Secure Server Build

IPTables

The default should be “Disallow everything except the specific network services required by the application”.

Do not use system-config-securitylevel it overwrites the iptables file

Changes are made by editing /etc/sysconfig/iptables

Starting IPTables

service iptables on

Change the Default Policies

Change the default policy to DROP (from ACCEPT) for the INPUT and FORWARD built-in chains: *filter :INPUT DROP [0:0] :FORWARD DROP [0:0]

Sample IP Tables for IPMS project

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [8636929:1948084600] 

### Default Policy 
-A RH-Firewall-1-INPUT -i lo -j ACCEPT 

# accepting all established 
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 

# ICMP 
# Default policy is DROP so will comment all Drop entries from your table
-A RH-Firewall-1-INPUT -s 83.70.168.102 -p icmp -m icmp --icmp-type any -j ACCEPT
#-A RH-Firewall-1-INPUT -s 83.0.0.0/255.0.0.0 -i eth2 -p icmp -j DROP 
#-A RH-Firewall-1-INPUT -s 84.0.0.0/255.0.0.0 -i eth2 -p icmp -j DROP 
#-A RH-Firewall-1-INPUT -s 85.0.0.0/255.0.0.0 -i eth2 -p icmp -j DROP 
#-A RH-Firewall-1-INPUT -s 86.0.0.0/255.0.0.0 -i eth2 -p icmp -j DROP 
#-A RH-Firewall-1-INPUT -s 95.0.0.0/255.0.0.0 -i eth2 -p icmp -j DROP 
#-A RH-Firewall-1-INPUT -s 151.177.0.0/255.255.0.0 -i eth2 -p icmp -j DROP 
#-A RH-Firewall-1-INPUT -s 159.134.0.0/255.255.0.0 -i eth2 -p icmp -j DROP 
#-A RH-Firewall-1-INPUT -s 213.94.0.0/255.255.0.0 -i eth2 -p icmp -j DROP 
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT 

# IP Encapsulating Security Payload
-A RH-Firewall-1-INPUT -p esp -j ACCEPT 

# IP Authentication Header
-A RH-Firewall-1-INPUT -p ah -j ACCEPT 

# multicast DNS
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT 

# ports are used for IPP…printing is disabled on this server as part of hardening
#-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT 
#-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT 

# these 2 ports are used for FTP… FTP is disabled on this server as part of hardening
#-A RH-Firewall-1-INPUT -i eth2 -p tcp -m state --state NEW -m tcp --dport 20:21 -j ACCEPT 

# SSH port leaving it open.  Might want to specify a network to accept ssh from
-A RH-Firewall-1-INPUT -i bond0 -p tcp -m state --state NEW -m tcp --dport 23 -j ACCEPT 

# ports are used for TFTP…TFTP is disabled on this server as part of hardening
#-A RH-Firewall-1-INPUT -i eth2 -p udp -m state --state NEW -m udp --dport 69 -j ACCEPT 

# SNMP  need to specify network here
# -A RH-Firewall-1-INPUT -i bond0 -p udp -m state --state NEW -m udp --dport 162 -j ACCEPT 

#NTP  need to specify source here
# -A RH-Firewall-1-INPUT -i bond0 -p udp -m state --state NEW -m udp --dport 123 -j ACCEPT 

# Not sure what this is for so commenting it out
# -A RH-Firewall-1-INPUT -i eth2 -p udp -m state --state NEW -m udp --dport 1162 -j ACCEPT 

# are used for RDP and RCP  both are  disabled on this server as part of hardening
# -A RH-Firewall-1-INPUT -i eth2 -p udp -m state --state NEW -m udp --dport 514 -j ACCEPT 

# are used for RMI  registry This is not installed or configured on this server as part of hardening
# -A RH-Firewall-1-INPUT -i eth1 -p tcp -m state --state NEW -m tcp --dport 1099 -j ACCEPT 

