iptables Recommendations from NSA
- 정광섭
chap 10 정리
Changes to Default Rules
Default
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
The NSA Recommendation would change this to
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
Regulate the Ping Command
From Linux, it's possible to flood another system with the -f (flood) switch. It may transmit thousands of packets per second.
One potentially troublesome rule in the default firewall is
-A INPUT -p icmp -j ACCEPT
However, ICMP message go both ways. If you run the ping command on a remote system, the remote system responds with an ICMP packet. So if you want to limit ICMP messages, the following rules allow "acceptable" response to a ping:
-A INPUT -p icmp --icmp-type echo-reploy -j ACCEPT
-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
Block Suspicious IP Addresses
-A INPUT -i eth0 -s 10.0.0.0/8 -j DROP
-A INPUT -i eth0 -s 172.16.0.0/12 -j DROP
-A INPUT -i eth0 -s 192.168.0.0/16 -j DROP
-A INPUT -i eth0 -s 224.0.0.0/4 -j DROP
-A INPUT -i eth0 -s 240.0.0.0/5 -j DROP
Regulate Access to SSH