Firewalls: Difference between revisions
Jump to navigation
Jump to search
Created page with "Welcome to the Firewall Wiki. NOTE: This page is intended to be edited by the community to add use practices, command syntax, etc. regarding firewalling and security on AMPRN..." |
|||
| Line 14: | Line 14: | ||
# DROPS OUTBOUND UNASSIGNED IPs FROM LOOPING THROUGH tunl0 VIA IPENCAP | # DROPS OUTBOUND UNASSIGNED IPs FROM LOOPING THROUGH tunl0 VIA IPENCAP | ||
# YOU MUST ADD A RULE UNDER THIS LINE TO MAKE EXCEPTIONS | # YOU MUST ADD A RULE UNDER THIS LINE TO MAKE EXCEPTIONS | ||
iptables -I FORWARD ! -s 44.xxx.xxx. | iptables -I FORWARD ! -s 44.xxx.xxx.xxx/xx -o tunl0 -j DROP | ||
############################################################ | ############################################################ | ||
# DROPS BOGONS ENTERING AMPRNet | # DROPS BOGONS ENTERING AMPRNet | ||
| Line 32: | Line 32: | ||
iptables -t raw -I PREROUTING -s 224.0.0.0/4 -i tunl0 -j DROP | iptables -t raw -I PREROUTING -s 224.0.0.0/4 -i tunl0 -j DROP | ||
iptables -t raw -I PREROUTING -s 240.0.0.0/4 -i tunl0 -j DROP | iptables -t raw -I PREROUTING -s 240.0.0.0/4 -i tunl0 -j DROP | ||
== Cisco == | == Cisco == | ||
Revision as of 23:53, 22 August 2016
Welcome to the Firewall Wiki.
NOTE: This page is intended to be edited by the community to add use practices, command syntax, etc. regarding firewalling and security on AMPRNet nodes. While each operator is ultimately responsible for the administration of their node, it is highly suggested amongst the 44 Community that nodes be firewalled.
iptables
############################################################ # DROPS IP TRAFFIC THAT'S INVALID ENTERING OR EXITING AMPR # THIS PREVENTS A GENERAL LOOP iptables -I FORWARD -i tunl0 -o tunl0 -j DROP iptables -t raw -I PREROUTING ! -s 44.xxx.xxx.xxx/xx -i br-amprnet -j DROP iptables -t raw -I PREROUTING -s 44.xxx.xxx.xxx/xx -i tunl0 -j DROP # DROPS OUTBOUND UNASSIGNED IPs FROM LOOPING THROUGH tunl0 VIA IPENCAP # YOU MUST ADD A RULE UNDER THIS LINE TO MAKE EXCEPTIONS iptables -I FORWARD ! -s 44.xxx.xxx.xxx/xx -o tunl0 -j DROP ############################################################ # DROPS BOGONS ENTERING AMPRNet # SEE http://www.team-cymru.org/Services/Bogons/bogon-bn-nonagg.txt iptables -t raw -I PREROUTING -s 0.0.0.0/8 -i tunl0 -j DROP iptables -t raw -I PREROUTING -s 10.0.0.0/8 -i tunl0 -j DROP iptables -t raw -I PREROUTING -s 100.64.0.0/10 -i tunl0 -j DROP iptables -t raw -I PREROUTING -s 127.0.0.0/8 -i tunl0 -j DROP iptables -t raw -I PREROUTING -s 169.254.0.0/16 -i tunl0 -j DROP iptables -t raw -I PREROUTING -s 172.16.0.0/12 -i tunl0 -j DROP iptables -t raw -I PREROUTING -s 192.0.0.0/24 -i tunl0 -j DROP iptables -t raw -I PREROUTING -s 192.0.2.0/24 -i tunl0 -j DROP iptables -t raw -I PREROUTING -s 192.168.0.0/16 -i tunl0 -j DROP iptables -t raw -I PREROUTING -s 198.18.0.0/15 -i tunl0 -j DROP iptables -t raw -I PREROUTING -s 198.51.100.0/24 -i tunl0 -j DROP iptables -t raw -I PREROUTING -s 203.0.113.0/24 -i tunl0 -j DROP iptables -t raw -I PREROUTING -s 224.0.0.0/4 -i tunl0 -j DROP iptables -t raw -I PREROUTING -s 240.0.0.0/4 -i tunl0 -j DROP