Local: Firewalling |
Like I detected in the past, many Linux firewalls (also commercial ones)
do not use all capabilities of the kernel for protection.
Most of the security problems are caused by 2 common rules (others
seen on using proxies in reverse manner because of missing access control,
see here for how to prevent against
such misusage):
You can easily protect a Linux firewall against such attacks if you're
using internal Linux kernel settings. Perhaps you already know about port
ranges which are used for outgoing or masqueraded connections. If not,
see following table:
Type of connection | Used source port range | General control of this range |
---|---|---|
Outgoing from firewall with r- or ssh-clients
running this applications with SUID bit set or as root |
512-1023 | By definition, cannot be changed |
Outgoing from firewall (normal) | 1024-4999 | net/ipv4/tcp_ipv4.c (kernel source)
or /proc/sys/net/ipv4/ip_local_port_range (on-the-fly) |
Outgoing from firewall (recommended) | 32768-60999 | /proc/sys/net/ipv4/ip_local_port_range (changed) |
Outgoing masqueraded by firewall | 61000-65095 | include/net/ip_masq (kernel source) |
With this knowledge, it's more easy to define a port range of a static port filter rule to prevent unwanted possible connections.
If you want to see what kernel switches and lists are used in which state, take a look at my ipchains image (thanks to Rusty Russel for reviewing!).
# DNS -> Internet (UDP) + answer ipchains -A output -i ppp0 -p udp --sport 32768:60999 --dport 53 -j ACCEPT ipchains -A input -i ppp0 -p udp --sport 53 --dport 32768:60999 -j ACCEPT
# DNS -> Internet (TCP) + answer ipchains -A output -i ppp0 -p tcp --sport 32768:60999 --dport 53 -j ACCEPT ipchains -A input -i ppp0 -p tcp --sport 53 --dport 32768:60999 ! -y -j ACCEPT
# Masqueraded DNS from interal -> Internet (UDP) + answer ipchains -A input -i eth0 -p udp --sport 1024: --dport 53 -j ACCEPT ipchains -A forward-i ppp0 -p udp --sport 1024: --dport 53 -j MASQ ipchains -A output -i ppp0 -p udp --sport 61000:65095 --dport 53 -j ACCEPT
ipchains -A input -i ppp0 -p udp --sport 53 --dport 61000:65095 -j ACCEPT ipchains -A output -i eth0 -p udp --sport 53 --dport 1024: -j ACCEPT
Your connection is via:
IPv4
Your address: 18.97.14.89 |
www.bieringer.de is maintained by webmaster at bieringer dot de (Impressum) |
![]() |
![]() |