Update: Following some feedback this has been changed to use the state and multiport modules - making it shorter and simpler!

Update 2: Added more rules to allow outbound ftp connections.

Now while people running linux dial-up machines are fairly invulnerable to attacks across the internet (script kiddies attack Windows machines after all), it is still good practice to have a firewall. (Unlike on a Windows box where it is essentail.)

This is a very basic fire wall to run on a a machine, like a laptop, that connects to the internet using a modem and ppp.

It is very restrictive, turning off everything and then allowing communications for the services we need. In particular, as the machine is not doing to be used as a server of any kind then no external communications to our locally running services is allowed.

Here's the code which uses IPTables and is suitable for Linux Kernels of 2.4 for above.

#!/bin/bash

## Delete any existing rules

iptables -F   # deletes existing rules
iptables -X   # deletes user defined chains

##Set policy to drop everything if we don't provide for something else

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP


#### Allow connections to and from localhost

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT


## set variables for ppp
EXTERNAL=ppp0

## variable containing allowed outward bound ports
## We want to connect to web, ssh, mail, pop3, whois, finger and https

ALLOWEDTCP=80,22,25,110,43,79,443

### Allow incoming packets from connections that we initiated

iptables -A INPUT -i $EXTERNAL -m state --state ESTABLISHED,RELATED -j ACCEPT


### Now, allow ourselves to initiate some connections
### Allow us to look up DNS

iptables -A OUTPUT -o $EXTERNAL -p udp --dport 53 -j ACCEPT

## Allow a bunch of outbound tcp connections - so we can surf the web
## collect our mail etc

iptables -A OUTPUT -o $EXTERNAL -p tcp -m multiport --dports $ALLOWEDTCP -j ACCEPT

## Allow ourselves to send ping requests (although we don't respond to
## incoming ping requests - we're very anti-social :)  )

iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT

## FTP: a couple of rules to allow ftp

modprobe ip_conntrack_ftp

iptables -A OUTPUT -p tcp -o $EXTERNAL --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -i $EXTERNAL --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -o $EXTERNAL --dport 20 -m state --state ESTABLISHED -j ACCEPT 

iptables -A INPUT -p tcp -i $EXTERNAL --sport 1024: --dport 1024:  -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -o $EXTERNAL --sport 1024: --dport 1024:  -m state --state ESTABLISHED,RELATED -j ACCEPT

Save/Share: Stumble It!  Subscribe Share on Facebook Digg it Reddit Delicious