Firewall: Unterschied zwischen den Versionen
HK (Diskussion | Beiträge) (Die Seite wurde neu angelegt: „https://wiki.samba.org/index.php/Samba_port_usage“) |
HK (Diskussion | Beiträge) |
||
| Zeile 1: | Zeile 1: | ||
| + | Zurück zu [[OPSI]] | ||
| + | vim /etc/sysconfig/iptables | ||
| + | |||
| + | <script> | ||
| + | |||
| + | *nat | ||
| + | :PREROUTING ACCEPT [0:0] | ||
| + | :INPUT ACCEPT [0:0] | ||
| + | :OUTPUT ACCEPT [0:0] | ||
| + | :POSTROUTING ACCEPT [0:0] | ||
| + | -A POSTROUTING -o enp3s0 -j MASQUERADE | ||
| + | COMMIT | ||
| + | *filter | ||
| + | :INPUT DROP [0:0] | ||
| + | :FORWARD DROP [0:0] | ||
| + | :OUTPUT ACCEPT [401:43511] | ||
| + | # lo | ||
| + | -A INPUT -i lo -j ACCEPT | ||
| + | |||
| + | |||
| + | -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| + | -A INPUT -p icmp -j ACCEPT | ||
| + | |||
| + | # INPUT VPN Regeln | ||
| + | ## ssh | ||
| + | -A INPUT -p tcp -i nc-schule -m state --state NEW -m tcp --dport 22 -j ACCEPT | ||
| + | ## OPSI-Frontend | ||
| + | -A INPUT -p tcp -i nc-schule -m state --state NEW -m tcp --dport 443 -j ACCEPT | ||
| + | -A INPUT -p tcp -i nc-schule -m state --state NEW -m tcp --dport 4447 -j ACCEPT | ||
| + | |||
| + | # INPUT enp2s0 (OPSI-Netzwerk) | ||
| + | ## ssh | ||
| + | -A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 22 -j ACCEPT | ||
| + | |||
| + | ## DHCP | ||
| + | -A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 67 -j ACCEPT | ||
| + | |||
| + | ## xinet | ||
| + | -A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 69 -j ACCEPT | ||
| + | |||
| + | ## DNS-Server | ||
| + | -A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 53 -j ACCEPT | ||
| + | -A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 53 -j ACCEPT | ||
| + | ## OPSI-Frontend | ||
| + | -A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 443 -j ACCEPT | ||
| + | -A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 4447 -j ACCEPT | ||
| + | ## Samba NT4 Style | ||
| + | -A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 135 -j ACCEPT | ||
| + | -A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 139 -j ACCEPT | ||
| + | -A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 445 -j ACCEPT | ||
| + | -A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 137 -j ACCEPT | ||
| + | -A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 138 -j ACCEPT | ||
| + | |||
| + | # ICMP Zusätze | ||
| + | -A INPUT -j REJECT --reject-with icmp-host-prohibited | ||
| + | |||
| + | # Forward | ||
| + | -A FORWARD -i enp2s0 -j ACCEPT | ||
| + | -A FORWARD -o enp2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| + | -A FORWARD -j REJECT --reject-with icmp-host-prohibited | ||
| + | |||
| + | COMMIT | ||
| + | |||
| + | </script> | ||
| + | |||
https://wiki.samba.org/index.php/Samba_port_usage | https://wiki.samba.org/index.php/Samba_port_usage | ||
Version vom 9. April 2015, 15:51 Uhr
Zurück zu OPSI
vim /etc/sysconfig/iptables
<script>
- nat
- PREROUTING ACCEPT [0:0]
- INPUT ACCEPT [0:0]
- OUTPUT ACCEPT [0:0]
- POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o enp3s0 -j MASQUERADE COMMIT
- filter
- INPUT DROP [0:0]
- FORWARD DROP [0:0]
- OUTPUT ACCEPT [401:43511]
- lo
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
- INPUT VPN Regeln
- ssh
-A INPUT -p tcp -i nc-schule -m state --state NEW -m tcp --dport 22 -j ACCEPT
- OPSI-Frontend
-A INPUT -p tcp -i nc-schule -m state --state NEW -m tcp --dport 443 -j ACCEPT -A INPUT -p tcp -i nc-schule -m state --state NEW -m tcp --dport 4447 -j ACCEPT
- INPUT enp2s0 (OPSI-Netzwerk)
- ssh
-A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 22 -j ACCEPT
- DHCP
-A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 67 -j ACCEPT
- xinet
-A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 69 -j ACCEPT
- DNS-Server
-A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 53 -j ACCEPT -A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 53 -j ACCEPT
- OPSI-Frontend
-A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 443 -j ACCEPT -A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 4447 -j ACCEPT
- Samba NT4 Style
-A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 135 -j ACCEPT -A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 139 -j ACCEPT -A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 445 -j ACCEPT -A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 137 -j ACCEPT -A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 138 -j ACCEPT
- ICMP Zusätze
-A INPUT -j REJECT --reject-with icmp-host-prohibited
- Forward
-A FORWARD -i enp2s0 -j ACCEPT -A FORWARD -o enp2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
</script>
