We have two own Rootservers with one DNS-Server (Bind). We also user iptables as firewall.
Now we have the problem that if the firewall is off all things are well, but with enabled firewall we can't get AXFRs because it's blocked. Out firewall script is listed below.
What is the problem in it?
Code: Select all
#!/bin/sh
MAX_CON=50
SERVER_IP="xx.xx.109.238"
DNS_SERVER="xx.xx.242.238"
FTP_PASSIVE_START=60000
FTP_PASSIVE_END=61000
SVN=3890
case "$1" in
start)
echo "Starte IP-Paketfilter"
# iptables-Modul
modprobe ip_tables
# Connection-Tracking-Module
modprobe ip_conntrack
# Das Modul ip_conntrack_irc ist erst bei Kerneln >= 2.4.19 verfuegbar
modprobe ip_conntrack_irc
modprobe ip_conntrack_ftp
# Tabelle flushen
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle -X
# Default-Policies setzen
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# MY_REJECT-Chain
iptables -N MY_REJECT
# MY_REJECT fuellen
iptables -A MY_REJECT -p tcp -m limit --limit $MAX_CON/s -j LOG --log-prefix "IPTABLES: REJECT TCP "
iptables -A MY_REJECT -p tcp -j REJECT --reject-with tcp-reset
iptables -A MY_REJECT -p udp -m limit --limit $MAX_CON/s -j LOG --log-prefix "IPTABLES: REJECT UDP "
iptables -A MY_REJECT -p udp -j REJECT --reject-with icmp-port-unreachable
iptables -A MY_REJECT -p icmp -m limit --limit $MAX_CON/s -j LOG --log-prefix "IPTABLES: DROP ICMP "
iptables -A MY_REJECT -p icmp -j DROP
iptables -A MY_REJECT -m limit --limit $MAX_CON/s -j LOG --log-prefix "IPTABLES: REJECT OTHER "
iptables -A MY_REJECT -j REJECT --reject-with icmp-proto-unreachable
# MY_DROP-Chain
iptables -N MY_DROP
iptables -A MY_DROP -m limit --limit 60/m -j LOG --log-prefix "IPTABLES: PORTSCAN DROP "
iptables -A MY_DROP -j DROP
# Alle verworfenen Pakete protokollieren
iptables -A INPUT -m state --state INVALID -m limit --limit $MAX_CON/s #-j LOG --log-prefix "IPTABLES: INPUT INVALID "
iptables -A OUTPUT -m state --state INVALID -m limit --limit $MAX_CON/s #-j LOG --log-prefix "IPTABLES: OUTPUT INVALID "
# Korrupte Pakete zurueckweisen
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
# Stealth Scans etc. DROPpen
# Keine Flags gesetzt
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j MY_DROP
# SYN und FIN gesetzt
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j MY_DROP
# SYN und RST gleichzeitig gesetzt
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j MY_DROP
# FIN und RST gleichzeitig gesetzt
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j MY_DROP
# FIN ohne ACK
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j MY_DROP
# PSH ohne ACK
iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j MY_DROP
# URG ohne ACK
iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j MY_DROP
# Loopback-Netzwerk-Kommunikation zulassen
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Connection-Tracking aktivieren
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# ICMP-Pakete (z.B. Ping) erlauben
iptables -A INPUT -p icmp -i eth0 -j ACCEPT
# SSH
# SSH: mehr als 3 neue Verbindungen/60 Sek.: BruteForce loggen
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --rcheck --seconds 60 --hitcount 3 --rttl --name SSH #-j LOG --log-level 7 --log-prefix "IPTABLES: SSH BruteForce "
# SSH: mehr als 3 neue Verbindungen/60 Sek.: BruteForce droppen
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 --rttl --name SSH -j DROP
# SSH: neue Verbindungen merken, aber durchlassen, wenn wir bis hierhin gekommen sind
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT
# SSH: bestehende Verbindungen erlauben
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
#iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 22 -j ACCEPT
# HTTP
iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 80 -j ACCEPT
# HTTPS
iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 443 -j ACCEPT
# DNS old style
#iptables -A INPUT -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
#iptables -A INPUT -p udp --sport 53 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -p udp --sport 53 --dport 53 -m state --state ESTABLISHED -j ACCEPT
# DNS Zone Transfer
for ip in $DNS_SERVER
do
iptables -A OUTPUT -p udp -s $SERVER_IP --sport 1024:65535 -d $ip --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp -s $ip --sport 53 -d $SERVER_IP --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s $SERVER_IP --sport 1024:65535 -d $ip --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s $ip --sport 53 -d $SERVER_IP --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
done
# DNS requests
iptables -A INPUT -p udp -s 0/0 --sport 1024:65535 -d $SERVER_IP --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp -s $SERVER_IP --sport 53 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp -s 0/0 --sport 53 -d $SERVER_IP --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp -s $SERVER_IP --sport 53 -d 0/0 --dport 53 -m state --state ESTABLISHED -j ACCEPT
# FTP
# Eingehender Zugriff auf FTP-Server (aktiver Modus)
iptables -A INPUT -p TCP -s 0/0 --sport 1024:65535 -d 0/0 --dport 20:21 -j ACCEPT
iptables -A OUTPUT -p TCP -d 0/0 --dport 1024:65535 -s 0/0 --sport 20:21 -j ACCEPT
# passiver Modus
iptables -A INPUT -p TCP -d 0/0 --dport 1024:65535 -s 0/0 --sport $FTP_PASSIVE_START:$FTP_PASSIVE_END -j ACCEPT
iptables -A OUTPUT -p TCP -d 0/0 --dport 1024:65535 -s 0/0 --sport $FTP_PASSIVE_START:$FTP_PASSIVE_END -j ACCEPT
#iptables -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
# FTP Kontrollverbindung
#iptables -A INPUT -p tcp --dport 1024:65535 --sport 21 ! --syn -j ACCEPT
#iptables -A OUTPUT -p tcp --sport 1024:65535 --dport 21 -j ACCEPT
# aktives FTP
#iptables -A INPUT -p tcp --dport 1024:65535 --sport 20 -j ACCEPT
#iptables -A OUTPUT -p tcp --sport 1024:65535 --dport 20 ! --syn -j ACCEPT
# passives FTP
#iptables -A INPUT -p tcp --dport 1024:65535 --sport 1024:65535 ! --syn -j ACCEPT
#iptables -A OUTPUT -p tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT
# Mail
iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 110 -j ACCEPT
iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 143 -j ACCEPT
# Webmin
iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 10000 -j ACCEPT
# SVN
iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport $SVN -j ACCEPT
# Default-Policies mit REJECT
iptables -A INPUT -j MY_REJECT
iptables -A OUTPUT -j MY_REJECT
;;
stop)
echo "Stoppe IP-Paketfilter"
# Tabelle flushen
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle -X
# Default-Policies setzen
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
;;
status)
echo "Tabelle filter"
iptables -L -vn
echo "Tabelle nat"
iptables -t nat -L -vn
echo "Tabelle mangle"
iptables -t mangle -L -vn
;;
*)
echo "Fehlerhafter Aufruf"
echo "Syntax: $0 {start|stop|status}"
exit 1
;;
esac