# Not sure what this is for so commenting it out
#-A RH-Firewall-1-INPUT -s 5.1.22.6 -i eth1 -p tcp -m state --state NEW -m tcp --dport 1828 -j ACCEPT 
#-A RH-Firewall-1-INPUT -s 5.1.22.13 -i eth1 -p tcp -m state --state NEW -m tcp --dport 1828 -j ACCEPT 

# I assume these are the IPs and ports used fro Backups?
-A RH-Firewall-1-INPUT -s 5.1.22.6 -i eth1 -p tcp -m state --state NEW -m tcp --dport 6070 -j ACCEPT 
-A RH-Firewall-1-INPUT -s 5.1.22.13 -i eth1 -p tcp -m state --state NEW -m tcp --dport 6070 -j ACCEPT 

# Not sure what this is for (BMC patrol?) so commenting it out
-A RH-Firewall-1-INPUT -s 159.134.25.144 -p tcp -m state --state NEW -m tcp --dport 3181 -j ACCEPT 
# -A RH-Firewall-1-INPUT -s 159.134.25.153 -p tcp -m state --state NEW -m tcp --dport 3181 -j ACCEPT 

# Not sure what this is for so commenting it out
# -A RH-Firewall-1-INPUT -s 159.134.25.153 -p tcp -m state --state NEW -m tcp --dport 50005 -j ACCEPT 

# Not sure what this is for so commenting it out
# -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 12321 -j ACCEPT 

# Netbios Already blocked by default policy
# -A RH-Firewall-1-INPUT -p udp -m udp --dport 137:138 -j DROP

#
# Specific to this server
#
# HTTP Public Internet Access…
-A RH-Firewall-1-INPUT –p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT 

# Remedy ITSM to Remedy AR and Integration Server
-A RH-Firewall-1-INPUT –s 10.137.6.1 –p tcp -m state --state NEW -m tcp --dport 20011 -j ACCEPT 

#  GT Access for Support via main Teamed NIC's
# max
-A RH-Firewall-1-INPUT –s 10.40.19.4 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A RH-Firewall-1-INPUT –s 10.40.19.4 -p udp -m state --state NEW -m udp --dport 22 -j ACCEPT
# sysmon01
-A RH-Firewall-1-INPUT –s 10.152.16.104 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A RH-Firewall-1-INPUT –s 10.152.16.104 -p udp -m state --state NEW -m udp --dport 22 -j ACCEPT 

# GT Access from Netbackup Servers to Remedy ITSM DMZ Servers for Backups
# bkpmst20
-A RH-Firewall-1-INPUT –s 10.40.35.7 -p tcp -m state --state NEW -m tcp --dport 13724 -j ACCEPT 
-A RH-Firewall-1-INPUT –s 10.40.35.7 -p udp -m state --state NEW -m udp --dport 13724 -j ACCEPT 
# bkpmst21
-A RH-Firewall-1-INPUT –s 10.40.35.3 -p tcp -m state --state NEW -m tcp --dport 13724 -j ACCEPT 
-A RH-Firewall-1-INPUT –s 10.40.35.3 -p udp -m state --state NEW -m udp --dport 13724 -j ACCEPT 
# bkpmed21
-A RH-Firewall-1-INPUT –s 10.136.12.6 -p tcp -m state --state NEW -m tcp --dport 13724 -j ACCEPT 
-A RH-Firewall-1-INPUT –s 10.136.12.6 -p udp -m state --state NEW -m udp --dport 13724 -j ACCEPT 

