mirror of
https://github.com/trimstray/iptables-essentials
synced 2024-06-30 18:50:54 +00:00
minor updates
This commit is contained in:
parent
47f71aacd1
commit
dada57b965
169
README.md
169
README.md
@ -28,6 +28,7 @@
|
|||||||
## :ballot_box_with_check: TODO
|
## :ballot_box_with_check: TODO
|
||||||
|
|
||||||
- [ ] Add useful Iptables configuration examples
|
- [ ] Add useful Iptables configuration examples
|
||||||
|
- [x] Add useful Kernel Settings (sysctl) configuration
|
||||||
- [ ] Add links to useful external resources
|
- [ ] Add links to useful external resources
|
||||||
- [ ] Add advanced configuration examples, commands, rules
|
- [ ] Add advanced configuration examples, commands, rules
|
||||||
|
|
||||||
@ -38,6 +39,14 @@
|
|||||||
- [Tools to help you configure Iptables](#tools-to-help-you-configure-iptables)
|
- [Tools to help you configure Iptables](#tools-to-help-you-configure-iptables)
|
||||||
- [Manuals/Howtos/Tutorials](#manualshowtostutorials)
|
- [Manuals/Howtos/Tutorials](#manualshowtostutorials)
|
||||||
- [Useful Kernel Settings (sysctl) configuration](#useful-kernel-settings-sysctl-configuration)
|
- [Useful Kernel Settings (sysctl) configuration](#useful-kernel-settings-sysctl-configuration)
|
||||||
|
* [rp_filter](#rp_filter)
|
||||||
|
* [log_martians](#log_martians)
|
||||||
|
* [send_redirects](#send_redirects)
|
||||||
|
* [accept_source_route](#accept_source_route)
|
||||||
|
* [accept_redirects](#accept_redirects)
|
||||||
|
* [tcp_syncookies](#tcp_syncookies)
|
||||||
|
* [icmp_echo_ignore_broadcasts](#icmp_echo_ignore_broadcasts)
|
||||||
|
* [ip_forward](#ip_forward)
|
||||||
- [How it works?](#how-it-works)
|
- [How it works?](#how-it-works)
|
||||||
- [Iptables Rules](#iptables-rules)
|
- [Iptables Rules](#iptables-rules)
|
||||||
* [Saving Rules](#saving-rules)
|
* [Saving Rules](#saving-rules)
|
||||||
@ -131,70 +140,112 @@
|
|||||||
|
|
||||||
### Useful Kernel Settings (sysctl) Configuration
|
### Useful Kernel Settings (sysctl) Configuration
|
||||||
|
|
||||||
|
##### rp_filter
|
||||||
|
|
||||||
|
> _Disable routing triangulation. Respond to queries out the same interface, not another. Also protects against IP spoofing._
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cat << EOF > /etc/sysctl.d/40-custom.conf
|
cat << EOF >> /etc/sysctl.d/40-custom.conf
|
||||||
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
# Disable routing triangulation. Respond to queries out
|
|
||||||
# the same interface, not another. Helps to maintain state
|
|
||||||
# Also protects against IP spoofing
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
|
|
||||||
net/ipv4/conf/all/rp_filter = 1
|
net/ipv4/conf/all/rp_filter = 1
|
||||||
|
|
||||||
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
# Enable logging of packets with malformed IP addresses
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
|
|
||||||
net/ipv4/conf/all/log_martians = 1
|
|
||||||
|
|
||||||
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
# Disable redirects
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
|
|
||||||
net/ipv4/conf/all/send_redirects = 0
|
|
||||||
|
|
||||||
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
# Disable source routed packets
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
|
|
||||||
net/ipv4/conf/all/accept_source_route = 0
|
|
||||||
|
|
||||||
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
# Disable acceptance of ICMP redirects
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
|
|
||||||
net/ipv4/conf/all/accept_redirects = 0
|
|
||||||
|
|
||||||
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
# Turn on protection from Denial of Service (DOS) attacks
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
|
|
||||||
net/ipv4/tcp_syncookies = 1
|
|
||||||
|
|
||||||
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
# Disable responding to ping broadcasts
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
|
|
||||||
net/ipv4/icmp_echo_ignore_broadcasts = 1
|
|
||||||
|
|
||||||
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
# Enable IP routing. Required if your firewall is protecting a
|
|
||||||
# network, NAT included
|
|
||||||
#---------------------------------------------------------------
|
|
||||||
|
|
||||||
net/ipv4/ip_forward = 1
|
|
||||||
|
|
||||||
EOF
|
EOF
|
||||||
```
|
```
|
||||||
|
|
||||||
|
- [rp_filter and LPIC-3 Linux Security](https://www.theurbanpenguin.com/rp_filter-and-lpic-3-linux-security/)
|
||||||
|
- [Linux kernel rp_filter settings (Reverse path filtering)](https://www.slashroot.in/linux-kernel-rpfilter-settings-reverse-path-filtering)
|
