Firewall script for NAT server to protect the smtp

[Teddy Mills]

Well I put my server behind a SmoothWall2.0 with a NAT address, (any I
portforward the needed ports)
but I still find I have to protect the SMTP 25 with this script.

This statement in the script gives a chain/target/match error.
/sbin/iptables -A INPUT -m state -p tcp --state ESTABLISHED,RELATED -j
ACCEPT

What is wrong with the above statement?




[root-v+aXH1h/sVw at public.gmane.org scripts]# more firewall

 #!/bin/sh
echo "FSNAT (Firewall for Server with NAT Address) starting..."

# ****************************************
# Flushing all chains and reset iptables
# ****************************************


/sbin/iptables -F
/sbin/iptables -F INPUT
/sbin/iptables -F OUTPUT
/sbin/iptables -F FORWARD

/sbin/iptables -X
/sbin/iptables -Z



# **********************************************
# DEFAULT POLICIES
#***********************************************

echo DROP INPUT chain
/sbin/iptables -P INPUT DROP

echo DROP OUTPUT chain
/sbin/iptables -P OUTPUT DROP

echo ACCEPT FORWARD chain
/sbin/iptables -P FORWARD ACCEPT



# **********************************************
# drop these nutbars
# *********************************************

echo Drop that spammer  bitch from China 218.70.8.186
/sbin/iptables -A INPUT -s 218.70.8.186/24 -j DROP
/sbin/iptables -A INPUT -s 218.70.0.0/24   -j DROP




# ***********************************************
# allow this traffic
# ***********************************************


echo accept packets from an already established TCP connection
/sbin/iptables -A INPUT -m state -p tcp --state ESTABLISHED,RELATED -j
ACCEPT


echo allow everything on eth1 network
/sbin/iptables -A INPUT   -i eth1 -j ACCEPT
/sbin/iptables -A OUTPUT  -o eth1 -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -j ACCEPT

echo allow everything on the loopback interface
/sbin/iptables -A INPUT   -i lo -j ACCEPT
/sbin/iptables -A OUTPUT  -o lo -j ACCEPT
/sbin/iptables -A FORWARD -i lo -j ACCEPT





# ****************************************************************
# ACCEPT THESE PACKETS
# ****************************************************************

echo allow INPUT eth1 only for ports 22 25 53 80 110 143 993
/sbin/iptables -A INPUT -p tcp -i eth1 --sport 22  -j ACCEPT
/sbin/iptables -A INPUT -p tcp -i eth1 --sport 25  -j ACCEPT

/sbin/iptables -A INPUT -p tcp -i eth1 --sport 53  -j ACCEPT
/sbin/iptables -A INPUT -p udp -i eth1 --sport 53  -j ACCEPT

/sbin/iptables -A INPUT -p tcp -i eth1 --sport 80  -j ACCEPT
/sbin/iptables -A INPUT -p tcp -i eth1 --sport 110 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -i eth1 --sport 113 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -i eth1 --sport 143 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -i eth1 --sport 443 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -i eth1 --sport 993 -j ACCEPT




# ***************************************************************
# eth1 OUTPUT
# ***************************************************************

echo allow outgoing eth1 traffic only for ports 22 25 53 80 110 143 993
/sbin/iptables -A OUTPUT -p tcp -o eth1 --dport 22  -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -o eth1 --dport 25  -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp -o eth1 --dport 53  -j ACCEPT
/sbin/iptables -A OUTPUT -p udp -o eth1 --dport 53  -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp -o eth1 --dport 80  -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -o eth1 --dport 110 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -o eth1 --dport 113 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -o eth1 --dport 143 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -o eth1 --dport 443 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -o eth1 --dport 993 -j ACCEPT


# **********************************************************
# eth1 FORWARD incoming
# default policy listed at top is ACCEPT. (this is a router)
# **********************************************************


# **********************************************************
# eth1 FORWARD outgoing
# default policy listed at top is ACCEPT. (this is a router)
# **********************************************************



# *****************************************************
# Loading Iptable modules (enable if not kernel builtin)
# *****************************************************

# /sbin/modprobe ip_tables
# /sbin/modprobe ip_conntrack   #Added this module
# /sbin/modprobe ip_nat_ftp
# /sbin/modprobe ip_conntrack_ftp



# *****************************************
# Disabled rules
# *****************************************


# echo Catchall In case a packet made it here, drop all other traffic.
# /sbin/iptables -A FORWARD -j DROP


# echo Drop any incoming SMTP packets
# /sbin/iptables -A INPUT -p tcp -i ppp0 -s 0/0 --dport 25 -j DROP

[root-v+aXH1h/sVw at public.gmane.org scripts]#
---------------------------------------------------------------
teddy mills
http://www.vger.ca
VGER directives...To collect...all that is collectable. To sell...all that
is saleable.To merchandise...all that is merchandisable.

Family Guys, Quagmire
"allllllllllllllllllllllllllllllll right"

--
The Toronto Linux Users Group.      Meetings: http://tlug.ss.org
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml