Webserver under a firewall

[Francis Ancheta]

Thank you so much ... this document will refrain me from asking unnecessary questions. Thanks guys ... Im still stuck with my testing phase will let you know how it goes ... Currently studying how Steven's iptable works.

[Jerome Henry]

Further to Claudio's tips, and to make short answers to you last questions :

When you boot, a directory called /etc/rc.d/ has subdirectories called rc1.d rc2.d and so on. Inside, there is a list of programs that has to be launched at this stage. There is a copy of each in init.d directory.

What chkconfig does it that it adds to the relevant directory services to launch on startup.

You can add it by yourself in those directories (ading in rcx.d a number looking like S for start plus 'last S+1' you see there).

You can also start or launch a service by typing 'service lokkit start (or stop, or restart to stop and restart)' directly, replacing lokkit by the service name you wish. Beware that it'll launch it now, but it won't be turned on at boot time, it's just launched now...

When you have 2 firewalls running, like you have, it's interesting !
Look into your rc3.d or rc5.d (depending on if you boot on graphical or shell startup), and look at the numbers closed to the program names : they are the order in which things must be launched or stopped (killed, K) ! The highest number will be the right one, desactivating Ip tables policies set up by the other. They actually shouldn't conflict as they do not manage same things (as you know from Bastille install), even if it's off no use to have them both. One good idea would be to desactivate firewalling in Batsille, and let it to lokkit...

Iptables -F flushes all the rules, bringing you back to the default policy which should be, if Bastille installed 'drop all' ! So no net anymore... It should be fixed on restarting services or machine.

Redhat also has good tips on all these things, see :

many things on security (maybe too much) :
http://www.europe.redhat.com/documentation/rhl8.0/rhl-sg-en-8.0/

Iptables :
http://www.europe.redhat.com/documentation/rhl8.0/rhl-rg-en-8.0/ch-iptables.php3

see also
http://www.iptables.org/documentation/index.html
the direct Iptables, with many things on routing, NAT and filtering.

But do not hesitate to ask here too : it's often shorter to ask than to read pages and pages. Read to learn, ask to fix !
:]] We love points and are always ready to help...

J

[Steven E. Protter]

1) Backup the iptables file.

Hare are my proposed changes.

They are preceeded by # comments telling you what to do. Don't include them in the file.

# Firewall configuration written by lokkit
# Manual customization of this file is not recommended.
# Note: ifup-post will punch the current nameservers through the
# firewall; such entries will *not* be listed here.
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]

# You may need to change the numbers in the brackets.
:PREROUTING ACCEPT [0:0]
:RH-Lokkit-0-50-INPUT - [0:0]
:OUTPUT ACCEPT [0:0]

# make the IP addresses below valid The first one is the firewall, second ip starting with 10 is the # iis web server
-A PREROUTING -p tcp -d 15.15.15.15 -dport 80 -j DNAT --to-destination 10.0.0.25

-A INPUT -j RH-Lokkit-0-50-INPUT
-A FORWARD -j RH-Lokkit-0-50-INPUT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 80 -j ACCEPT --syn
-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT
-A RH-Lokkit-0-50-INPUT -i eth1 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 -j REJECT --syn
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 -j REJECT --syn
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 -j REJECT --syn
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 -j REJECT --syn
COMMIT
# Generated by webmin
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed
# Generated by webmin
*nat
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed



service iptables restart.

Sorry for the delay. This took thought, had to wait for my lunch break. Plus I'm short on sleep.

SEP