In Microsoft Networks you will

# # In Microsoft Networks you will be
swamped by broadcasts. These lines # will prevent them from showing up in the logs. #

#$IPTABLES -A udp_packets -p UDP -i
$INET_IFACE -d $INET_BROADCAST \ #--destination-port 135:139 -j DROP

# # If we get DHCP requests from the
Outside of our network, our logs will # be swamped as well. This rule
will block them from getting logged. #

#$IPTABLES -A udp_packets -p UDP -i
$INET_IFACE -d 255.255.255.255 \ #--destination-port 67:68 -j DROP

# # ICMP rules #

$IPTABLES -A icmp_packets -p ICMP -s 0/0
--icmp-type 8 -j ACCEPT $IPTABLES -A icmp_packets -p ICMP -s 0/0
--icmp-type 11 -j ACCEPT

# # 4.1.4 INPUT chain #

# # Bad TCP packets we don't want. #

$IPTABLES -A INPUT -p tcp -j bad_tcp_packets

# # Rules for special networks not part
of the Internet #

$IPTABLES -A INPUT -p ALL -i $LAN_IFACE
-s $LAN_IP_RANGE -j ACCEPT $IPTABLES -A INPUT -p ALL -i $LO_IFACE
-s $LO_IP -j ACCEPT $IPTABLES -A INPUT -p ALL -i $LO_IFACE
-s $LAN_IP -j ACCEPT $IPTABLES -A INPUT -p ALL -i $LO_IFACE
-s $INET_IP -j ACCEPT

# # Special rule for DHCP requests from LAN,
which are not caught properly # otherwise. #

$IPTABLES -A INPUT -p UDP -i $LAN_IFACE
--dport 67 --sport 68 -j ACCEPT

# # Rules for incoming packets from the internet. #

$IPTABLES -A INPUT -p ALL -d $INET_IP
-m state --state ESTABLISHED,RELATED \ -j ACCEPT $IPTABLES -A INPUT -p TCP -i $INET_IFACE
-j tcp_packets $IPTABLES -A INPUT -p UDP -i $INET_IFACE
-j udp_packets $IPTABLES -A INPUT -p ICMP -i $INET_IFACE
-j icmp_packets

# # If you have a Microsoft Network on the
outside of your firewall, you may # also get flooded by Multicasts.
We drop them so we do not get flooded by # logs #

#$IPTABLES -A INPUT -i $INET_IFACE
-d 224.0.0.0/8 -j DROP

# # Log weird packets that don't match the above. #

$IPTABLES -A INPUT -m limit --limit 3/minute
--limit-burst 3 -j LOG \ --log-level DEBUG --log-prefix
"IPT INPUT packet died: "

# # 4.1.5 FORWARD chain #

# # Bad TCP packets we don't want #

$IPTABLES -A FORWARD -p tcp
-j bad_tcp_packets


Содержание  Назад  Вперед

---

Forekc.ru
Рефераты, дипломы, курсовые, выпускные и квалификационные работы, диссертации, учебники, учебные пособия, лекции, методические пособия и рекомендации, программы и курсы обучения, публикации из профильных изданий

---