Firewall: Unterschied zwischen den Versionen

Aus Vosp.info
Wechseln zu:Navigation, Suche
(Die Seite wurde neu angelegt: „https://wiki.samba.org/index.php/Samba_port_usage“)
 
Zeile 1: Zeile 1:
 +
Zurück zu [[OPSI]]
 +
vim /etc/sysconfig/iptables
 +
 +
<script>
 +
 +
*nat
 +
:PREROUTING ACCEPT [0:0]
 +
:INPUT ACCEPT [0:0]
 +
:OUTPUT ACCEPT [0:0]
 +
:POSTROUTING ACCEPT [0:0]
 +
-A POSTROUTING -o enp3s0 -j MASQUERADE
 +
COMMIT
 +
*filter
 +
:INPUT DROP [0:0]
 +
:FORWARD DROP [0:0]
 +
:OUTPUT ACCEPT [401:43511]
 +
# lo
 +
-A INPUT -i lo -j ACCEPT
 +
 +
 +
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 +
-A INPUT -p icmp -j ACCEPT
 +
 +
# INPUT VPN Regeln
 +
## ssh
 +
-A INPUT -p tcp -i nc-schule -m state --state NEW -m tcp --dport 22 -j ACCEPT
 +
## OPSI-Frontend
 +
-A INPUT -p tcp -i nc-schule -m state --state NEW -m tcp --dport 443 -j ACCEPT
 +
-A INPUT -p tcp -i nc-schule -m state --state NEW -m tcp --dport 4447 -j ACCEPT
 +
 +
# INPUT enp2s0 (OPSI-Netzwerk)
 +
## ssh
 +
-A INPUT -p tcp -i enp2s0  -m state --state NEW -m tcp --dport 22 -j ACCEPT
 +
 +
## DHCP
 +
-A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 67 -j ACCEPT
 +
 +
## xinet
 +
-A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 69 -j ACCEPT
 +
 +
## DNS-Server
 +
-A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp  --dport 53 -j ACCEPT
 +
-A INPUT -p udp -i enp2s0 -m state --state NEW -m udp  --dport 53 -j ACCEPT
 +
## OPSI-Frontend
 +
-A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 443 -j ACCEPT
 +
-A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 4447 -j ACCEPT
 +
## Samba NT4 Style
 +
-A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 135 -j ACCEPT
 +
-A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 139 -j ACCEPT
 +
-A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 445 -j ACCEPT
 +
-A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 137 -j ACCEPT
 +
-A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 138 -j ACCEPT
 +
 +
# ICMP Zusätze
 +
-A INPUT -j REJECT --reject-with icmp-host-prohibited
 +
 +
# Forward
 +
-A FORWARD -i enp2s0  -j ACCEPT
 +
-A FORWARD -o enp2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
 +
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
 +
 +
COMMIT
 +
 +
</script>
 +
 
https://wiki.samba.org/index.php/Samba_port_usage
 
https://wiki.samba.org/index.php/Samba_port_usage

Version vom 9. April 2015, 15:51 Uhr

Zurück zu OPSI 

vim /etc/sysconfig/iptables

<script>

  • nat
PREROUTING ACCEPT [0:0]
INPUT ACCEPT [0:0]
OUTPUT ACCEPT [0:0]
POSTROUTING ACCEPT [0:0]

-A POSTROUTING -o enp3s0 -j MASQUERADE COMMIT

  • filter
INPUT DROP [0:0]
FORWARD DROP [0:0]
OUTPUT ACCEPT [401:43511]
  1. lo

-A INPUT -i lo -j ACCEPT


-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT

  1. INPUT VPN Regeln
    1. ssh

-A INPUT -p tcp -i nc-schule -m state --state NEW -m tcp --dport 22 -j ACCEPT

    1. OPSI-Frontend

-A INPUT -p tcp -i nc-schule -m state --state NEW -m tcp --dport 443 -j ACCEPT -A INPUT -p tcp -i nc-schule -m state --state NEW -m tcp --dport 4447 -j ACCEPT

  1. INPUT enp2s0 (OPSI-Netzwerk)
    1. ssh

-A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 22 -j ACCEPT

    1. DHCP

-A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 67 -j ACCEPT

    1. xinet

-A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 69 -j ACCEPT

    1. DNS-Server

-A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 53 -j ACCEPT -A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 53 -j ACCEPT

    1. OPSI-Frontend

-A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 443 -j ACCEPT -A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 4447 -j ACCEPT

    1. Samba NT4 Style

-A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 135 -j ACCEPT -A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 139 -j ACCEPT -A INPUT -p tcp -i enp2s0 -m state --state NEW -m tcp --dport 445 -j ACCEPT -A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 137 -j ACCEPT -A INPUT -p udp -i enp2s0 -m state --state NEW -m udp --dport 138 -j ACCEPT

  1. ICMP Zusätze

-A INPUT -j REJECT --reject-with icmp-host-prohibited

  1. Forward

-A FORWARD -i enp2s0 -j ACCEPT -A FORWARD -o enp2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

</script>

https://wiki.samba.org/index.php/Samba_port_usage

Abgerufen von „https://vosp.info/index.php?title=Firewall&oldid=3688“