# GT Access from Patrol PEM Servers to Remedy ITSM DMZ Servers for Monitoring
# w2k-esm1 159.134.25.144
-A RH-Firewall-1-INPUT -s 159.134.25.144 -p icmp -m icmp --icmp-type echo-request -j ACCEPT
-A RH-Firewall-1-INPUT –s 159.134.25.144 -p tcp -m state --state NEW -m tcp --dport 3181:3182:3185:3281:3283  -j ACCEPT 
-A RH-Firewall-1-INPUT –s 159.134.25.144 -p udp -m state --state NEW -m udp --dport 3181:3182:3185:3281:3283  -j ACCEPT
# w2k-esm1 159.134.25.153
-A RH-Firewall-1-INPUT -s 159.134.25.153 -p icmp -m icmp --icmp-type echo-request -j ACCEPT
-A RH-Firewall-1-INPUT –s 159.134.25.153 -p tcp -m state --state NEW -m tcp --dport 50005:3181  -j ACCEPT 
-A RH-Firewall-1-INPUT –s 159.134.25.153 -p udp -m state --state NEW -m udp --dport 50005:3181: -j ACCEPT

# ESM Group Access
# ppatcehellpc
-A RH-Firewall-1-INPUT -s 10.201.136.0/24 -p icmp -m icmp --icmp-type echo-request -j ACCEPT
-A RH-Firewall-1-INPUT –s 10.201.136.0/24 -p tcp -m state --state NEW -m tcp --dport 3182:3183:3185:3281:3282:3283:3389  -j ACCEPT 
-A RH-Firewall-1-INPUT –s 10.201.136.0/24 -p udp -m state --state NEW -m udp --dport 3182:3183:3185:3281:3282:3283:3389  -j ACCEPT
# ppatcehellpc (Home)  NO IP Provided…
#-A RH-Firewall-1-INPUT -s 10.201.136.0/24-p icmp -m icmp --icmp-type echo-request -j ACCEPT
#-A RH-Firewall-1-INPUT –s 10.201.136.0/24 -p tcp -m state --state NEW -m tcp --dport 3182:3183:3185:3281:3282:3283:3389  -j ACCEPT 
#-A RH-Firewall-1-INPUT –s 10.201.136.0/24 -p udp -m state --state NEW -m udp --dport 3182:3183:3185:3281:3282:3283:3389  -j ACCEPT
# ppatchellpc (Dundrum)
-A RH-Firewall-1-INPUT -s 10.40.23.55-p icmp -m icmp --icmp-type echo-request -j ACCEPT
-A RH-Firewall-1-INPUT –s 10.40.23.55 -p tcp -m state --state NEW -m tcp --dport 3182:3183:3185:3281:3282:3283:3389  -j ACCEPT 
-A RH-Firewall-1-INPUT –s 10.40.23.55 -p udp -m state --state NEW -m udp --dport 3182:3183:3185:3281:3282:3283:3389  -j ACCEPT
# pemdev01
-A RH-Firewall-1-INPUT -s 10.152.32.0/24 -p icmp -m icmp --icmp-type echo-request -j ACCEPT
-A RH-Firewall-1-INPUT –s 10.152.32.0/24 -p tcp -m state --state NEW -m tcp --dport 3181:3182:3185:3281:3283  -j ACCEPT 
-A RH-Firewall-1-INPUT –s 10.152.32.0/24 -p udp -m state --state NEW -m udp --dport 3181:3182:3185:3281:3283  -j ACCEPT
# pemprd01
-A RH-Firewall-1-INPUT -s 159.134.25.0/24 -p icmp -m icmp --icmp-type echo-request -j ACCEPT
-A RH-Firewall-1-INPUT –s 159.134.25.0/24 -p tcp -m state --state NEW -m tcp --dport 3181:3182:3185:3281:3283  -j ACCEPT 
-A RH-Firewall-1-INPUT –s 159.134.25.0/24 -p udp -m state --state NEW -m udp --dport 3181:3182:3185:3281:3283  -j ACCEPT


# Logging
-A RH-Firewall-1-INPUT -j LOG --log-prefix "LOGDROP " --log-level debug
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited 

# Drop ALL packages that get to this level
 -A RH-Firewall-1-INPUT -j DROP
COMMIT

To prevent your /var/log/messages from being overrunn by dropped messages add 

 kern.=debug /var/log/iptables.log
 kern.*;kern.!=debug /var/log/messages

to /etc/syslog.conf remember to touch the /var/log/dropped-custom.log so that the file actually exists