{"id":546,"date":"2006-02-01T18:39:02","date_gmt":"2006-02-01T16:39:02","guid":{"rendered":"http:\/\/www.marblestation.com\/blog\/?p=546"},"modified":"2012-04-26T17:20:58","modified_gmt":"2012-04-26T15:20:58","slug":"firewall-iptables-en-10-minuts","status":"publish","type":"post","link":"https:\/\/www.marblestation.com\/?p=546","title":{"rendered":"Firewall iptables en 10 minuts"},"content":{"rendered":"

Per compartir Internet i protegir el nostre equip utilitzarem el firewall “iptables” del kernel de Linux. <\/p>\n


\n
\n<\/center><\/p>\n

Per comen\u00e7ar ens assegurem que no hi ha cap regla definida al firewall fent neteja de les 3 taules principals que disposa: filter (per defecte), nat (consultada quan un paquet crea una nova connexi\u00f3) i mangle (especifica per alteraci\u00f3 de paquets).<\/p>\n

\r\niptables -t filter -F\r\niptables -t nat -F\r\niptables -t mangle -F\r\n<\/pre>\n
Establim una pol\u00edtica per defecte, la qual pot ser REJECT, DROP (descarta paquet sense avisar l’altre extrem) o ACCEPT:
\n<\/p>\n
\r\n# Politica general\r\niptables -t filter -P INPUT DROP\r\niptables -t filter -P OUTPUT DROP\r\niptables -t filter -P FORWARD DROP\r\n\r\n# Politica de las cadenas extendidas\r\niptables -t mangle -P INPUT ACCEPT\r\niptables -t mangle -P OUTPUT ACCEPT\r\niptables -t mangle -P PREROUTING ACCEPT\r\niptables -t mangle -P POSTROUTING ACCEPT\r\n\r\niptables -t nat -P OUTPUT ACCEPT\r\niptables -t nat -P PREROUTING ACCEPT\r\niptables -t nat -P POSTROUTING ACCEPT\r\n<\/pre>\n
En aquest cas descartem els paquets que arribin a la cadena INPUT, OUTPUT i FORWARD.<\/p>\n
Per compartir la connexi\u00f3, en primer lloc haurem d’activar el forward de trafic:<\/p>\n
\r\necho 1 > \/proc\/sys\/net\/ipv4\/ip_forward\r\n<\/pre>\n
I a continuaci\u00f3 activem NAT per l’interficie “eth0”:<\/p>\n
\r\n# Habilito el NAT\r\niptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE\r\n<\/pre>\n
Amb aquests 2 \u00faltims sentencies ja hem compartit l’acc\u00e9s a Internet (es poden obviar si no es desitja activar la compartici\u00f3).<\/p>\n
En general, \u00e9s recomanable permetre el trafic ICMP:<\/p>\n
\r\n# Dejo pasar los paquetes ICMP\r\niptables -t filter -A INPUT -i eth0 -p ICMP -j ACCEPT\r\n<\/pre>\n
Si volem, com que per defecte descartem tots els paquets, ara es el moment a on podem obrir ports d’entrada com per exemple 80 (Web) y 22 (SSH):<\/p>\n
\r\n# Acepto conexiones al puerto 80 (HTTP)\r\niptables -t filter -A INPUT -i eth0 -p TCP --dport 80 -m state --state NEW  -j ACCEPT\r\n\r\n# Acepto conexiones al puerto 22 (SSH)\r\niptables -t filter -A INPUT -i eth0 -p TCP --dport 22 -m state --state NEW  -j ACCEPT\r\n<\/pre>\n
Si volem permetre l’acc\u00e9s cap a servidors web:<\/p>\n
\r\niptables -t filter -A OUTPUT -o eth0 -p TCP --dport 80 -j ACCEPT\r\n<\/pre>\n
En general, lo m\u00e9s c\u00f2mode es permetre tots els paquets de sortida, tot i que les recomanacions de seguretat sempre s\u00f3n tancar per defecte i obrir nom\u00e9s lo que necessitem:<\/p>\n
\r\niptables -t filter -A OUTPUT -o eth0 -j ACCEPT\r\n<\/pre>\n
Finalment, acceptem tots els paquets de connexions ja establertes (e.g. relacionats amb el port 80) i descartem noves connexions (tan directes com forwarded):<\/p>\n
\r\n# Acepto paquetes de conexiones ya establecidas\r\niptables -t filter -A INPUT -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT\r\n\r\n# Rechazo paquetes de conexiones nuevas\r\niptables -t filter -A INPUT -i eth0 -m state --state NEW,INVALID -j DROP\r\n\r\n# Rechazo paquetes de forwarding de conexiones no establecidas\r\niptables -t filter -A FORWARD -i eth0 -m state --state NEW,INVALID -j DROP\r\n<\/pre>\n
A m\u00e9s a m\u00e9s, es possible que ens interessi redirigir un port de la nostra m\u00e0quina a una altra m\u00e0quina de la xarxa local, per exemple redirigir el nostre port 80 a la IP 192.168.0.111<\/p>\n
\r\niptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 192.168.0.111:80\r\niptables -t filter -A FORWARD -i eth0 -p tcp -d 192.168.0.111 --dport 80 -j ACCEPT\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
Per compartir Internet i protegir el nostre equip utilitzarem el firewall “iptables” del kernel de Linux. Per comen\u00e7ar ens assegurem que no hi ha cap regla definida al firewall fent neteja de les 3 taules principals que disposa: filter (per defecte), nat (consultada quan un paquet crea una nova connexi\u00f3) i mangle (especifica per alteraci\u00f3 … Continue reading Firewall iptables en 10 minuts<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,6],"tags":[],"class_list":["post-546","post","type-post","status-publish","format-standard","hentry","category-catala","category-tecnologia"],"_links":{"self":[{"href":"https:\/\/www.marblestation.com\/index.php?rest_route=\/wp\/v2\/posts\/546","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.marblestation.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.marblestation.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.marblestation.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.marblestation.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=546"}],"version-history":[{"count":1,"href":"https:\/\/www.marblestation.com\/index.php?rest_route=\/wp\/v2\/posts\/546\/revisions"}],"predecessor-version":[{"id":1372,"href":"https:\/\/www.marblestation.com\/index.php?rest_route=\/wp\/v2\/posts\/546\/revisions\/1372"}],"wp:attachment":[{"href":"https:\/\/www.marblestation.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=546"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.marblestation.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=546"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.marblestation.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=546"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}