.
# # NARC - Netfilter Automatic Rules Configurator v0.6 # Copyright (c) 2001, Shane Chen (shane@knowplace.org). See the LICENSE file for the (BSD) license. # CONF_VERSION=0.6 # DO NOT edit this line. EDITED="yes" # Edit the options below and change this option to 'yes' once you're satisfied with the changes # # Config options # # Start Iptables at boot up? START_IPTABLES="yes" USE_COLOR="yes" # When possible # Path to the executables NARC="/usr/sbin/narc" # Location of the narc bash script - edit this if the path is incorrect IPTABLES="/usr/local/sbin/iptables" # Make sure the path is correct! ECHO="/bin/echo" # Make sure the path is correct! # Load Netfilter modules - only necessary if you compiled netfilter as modules LOAD_MODULES="yes" # Network parameters EXTERNAL_INTERFACE="eth0" # Example: "eth0" DYNAMIC_EXTERNAL_IP="yes" # If this is set to "no", you'll need to enter an IP address below EXTERNAL_INTERFACE_IP="" # If DYNAMIC_EXTERNAL_IP is "yes", NARC will attempt to auto-obtain this # The options immediately below control server services that you're offering to the outside world - it does not limit # the services available to your localhost. # Use comma separated name or numeric value from /etc/services - if port is > 1024, use numeric value instead of name # # Note: limited to 15 services - you shouldn't need more than 15 ports open, especially on a firewall. ALLOW_TCP_EXT="ftp,ssh,auth,http,imap,https" # Example "ssh,smtp,http" - note the lack of spaces ALLOW_UDP_EXT="27015" # Example "domain,ntp" - note the lack of spaces CHECK_SYN_PACKET_LENGTH="no" # Do not disable unless you must use a stock kernel that does not support length checking # # The options immediately below here are similar to above, except that they allows you to enter port ranges (and single ports) # using space separated numeric values. Enter as many as necessary (i.e. not limited to 15 entries). # Unless needed, use the above instead. ALLOW_TCP_EXT_RANGE="" # Example "6000:6010 6660:6669 3128" ALLOW_UDP_EXT_RANGE="" # Example "6000:6010 6660:6669 3128" # Note: If you simply wanted to firewall a single host, you can ~safely skip the rest of the config options below # MASQuerading section - This is the Linux equivalent of "Internet Connection Sharing" # Don't turn on ALWAYS_FORWARD unless you know what you're doing. # ALWAYS_FORWARD will keep forwarding (and masq'ing) traffic even when there are no firewall rules loaded. MASQUERADE="yes" # Turning this on will enable IP forwarding automatically LAN_INTERFACE="eth1" # Example: "eth1" ALWAYS_FORWARD="no" # Don't turn this on unless you want to forward traffic even when not firewalling. PROTECT_FROM_LAN="no" # "yes" or "no" - Protect firewall from internal network # The options immediately below control server services that you're offering to your internal LAN - it does not limit # the services available to your localhost. # Use comma separated name or numeric value from /etc/services - if port is > 1024, use numeric value instead of name # # Note: limited to 15 services - you shouldn't need more than 15 ports open, especially on a firewall. ALLOW_TCP_LAN="" # Example "ssh,smtp,http" - note the lack of spaces ALLOW_UDP_LAN="" # Example "domain,ntp" - note the lack of spaces # # The options immediately below here are similar to above, except that they allows you to enter port ranges (and single ports) # using space separated numeric values. Enter as many as necessary (i.e. not limited to 15 entries). # Unless needed, use the above instead. ALLOW_TCP_LAN_RANGE="" # Example "6000:6010 6660:6669 3128" ALLOW_UDP_LAN_RANGE="" # Example "6000:6010 6660:6669 3128" # PortForwarding section - Requires masquerading and forwarding. PORT_FORWARD="yes" # This will not have any effect unless MASQUERADE is enabled DMZ_INTERFACE="eth1" # DMZ interface (technically, you can use your LAN interface as well - bad security practice) PROTECT_FROM_DMZ="no" # "yes" or "no" - Protect firewall from DMZ network FORWARD_LAN_TO_DMZ="yes" # Forward traffic from LAN to DMZ FORWARD_CONF="/etc/narc/narc-forward.conf" # Edit this file if you need to do port forwarding # The options immediately below control server services that you're offering to your DMZ network - it does not limit # the services available to your localhost. # Use comma separated name or numeric value from /etc/services - if port is > 1024, use numeric value instead of name # # Note: limited to 15 services - you shouldn't need more than 15 ports open, especially on a firewall. ALLOW_TCP_DMZ="" # Example "ssh,smtp,http" - note the lack of spaces ALLOW_UDP_DMZ="" # Example "domain,ntp" - note the lack of spaces # # The options immediately below here are similar to above, except that they allows you to enter port ranges (and single ports) # using space separated numeric values. Enter as many as necessary (i.e. not limited to 15 entries). # Unless needed, use the above