WEB server
Mad Unix
madunix at gmail.com
Tue Jul 3 05:19:46 UTC 2007
Hi all,
I am hosting a webservices to the public, the webserver got 2x interfaces;
one pointing to my network LAN (10.x.x.x)
and the other one connecting to the DMZ 192.168.10.x of the PIX.
Inside PIX I blocked every protocol except WWW and DNS.
>From inside the LAN I did the following rules to allow outgoing ssh, Oracle
ports, www, ... from the private network.
I want to add more rules via iptableas to _protect_ my internal LAN from the
public packets. i.e
to block any forwarded packets to my internal lan.
Routing table of the web server:
------------------------------------------------
Destination Gateway Genmask Iface
10.5.0.0 0.0.0.0 255.255.0.0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 eth1
192.168.0.0 0.0.0.0 255.255.0.0 eth1
10.0.0.0 10.5.0.1 255.0.0.0 eth0
0.0.0.0 192.168.10.1 0.0.0.0 eth1
IPTABLES
----------------
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT ipv6-crypt-- anywhere anywhere
ACCEPT ipv6-auth-- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:5353
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT all -- anywhere anywhere state
RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW tcp
dpt:http
ACCEPT tcp -- anywhere anywhere state NEW tcp
dpt:https
ACCEPT tcp -- anywhere anywhere state NEW tcp
dpt:ftp
ACCEPT tcp -- anywhere anywhere state NEW tcp
dpt:ssh
ACCEPT tcp -- anywhere anywhere state NEW tcp
dpt:smtp
ACCEPT tcp -- anywhere anywhere state NEW tcp
dpt:1521
REJECT all -- anywhere anywhere reject-with
icmp-host-prohibited
--
madunix
More information about the redhat-list
mailing list