iptables를 사용한 방화벽구축에서 문제..(기본정책)
안녕하세요
방화벽구죽하는데 문제가 있네요..(방화벽과 ssh서버는 동일 서버)
다음과 같은 스크립트를 돌려서 규칙을 만드는데
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
iptables -t nat -P PREROUTING DROP
iptables -t nat -P OUTPUT DROP
iptables -t nat -P POSTROUTING DROP
iptables -t mangle -P PREROUTING DROP
iptables -t mangle -P POSTROUTING DROP
의 기본정책을 ACCEPT로 모두 할때만 ssh접속이 원격에서 되고 DROP으로 바꾸면 안되네요..
(eth0:210.182.x.1, eth1:192.168.0.1 ,OS:redhat 9)
답변부탁합니다.
그럼...
#!/bin/sh
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
for interface in /proc/sys/net/ipv4/conf/*/accept_source_route;do
echo "1">$interface
done
sysctl -w net.ipv4.tcp_syncookies=1
for interface in /proc/sys/net/ipv4/conf/*/accept_redirects;do
echo "1">$interface
done
for interface in /proc/sys/net/ipv4/conf/*/rp_filter;do
echo "1">$interface
done
for interface in /proc/sys/net/ipv4/conf/*/log_martians;do
echo "1">$interface
done
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
iptables -t nat -P PREROUTING DROP
iptables -t nat -P OUTPUT DROP
iptables -t nat -P POSTROUTING DROP
iptables -t mangle -P PREROUTING DROP
iptables -t mangle -P POSTROUTING DROP
iptables -A INPUT -p TCP --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p TCP --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p TCP --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A INPUT -p TCP --tcp-flags FIN,RST FIN,RST -j DROP
iptables -A INPUT -p TCP --tcp-flags ACK,FIN FIN -j DROP
iptables -A INPUT -p TCP --tcp-flags ACK,PSH PSH -j DROP
iptables -A INPUT -p TCP --tcp-flags ACK,URG URG -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 210.182.x.1 -j DROP
iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP
iptables -A INPUT -i eth0 -s 224.0.0.0/4 -j DROP
iptables -A INPUT -i eth0 -s 240.0.0.0/5 -j DROP
iptables -A INPUT -i eth0 -s 127.0.0.0/8 -j DROP
iptables -A INPUT -i eth0 -s 0.0.0.0/8 -j DROP
iptables -A INPUT -i eth0 -s 169.254.0.0/16 -j DROP
iptables -A INPUT -i eth0 -s 192.0.2.0/24 -j DROP
iptables -A INPUT -i eth0 -s 248.0.0.0/5 -j DROP
iptables -A INPUT -p TCP -i eth1 -s 192.168.0.0/24 --sport 1024:65535 --dport 22 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p TCP -o eth1 ! --syn --sport 22 -d 192.168.0.0/24 --dport 1024:65535 -j ACCEPT
iptables -A INPUT -p TCP -i eth0 -s 192.168.0.0/24 --sport 1024:65535 --dport 22 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p TCP -o eth0 ! --syn --sport 22 -d 192.168.0.0/24 --dport 1024:65535 -j ACCEPT