instead. ALLOW_TCP_DMZ_RANGE="" # Example "6000:6010 6660:6669 3128" ALLOW_UDP_DMZ_RANGE="" # Example "6000:6010 6660:6669 3128" # To enable traceroute from MS Windows to your firewall, enable ANSWER_PING. # To enable traceroute from UNIX hosts, turn enable ANSWER_TRACEROUTE. Use of either option is discouraged. ANSWER_PING="yes" PING_RATE="1/s" # Leave this alone unless you happen to like flood pings ANSWER_TRACEROUTE="yes" # Auth port responds with reject instead of drop AUTH_REJECT="no" # Disable this if you're running identd or using IRC # Drop broadcasts DROP_BROADCASTS="yes" BROADCAST_NETWORKS="0.0.0.0/8 255.255.255.255 224.0.0.0/4" # Logging options LOG_DROPS="yes" # If this is turned off, the rest of the log options have no effect. NORM_LOG_LEVEL="info" # Log everything to /var/log/firewall.log ONLY if you add 'kern.=info -/var/log/ firewall.log' to /etc/syslog.conf WARN_LOG_LEVEL="info" # Change to "warning" if you want more urgent logging to show up in /var/log/ warn LOG_PROBES="yes" # Uses the TCP/UDP_PROBE# below to monitor certain ports LOG_ILLEGAL="yes" # Logs packets defined by ILLEGAL_TCP_FLAGS in the advanced section below. LOG_INVALID="yes" # Logs packets that do not belong to a valid connection LOG_SPOOF="no" # Logs packets defined by the anti-spoof options in the advanced section below. LOG_ICMP="no" # Logs packets not accepted by ALLOW_ICMP_MESSAGE (below) LOG_PACKET_LENGTH="yes" # Logs TCP SYN packets that have bad header length (PACKET_LENGTH) LOG_IPLIMIT_EXCEED="yes" # Logs TCP connections that exceed IPLIMIT_MAX_ACCEPT LOG_ALL_ELSE="yes" # This logs everything that we didn't explicitly match (recommeded) BURST_MAX="5" # default is 5 LOG_RATE="1/s" # not implemented - may not be a good idea # Probable probes - Note: Add or remove entries as necessary but do not exceed 15 ports per line! # Use comma separated values with no spaces # (common trojans) - see http://www.simovits.com/sve/nyhetsa...yheter9902.html TCP_PROBE=" 23,81,111,123,161,445,515,555,1234,1241,1243,1433,1494,2049, 3306" TCP_PROBE2=" 3128,3389,5631,5632,6635,8080,9055,12345,24452,27374,27573,3 1337,42484" UDP_PROBE="22,161,1025,3283,5634,5882,28431,31337,31789" UDP_PROBE2="" # # Advanced options below - DO NOT edit unless you know what you are doing # # Executes a custom script EXECUTE_CUSTOM_SCRIPT="no" CUSTOM_SCRIPT="/etc/narc/narc-custom.script" PRELOAD_IP_MODULES="ip_tables ip_conntrack ip_conntrack_ftp" NAT_MODULES="iptable_nat ip_nat_ftp" # Illegal TCP flag combinations ILLEGAL_TCP_FLAGS="SYN,FIN PSH,FIN SYN,ACK,FIN SYN,FIN,PSH SYN,FIN,RST SYN,FIN,RST,PSH SYN,FIN,ACK,RST SYN,ACK,FIN,RST,PSH ALL" FINSCAN="FIN" XMASSCAN="URG,PSH,FIN" NULLSCAN="NONE" # SYN packet length (range in bytes) PACKET_LENGTH="40:68" # General rate limit ENABLE_LIMIT_RATE="no" LIMIT_RATE="30/s" LIMIT_BURST="50" # IP based TCP rate limit (requires the CONFIG_IP_NF_MATCH_IPLIMIT / iplimit patch) ENABLE_IPLIMIT="no" # You better know what you're doing - change the values below. IPLIMIT_MAX_ACCEPT="16" # accept only UP TO this many connections per the netmask below. IPLIMIT_NETMASK="24" # netmask value # Drop "unclean" packets - packet sanity checking (EXPERIMENTAL - don't use this) DROP_UNCLEAN_PACKETS="no" # Allowable ICMP messages - see http://www.iana.org/assignments/icmp-parameters # Note: will accept numeric or name value - 'iptables -p icmp -h' to list ALLOW_ICMP_MESSAGE="echo-reply network-unreachable host-unreachable port-unreachable fragmentation-needed time-exceeded" # Anti-spoofing options # see http://www.sans.org/dosstep/cisco_spoof.htm and http://www.isi.edu/in-notes/rfc1918.txt # 0.0.0.0/8 - Broadcast (old) # 255.255.255.255(/32) - Broadcast (all) # 127.0.0.0/8 - Loopback # 224.0.0.0/4 - Multicast # 240.0.0.0/5 - Class E reserved # 248.0.0.0/5 - Unallocated # 192.0.2.0/24 - NET-TEST (reserved) # 169.254.0.0/16 - LinkLocal (reserved) # 10.0.0.0/8 - Class A (private use) # 172.16.0.0/12 - Class B (private use) # 192.168.0.0/16 - Class C (private use) RESERVED_NETWORKS="127.0.0.0/8 240.0.0.0/5 248.0.0.0/5" #PRIVATE_NETWORKS=" 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16" PRIVATE_NETWORKS=" 10.0.0.0/8 172.16.0.0/12 " # Accept traffic to loopback LOOPBACK_ACCEPT="yes" LOOPBACK_MODE="normal" # values are paranoid, normal, or loose. # Self-referenced firewall DNS workaround - leave this alone; if you're having DNS problems on the firewall itself, # but not from behind it, this should probably make sense to you. Otherwise, leave this blank. # Use space separated dotted quad IP addresses if you need more than one. BIND_IP="" # Kernel options - do not change unless you're sure what you're doing SYNCOOKIES="no" ANTI_SMURF="yes" ACCEPT_SOURCE_ROUTE="no" # Ingress filtering: 1 for simple, 2 to comply with RFC1812 section 5.3.8 - see http:// andrew2.andrew.cmu.edu/rfc/rfc1812.html INGRESS_FILTER="2" LOG_MARTIANS="yes" # TCP congestion notification - depreciated ENABLE_TCP_ECN="no"
Comentario