IP tables

[LT72884]

Ello all once again. So sorry for the 4 month vacation from the forums. School has been busy but all in all i have good news about my schooling. They accepted my proposal for a new network engineering program and here is what is on it thus far. there will be more added. I wrote this up for them and they said they loved my choice of classes. They voted me onto student council and we went from there:

Server configuration and administration.
Network Operating Systems including Linux(Finally)
Client/Desktop administration
Business Law and security ethics
Certified Ethical Hacker certification.
IP Security
Firewall administration
Protocol mechanics
Network monitoring and documentation
Telecom cabling and wiring for physical hardware.
Scripting and programing
CCNA and CCNP
Wireless networks and communications
Disaster recovery and prevention
Unified communications
Data center administration including cooling, UPS, ROI, NAS


So im excited BUT lets get to the meat of the subject.. I have built a hardware FW using SmoothWall. They are having a hard time answering my question. They are basically telling me that what i want to do is not recomended,Well to me i need to know how to do this so i can use it for future use. Apparently SW uses a linux program that i have never heard of called "Ip Tables" To me an IP table is like a routing table. But i guess in the *nix world its different.

My ISP blocks certain common ports on there end so that a household user cant use them for business purposes unless they buy a business line. I need to learn how to change the port in IP tables from port 45 (just an example) to port 43.. SW for some reason will not allow me to change my port numbers from port 45 to 43.

My isp blocks SSH and other protocol ports that i need open for various reasons. I wish they didnt but even if i had port forwarding it would still block it because i take it that the FTP server on the other end by default uses port 21 and if i try using port 8080, the server at the other end would have to know that port 8080 is being used for FTP.

Point is i own my own servers and i have them set up on diff ports than the default and i need to change the default values in IP tables to the same as the servers...

I know this is a very interesting let alone complicated question but some good advice would be nice. Also, is there a book about IP tables. I need one that is easy to understand..

Thanx in advance (TIA)

Matt Thomas

[Jman]

There is some documentation. http://www.netfilter.org/documentation/

You may run ssh on a different port, a random high numbered. That way you may even get less attack attempts from the Internet as on 22

[Vouters]

Here is a commented Linux Fedora Core 6 /etc/sysconfig/iptables

[root@victor ~]# cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [6310:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -p tcp -m tcp --dport 631 -j
ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 137 -j ACCEPT
-A RH-Firewall-1-INPUT -m udp -p udp --dport 138 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 82.229.172.76
--dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 161.114.0.0/16
--dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 15.0.0.0/8
--dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 50000 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 631 -j
ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

This has to be understood up down. First anything from lo0 (localhost
connection) will be accepted. Next any ICMP protocol such as ping (see symptom
above) will be accepted. Next udp traffic with port 5353 with a destination
224.0.0.251 will be accepted. Anything that establish a TCP connection on
destination port 631 will be accepted. And so on. The last line says that if
everything above is not true, the ip layer will reject the tentative with
icmp-host-prohibited.

You can filter address ranges. Consider the two lines above:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 161.114.0.0/16
--dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 15.0.0.0/8
--dport 80 -j ACCEPT

This simply means than any TCP access on port 80 (http) from any address that
starts with 161.114 or any address that starts with 15 will be accepted. As
the author of this article is working for HP, these are the likely addresses
of the Web proxies within HP assigned public addresses ranges.

The ports which does not seem to be protected against worldwide accesses are
undeclared on the author's ADSL modem-router. Therefore anyone within the local
private network can access these seemlingly unprotected ports.

[Vouters]

PS: I have port 8080 (Apache port) world opened in both my DSL modem and my firewall so that any worldwide Linux users can access the http://vouters.dyndns.org:8080/Intel directory but I restricted access to a few known DSN names to directories containing more sensitive data, moving the security on this port from /etc/sysconfig/iptables to /etc/httpd/conf/httpd.conf.

[LT72884]

Wow, thanx guys. Im still trying to figure out what it all means.. lol.. I think my ISP blocks port 441. Smoothwall uses port 441 by default and i cant change it in the web GUI so i have to edit iptables which i do not know how yet. I do not have the output with me but i can sure try to get it. What info do you guys need from my iptables? im trying to switch what ever protocol uses tcp port 441 and switch to 445

thanx guys