||||||
|
- [Reverse Path Filtering](http://tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.kernel.rpf.html)
|
||||||
|
|
||||||
|
##### log_martians
|
||||||
|
|
||||||
|
> _Enable logging of packets with malformed IP addresses._
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cat << EOF >> /etc/sysctl.d/40-custom.conf
|
||||||
|
net/ipv4/conf/all/log_martians = 1
|
||||||
|
EOF
|
||||||
|
```
|
||||||
|
|
||||||
|
- [What is the usefulness of logging of martians packet?](https://serverfault.com/questions/570980/what-is-the-usefulness-of-logging-of-martians-packet-e-g-net-ipv4-conf-all-lo)
|
||||||
|
|
||||||
|
##### send_redirects
|
||||||
|
|
||||||
|
> _Disables sending of all IPv4 ICMP redirected packets on all interfaces._
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cat << EOF >> /etc/sysctl.d/40-custom.conf
|
||||||
|
net/ipv4/conf/all/send_redirects = 0
|
||||||
|
EOF
|
||||||
|
```
|
||||||
|
|
||||||
|
- [Disable source routing](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-disable-source-routing)
|
||||||
|
- [What are ICMP redirects and should they be blocked?](https://askubuntu.com/questions/118273/what-are-icmp-redirects-and-should-they-be-blocked)
|
||||||
|
|
||||||
|
##### accept_source_route
|
||||||
|
|
||||||
|
> _Disable source routed packets (packets with the Strict Source Route (SSR) or Loose Source Routing (LSR) option set)._
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cat << EOF >> /etc/sysctl.d/40-custom.conf
|
||||||
|
net/ipv4/conf/all/accept_source_route = 0
|
||||||
|
EOF
|
||||||
|
```
|
||||||
|
|
||||||
|
- [Disable source routing](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-disable-source-routing)
|
||||||
|
- [The system must not accept IPv4 source-routed packets by default.](https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2017-12-08/finding/V-38529)
|
||||||
|
|
||||||
|
##### accept_redirects
|
||||||
|
|
||||||
|
> _Disable acceptance of ICMP redirects._
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cat << EOF >> /etc/sysctl.d/40-custom.conf
|
||||||
|
net/ipv4/conf/all/accept_redirects = 0
|
||||||
|
EOF
|
||||||
|
```
|
||||||
|
|
||||||
|
- [What are ICMP redirects and should they be blocked?](https://askubuntu.com/questions/118273/what-are-icmp-redirects-and-should-they-be-blocked)
|
||||||
|
- [The Red Hat Enterprise Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.](https://www.stigviewer.com/stig/red_hat_enterprise_linux_7/2018-11-28/finding/V-73175)
|
||||||
|
|
||||||
|
##### tcp_syncookies
|
||||||
|
|
||||||
|
> _Turn on SYN-flood protections (protection from Denial of Service (DOS) attacks)._
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cat << EOF >> /etc/sysctl.d/40-custom.conf
|
||||||
|
net/ipv4/tcp_syncookies = 1
|
||||||
|
EOF
|
||||||
|
```
|
||||||
|
|
||||||
|
- [Hardening your TCP/IP Stack Against SYN Floods](https://www.ndchost.com/wiki/server-administration/hardening-tcpip-syn-flood)
|
||||||
|
- [Linux: Turn On TCP SYN Cookie Protection](https://www.cyberciti.biz/faq/enable-tcp-syn-cookie-protection/)
|
||||||
|
- [Better alternative for tcp_syncookies in Linux](https://serverfault.com/questions/705504/better-alternative-for-tcp-syncookies-in-linux)
|
||||||
|
|
||||||
|
##### icmp_echo_ignore_broadcasts
|
||||||
|
|
||||||
|
> _Disable responding to ping broadcasts._
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cat << EOF >> /etc/sysctl.d/40-custom.conf
|
||||||
|
net/ipv4/icmp_echo_ignore_broadcasts = 1
|
||||||
|
EOF
|
||||||
|
```
|
||||||
|
|
||||||
|
- [What is ICMP broadcast good for?](https://superuser.com/questions/306065/what-is-icmp-broadcast-good-for)
|
||||||
|
- [The system must not respond to ICMPv4 sent to a broadcast address.](https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2018-11-28/finding/V-38535)
|
||||||
|
|
||||||
|
##### ip_forward
|
||||||
|
|
||||||
|
> _Enable IP routing. Required if your firewall is protecting a network, NAT included._
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cat << EOF >> /etc/sysctl.d/40-custom.conf
|
||||||
|
net/ipv4/ip_forward = 1
|
||||||
|
EOF
|
||||||
|
```
|
||||||
|
|
||||||
|
- [Introduction to routers](http://linux-training.be/security/ch10.html)
|
||||||
|
- [How to Enable IP Forwarding in Linux](http://www.ducea.com/2006/08/01/how-to-enable-ip-forwarding-in-linux/)
|
||||||
|
- [What is kernel ip forwarding?](https://unix.stackexchange.com/questions/14056/what-is-kernel-ip-forwarding)
|
||||||
|
|
||||||
### How it works?
|
### How it works?
|
||||||
|
|
||||||
<p align="center">
|
<p align="center">
|
||||||
|
Loading…
Reference in New Issue
Block a user