<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=iso-8859-1">
<TITLE>Re: [luau] Re: IPCHAINS Help</TITLE>
<META NAME="GENERATOR" CONTENT="StarOffice/5.2 (Linux)">
<META NAME="CREATED" CONTENT="20011016;20445000">
<META NAME="CHANGEDBY" CONTENT="Ben Beeson">
<META NAME="CHANGED" CONTENT="20011016;22034000">
</HEAD>
<BODY>
<P>Dusty, Brian and Warren,</P>
<P> Here is what I did to my firewall rules. So far so good... Any
comments would be appreciated.</P>
<P><BR><BR>
</P>
<P><FONT COLOR="#0000ff">#DNS Original Firewall Rules</FONT></P>
<P><FONT COLOR="#0000ff">#$IPCHAINS -A input -p tcp -s $REMOTENET -d
$OUTERNET 53 -j ACCEPT</FONT></P>
<P><FONT COLOR="#0000ff">#$IPCHAINS -A input -p udp -s $REMOTENET -d
$OUTERNET 53 -j ACCEPT</FONT></P>
<P><FONT COLOR="#0000ff">#</FONT></P>
<P><FONT COLOR="#0000ff">### Modified 16 Oct 2001 by Ben after
suggestions from "dusty@sandust.com"</FONT></P>
<P><FONT COLOR="#0000ff"># Warren Togami, and Brian Russo</FONT></P>
<P><FONT COLOR="#0000ff"># Some of the LUAU Kahuna...</FONT></P>
<P><FONT COLOR="#0000ff">#</FONT></P>
<P><FONT COLOR="#0000ff"># Goal is to block incoming DNS queries, but
allow outgoing queries. </FONT>
</P>
<P><FONT COLOR="#0000ff"># This means incoming SYN is blocked, but
outgoing SYN is not, and </FONT>
</P>
<P><FONT COLOR="#0000ff"># incoming ACK is not.</FONT></P>
<P><FONT COLOR="#0000ff"># </FONT>
</P>
<P><FONT COLOR="#0000ff"># Allow my ISP nameserver IP in...Put these in
front of REJECT rules</FONT></P>
<P><FONT COLOR="#0000ff"># so they work and allow it in before the
REJECT rule kicks in and bounces it...</FONT></P>
<P><FONT COLOR="#0000ff">#</FONT></P>
<P><FONT COLOR="#0000ff"># Here is a kludge that searches the
/etc/resolv.conf file for the lines</FONT></P>
<P><FONT COLOR="#0000ff"># that contain the "nameserver"
entries. The kludge is that for my</FONT></P>
<P><FONT COLOR="#0000ff"># particular file, the nameserver entries are
lines 2 and 3. From here,</FONT></P>
<P><FONT COLOR="#0000ff"># extract the values and assign them to the
$NAMESERVER_IP1 or 2 variables.</FONT></P>
<P><FONT COLOR="#0000ff"># </FONT>
</P>
<P><FONT COLOR="#0000ff">NAMESERVER_IP1=`egrep -n nameserver
/etc/resolv.conf | grep 2: - |gawk -F" " '{print $2}'`</FONT></P>
<P><FONT COLOR="#0000ff">echo "NAMESERVER_IP1 is $NAMESERVER_IP1"</FONT></P>
<P><FONT COLOR="#0000ff">NAMESERVER_IP2=`egrep -n nameserver
/etc/resolv.conf | grep 3: - |gawk -F" " '{print $2}'`</FONT></P>
<P><FONT COLOR="#0000ff">echo "NAMESERVER_IP2 is $NAMESERVER_IP2"</FONT></P>
<P><FONT COLOR="#0000ff">#</FONT></P>
<P><FONT COLOR="#0000ff">#</FONT></P>
<P><FONT COLOR="#0000ff">$IPCHAINS -A input -p udp -s $NAMESERVER_IP1
-d $OUTERNET 53 -j ACCEPT</FONT></P>
<P><FONT COLOR="#0000ff">$IPCHAINS -A input -p udp -s $NAMESERVER_IP2
-d $OUTERNET 53 -j ACCEPT</FONT></P>
<P><FONT COLOR="#0000ff">#</FONT></P>
<P><FONT COLOR="#0000ff"># DNS REJECT/DENY rules can go here....</FONT></P>
<P><FONT COLOR="#0000ff"># REJECT input udp from everywhere else...</FONT></P>
<P><FONT COLOR="#0000ff">$IPCHAINS -A input -p udp -s $REMOTENET -d
$OUTERNET 53 -j REJECT</FONT></P>
<P><FONT COLOR="#0000ff"># Now allow outgoing requests...</FONT></P>
<P><FONT COLOR="#0000ff">$IPCHAINS -A output -p udp -s $REMOTENET -d
$OUTERNET 53 -j ACCEPT</FONT></P>
<P><FONT COLOR="#0000ff">#</FONT></P>
<P><FONT COLOR="#0000ff">### End DNS rules changed on 16 Oct </FONT>
</P>
<P><BR><BR>
</P>
<P>Thanks again for your help,</P>
<P><BR><BR>
</P>
<P>Ben
</P>
<P><BR><BR>
</P>
<HR>
<P STYLE="margin-bottom: 0in">Original Message dated 10/16/01, 8:55:56
PM</P>
<P STYLE="margin-bottom: 0in">Author: Ben Beeson
<beesond001@hawaii.rr.com></P>
<P STYLE="margin-bottom: 0in">Re: [luau] Re: IPCHAINS Help:</P>
<HR>
<P><BR><BR>
</P>
<P>Dusty, Brian and Warren,</P>
<P>Thanks for your help. The answer to Warren's question is that I am
seeing a few more port scans on port 53 from the far flung regions of
the world than I want to see. These appear to be coming from places
like Kazakhstan, Beijing, Chekoslovakia etc. Not places where a note to
a sysadmin is likely to have too much effect. So far, my firewall and
portsentry have done well, but I thought I'd try and tighten things
down a bit just in case. I didn't want to "break" anything
that already works in the process though, so I came to the best answer
place I could find, and you guys helped tremendously.
</P>
<P>Right now, I just want to tighten up my box a bit, but these
questions are going to help me with my router in the near future, so
hopefully my home LAN that I am building stay just that --- You are
currently subscribed to luau as: beesond001@hawaii.rr.com To
unsubscribe send a blank email to $subst('Email.Unsub') --
mine ;-))</P>
<P>I'll tinker around a bit over the next few days and let you guys
know how it worked out.
</P>
<P><BR><BR>
</P>
<P>Thanks again,</P>
<P>Ben
</P>
<P><BR><BR>
</P>
</BODY>
</HTML>