Ubuntu/iptables - Revision history

R00t at 16:27, 20 May 2021

2021-05-20T16:27:41Z

R00t at 22:53, 20 January 2017

2017-01-20T22:53:37Z

R00t at 22:23, 29 June 2016

2016-06-29T22:23:26Z

R00t at 07:20, 22 May 2016

2016-05-22T07:20:31Z

R00t: /* CVE-2015-7547 */

2016-02-20T21:44:46Z

‎CVE-2015-7547

R00t at 19:54, 20 February 2016

2016-02-20T19:54:57Z

R00t at 19:54, 20 February 2016

2016-02-20T19:54:22Z

R00t at 07:11, 6 January 2015

2015-01-06T07:11:00Z

R00t at 03:32, 7 October 2014

2014-10-07T03:32:02Z

R00t at 10:13, 22 June 2014

2014-06-22T10:13:46Z

@@ Line 17: / Line 17: @@
 allow connection from specific address, inbound, using only TCP on a specific port
   -A INPUT -s ip.address -p tcp --dport 22 -j ACCEPT
 add a comment to the iptables rule
   -m comment --comment "limit ssh access"

@@ Line 1: / Line 1: @@
 ;iptables
 :allows you to configure network ports and more
 <br\>
 lookup current active rules
@@ Line 24: / Line 25: @@
 delete chain from iptables
   iptables -X chain.name
 save current IP Tables config
   sudo sh -c "iptables-save > /etc/iptables.rules"

@@ Line 56: / Line 56: @@
 	printf "\nRestoring iptable rules ..."
 	iptables-restore < /etc/iptables.rules > /dev/null 2>&1 &
-	printf " restored.\n"
+	printf "\n... restored.\n"
+}
@@ Line 71: / Line 71: @@
 	iptables -P FORWARD ACCEPT
 	iptables -P OUTPUT ACCEPT
-	printf " flushed.\n"
+	printf "\n... flushed.\n"
+}
@@ Line 84: / Line 84: @@
 status_iptables_rules () {
 	iptables -L -n -v
+}
@@ Line 99: / Line 106: @@
 		status_iptables_rules
 		;;
 	*)
-		printf "Usage: /etc/init.d/iptables.rules {start|stop|restart|status}"
+		printf "Usage: /etc/init.d/iptables.rules {start|stop|restart|status|save}"
 		exit 1
 		;;

← Older revision		Revision as of 07:20, 22 May 2016
Line 32:		Line 32:
	attempt to [https://www.sourceware.org/ml/libc-alpha/2016-02/msg00416.html mitigate glibc vuln.]<br>		attempt to [https://www.sourceware.org/ml/libc-alpha/2016-02/msg00416.html mitigate glibc vuln.]<br>
	~$ sudo iptables -A INPUT -p udp -m length --length 512:0xffff --dport 53 -j DROP -m comment --comment "mitigate CVE-2015-7547"		~$ sudo iptables -A INPUT -p udp -m length --length 512:0xffff --dport 53 -j DROP -m comment --comment "mitigate CVE-2015-7547"
		+
		+
		+	==Init.d startup script==
		+	Below is a method designed in hopes of a reliable auto-load of iptable rules on bootup. adding entry to rc.local entry was not 100% reliable.
		+
		+	===Create startup script under /etc/init.d===
		+	<nowiki> ~$ sudo vi /etc/init.d/iptables.rules</nowiki>
		+	====Script====
		+	<nowiki>
		+	#!/bin/sh
		+	### BEGIN INIT INFO
		+	# Provides: iptables.rules
		+	# Required-Start: $remote_fs $syslog
		+	# Required-Stop: $remote_fs $syslog
		+	# Default-Start: 2 3 4 5
		+	# Default-Stop: 0 1 6
		+	# Short-Description: Start iptables.rules at boot time
		+	# Description: Load iptable rules at startup, provide flushing (stop) or flush and reload (restart) of rules.
		+	### END INIT INFO
		+
		+	#startup function
		+	start_iptables_rules() {
		+	printf "\nRestoring iptable rules ..."
		+	iptables-restore < /etc/iptables.rules > /dev/null 2>&1 &
		+	printf " restored.\n"
		+	}
		+
		+	#stopping function that flushes iptables
		+	stop_iptables_rules () {
		+	printf "\nFlushing iptable rules ..."
		+	iptables -F
		+	iptables -X
		+	iptables -t nat -F
		+	iptables -t nat -X
		+	iptables -t mangle -F
		+	iptables -t mangle -X
		+	iptables -P INPUT ACCEPT
		+	iptables -P FORWARD ACCEPT
		+	iptables -P OUTPUT ACCEPT
		+	printf " flushed.\n"
		+	}
		+
		+	#restarting function that stops and starts iptables.rules
		+	restart_iptables_rules () {
		+	printf "\nFlushing and reloading iptable rules ..."
		+	stop_iptables_rules
		+	start_iptables_rules
		+	}
		+
		+	#list iptable rules currently configured
		+	status_iptables_rules () {
		+	iptables -L -n -v
		+	}
		+
		+	case "$1" in
		+	start)
		+	start_iptables_rules
		+	;;
		+	stop)
		+	stop_iptables_rules
		+	;;
		+	restart)
		+	restart_iptables_rules
		+	;;
		+	status)
		+	status_iptables_rules
		+	;;
		+	*)
		+	printf "Usage: /etc/init.d/iptables.rules {start\|stop\|restart\|status}"
		+	exit 1
		+	;;
		+
		+	esac
		+	exit 0
		+	</nowiki>
		+	===Permissions and Boot===
		+	Add permissions to execute
		+	<nowiki>~$ chmod 755 /etc/init.d/iptables.rules</nowiki>
		+	Enable dependency based boot sequence
		+	<nowiki>~$ update-rc.d iptables.rules defaults</nowiki>

@@ Line 31: / Line 31: @@
 ====CVE-2015-7547====
 attempt to [https://www.sourceware.org/ml/libc-alpha/2016-02/msg00416.html mitigate glibc vuln.]<br>
-  ~$ sudo iptables -A INPUT -p udp -m length --length 512:0xffff -j DROP -m comment --comment "mitigate CVE-2015-7547"
+  ~$ sudo iptables -A INPUT -p udp -m length --length 512:0xffff --dport 53 -j DROP -m comment --comment "mitigate CVE-2015-7547"

← Older revision		Revision as of 19:54, 20 February 2016
Line 28:		Line 28:
	restore IP Tables config (also add this line to /etc/rc.local for it to auto run during boot)		restore IP Tables config (also add this line to /etc/rc.local for it to auto run during boot)
	iptables-restore < /etc/iptables.rules		iptables-restore < /etc/iptables.rules
		+
		+	====CVE-2015-7547====
		+	attempt to [ https://www.sourceware.org/ml/libc-alpha/2016-02/msg00416.html mitigate glibc vuln.]<br>
		+	~$ sudo iptables -A INPUT -p udp -m length --length 512:0xffff -j DROP -m comment --comment "mitigate CVE-2015-7547"

@@ Line 4: / Line 4: @@
 lookup current active rules
   iptables -L -n -v
-remove a rule from IP Tables
+remove a rule from IP Tables.  Make sure to include the comment if a comment exists.
   iptables -D INPUT 1
   or
   iptables -D INPUT -s 0.0.0.0/0 -p tcp --dport 22 -j ACCEPT
 specify policy default
   -P INPUT DROP

@@ Line 14: / Line 14: @@
 allow connection from specific address, inbound, using only TCP on a specific port
   -A INPUT -s ip.address -p tcp --dport 22 -j ACCEPT
 allow related and established
   -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT