Here's a Firewall Generator..

T-Dawg · 2005-03-06 03:52:53

I just found this good iptables firewall generator for anyone who cares. It provides tables for filter and nat. I tested it at grc and got a passing score. My internet seems a little faster now than it did with my regular manually configured rules.;)
Download and extract it, then run the quicktables script to generate the rules. You can use the INSTALL file to configure it the rest of the way. Remember to remove iptables from the daemons list.

http://qtables.radom.org/download.php

More info and supported features:
http://qtables.radom.org/index.php

timtux · 2005-10-09 20:41:22

This is how to do:

Edit the /etc/rc.conf DEAMONS line so it looks like this: (disable iptables)

DAEMONS=(syslog-ng acpid cpufreqd hotplug !pcmcia !iptables network netfs crond autofs)

Then go in to the map where you extracted quicktables

./quicktables-2.3
<FOLLOW THE INSTRUCTIONS>
su 
<entermyrootpw>
cp rc.firewall /usr/local/sbin
chown root /usr/local/sbin/rc.firewall
chmod 744 /usr/local/sbin/rc.firewall

And last add /usr/local/sbin/rc.firewall to the bottom of /etc/rc.local:

#!/bin/sh
#
# /etc/rc.local: Local multi-user startup script.
#
/usr/local/sbin/rc.firewall
# End of file

T-Dawg · 2005-10-09 21:06:00

Woah, this is an old thread...
Yes to all your questions, but you'll have to reboot before they take effect.

Honestly, I don't use this method. Instead, I added the line to rc.local once, rebooted, and did:

/etc/rc.d/iptables save

That will hard coat the rules into /etc/iptables/iptables.rules rather than being cached into memory by the script. Now you can remove the line from rc.local and add iptables to the deamon array.
The advantage of this is that it will allow you to be able to stop or start the firewall at any time easily by doing /etc/rc.d/iptables stop or /etc/rc.d/iptables start.

timtux · 2005-10-09 21:11:44

ah, smart Dident think so long

timtux · 2005-10-09 21:25:16

Just one more thing:

The firewall is up and running as i wish.
Ive tested my computer on an Swedish site ( http://www.testadatorn.se ) and all seems to be ok:

Swedish:
Din dator har nu blivit testad och inga svagheterl kunde hittas i din datorsäkerhet. Testet kunde dock få fram information om din dator som kan vara viktig för dig att veta om.

In English:
Your computer have now been tested and no weakness has been found.

But when im test it at https://www.grc.com/x/ne.dll?bh0bkyd2 ive get:

Greetings!

Without your knowledge or explicit permission, the Windows networking technology which connects your computer to the Internet may be offering some or all of your computer's data to the entire world at this very moment!

T-Dawg · 2005-10-09 21:40:03

Its probably detecting it from your browser (all browsers fail those stupid tests).
Try it here, it test all ports, not the browser:
http://www.grc.com/default.htm
then go to "shields up" --> "all service ports"

timtux · 2005-10-09 21:44:21

Penguin wrote:

Its probably detecting it from your browser (all browsers fail those stupid tests).
Try it here, it test all ports, not the browser:
http://www.grc.com/default.htm
then go to "shields up" --> "all service ports"

a, thx

Shofs · 2005-10-12 02:45:11

I remember reading a while back about some sort of dynamic iptables configurator. If, for example, some script kiddie is bombarding your server with attempted ssh connections the dynamic rules would kick in and temporarily block/drop/whatever all connections for port 22 from that host for for some given amount of time.

It would then relinquish that rule after the specified amount of time. This is useful if you accidentally typed your password wrong more than once when trying to ssh to your box.

I can't seem to find this. Perhaps someone knows what I am talking about.

T-Dawg · 2005-10-12 03:03:51

quicktables has quickblock included with it:

quickblock README wrote:

qtables@radom.org
quickblock.sh was designed to block packets from a host "on-the-fly"
without having to edit a script and rerun the firewall.
quickblock.sh is simple to use and operates as follows...
- first you'll be asked for the IP or network address to block. please
enter a single address only
- next you'll be asked if you would like your quicktables firewall to
block this IP or network address permanently or not. if you answer
yes then the address will be appended to /etc/qblock. /etc/qblock
addresses will then be read in by your quicktables firewall script
when it next runs.
- next you'll be asked if you use NAT or not. please answer yes or no

dunno if thats what you wanted...

Shofs · 2005-10-12 03:35:11

Penguin wrote:

quicktables has quickblock included with it:
quickblock README wrote:
qtables@radom.org
quickblock.sh was designed to block packets from a host "on-the-fly"
without having to edit a script and rerun the firewall.
quickblock.sh is simple to use and operates as follows...
- first you'll be asked for the IP or network address to block. please
enter a single address only
- next you'll be asked if you would like your quicktables firewall to
block this IP or network address permanently or not. if you answer
yes then the address will be appended to /etc/qblock. /etc/qblock
addresses will then be read in by your quicktables firewall script
when it next runs.
- next you'll be asked if you use NAT or not. please answer yes or no
dunno if thats what you wanted...

That still seems to need user interaction though . . . I am looking for something that recognizes a threat and takes care of it automatically.

cactus · 2005-10-12 05:08:35

take a look at snort. I believe there are plugins for snort that will update firewall rules..

Arch Linux

#1 2005-03-06 03:52:53

Here's a Firewall Generator..

#2 2005-10-09 20:41:22

Re: Here's a Firewall Generator..

#3 2005-10-09 21:06:00

Re: Here's a Firewall Generator..

#4 2005-10-09 21:11:44

Re: Here's a Firewall Generator..

#5 2005-10-09 21:25:16

Re: Here's a Firewall Generator..

#6 2005-10-09 21:40:03

Re: Here's a Firewall Generator..

#7 2005-10-09 21:44:21

Re: Here's a Firewall Generator..

#8 2005-10-12 02:45:11

Re: Here's a Firewall Generator..

#9 2005-10-12 03:03:51

Re: Here's a Firewall Generator..

#10 2005-10-12 03:35:11

Re: Here's a Firewall Generator..

#11 2005-10-12 05:08:35

Re: Here's a Firewall Generator..

Board footer