THIS AS IT'S JUST THE ONE 
MACHINE
$IPCHAINS -N icmpchk

# define the public - I ASSUME I DEFINE ICMPCHK THE SAME WAY?
$IPCHAINS -A input -i eth0 -j public


#### standard public rule set ####

# This being your broadcast address on your public ethernet to deny 
broadcasts
$IPCHAINS -A public -d x.x.x.x -j DENY

# Allow Syn requests
$IPCHAINS -A public -p TCP ! -y -j ACCEPT

# This to allow ftp data , which will solve the ftp problem
$IPCHAINS -A public -p TCP --source-port ftp-data -j ACCEPT

# This is to finish the ftp connections to the firewall,
#*** DO I NEED THIS IF I AM NOT OFFERING FTP? ***
$IPCHAINS -A public -p TCP -d x.x.x.x 21:21 -j ACCEPT

# That udp ports that needs to be open on a firewall
# ** I DON'T UNDERSTAND THE /26 ? **
$IPCHAINS -A public -p UDP -s x.x.x.x/26 53:53 --destination-port 1024:65535 
-j ACCEPT

# WWW , DNS , SSH
$IPCHAINS -A public -p TCP -y -d x.x.x.x 53:53 -j ACCEPT
$IPCHAINS -A public -p UDP -y -b x.x.x.x 53:53 -j ACCEPT
$IPCHAINS -A public -p TCP -y -d x.x.x.x 80:80 -j ACCEPT
$IPCHAINS -A public -p TCP -y -d x.x.x.x 22:22 -j ACCEPT


#### Entries taken from my friends ipchains file ####
##
## I don't know if these are things I want or not  ##

# allow forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# set default forward rule to deny
ipchains -P forward DENY

# deny ping response requests
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

# block broadcast icmp (smurf attack)  maybe redundant...
echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# enable ip spoofing protection
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then
      echo
      echo -n "Setting up IP spoofing protection..."
      for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
          echo 1 > $f
          done
      echo "done."
   else
      echo "PROBLEMS SETTING UP IP SPOOFING PROTECTION.  BE WORRIED."
      echo
   fi
_________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://www.nfr.com/mailman/listinfo/firewall-wizards