Date: Fri, 22 Mar 2013 11:00:13 +0100 From: Wessel Dankers To: Joost Subject: autistische IPv6-rulebase Message-ID: <20130322100013.GN2849@homsar.uvt.nl> Om te voeren aan ip6tables-restore: *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] COMMIT *raw :PREROUTING DROP [0:0] :OUTPUT DROP [0:0] COMMIT *mangle :PREROUTING DROP [0:0] :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] :POSTROUTING DROP [0:0] COMMIT Zonder ip6tables-restore: ip6tables -F ip6tables -t raw -F ip6tables -t mangle -F ip6tables -P INPUT DROP ip6tables -P FORWARD DROP ip6tables -P OUTPUT DROP ip6tables -t raw -P PREROUTING DROP ip6tables -t raw -P OUTPUT DROP ip6tables -t mangle -P PREROUTING DROP ip6tables -t mangle -P INPUT DROP ip6tables -t mangle -P FORWARD DROP ip6tables -t mangle -P OUTPUT DROP ip6tables -t mangle -P POSTROUTING DROP Dit gaat er trouwens wel vanuit dat je in uruk de policies op ACCEPT instelt, iets wat sowieso zou moeten gebeuren (anders kun je niet robuust een ruleset laden).----------- later: reimplement uruk-save in perl, be sure to run it only when /usr is mounted, not in init-script during boot. from group/uruk/etc/uruk/rc-experimental by Wessel Dankers, 2012: ------------------- di 23 15:50 < Fruit> joostvb: Saving iptables ruleset: save "inactive". di 23 15:50 < Fruit> joostvb: dat probeer ik te voorkomen, met enable_autosave=false en enable_save_counters=false di 23 15:51 < Fruit> joostvb: maar dat blijft-ie doen - enable ip-not-yet-known. for roaming users, for fast-chagnging ipv6 adresses,for interfaces for which ip is not yet known. optionally: allow specifying range as local adress. tnx Wessel for reporting issue. - init script *** /var issue 2 init scripts eentje doet deny alles tweede doet stuff alternatief: ifupdown /etc/network/interfaces en vooral /etc/init.d/networking /run is cleared during reboot. we'd prefer to be able to load from saved state during boot. therefore, first block everything. later, when /var etc. are available, run uruk. what to do before halt? *** rh issue /etc/redhat-lsb/lsb_* geleverd door redhat-lsb-4.0-3.el6.x86_64 License GPL, by Lawrence Lim e.a., 2011, for Red Hat, Inc. -------------- - decide: fork this package, get new name, don't bother about migration scenario, use dedicated named chains and tables. - major overhaul: use different chains, optimise behaviour when dealing with ipv6. we deal with private ip ranges in a braindead way; improve that. - test on dijkstra, rolle, bruhat, freitag root@janacopoulos:/tmp# wget http://mdcc.cx/tmp/uruk/uruk_20110602-1_all.deb && dpkg -i uruk_20110602-1_all.deb ------------- - add a full IPv6 example to uruk-rc manpage (we now only have the example rc-file). - 28 14:11 < joostvb> ip6_noroute_ranges='::1/128 ffff:0:0::/96 fc00::/7 fec0::/10 0200::/7 2001:0db8::/32' vr 28 14:14 < Fruit> joostvb: overigens kun je in IPv6 veel beter over *routable* spreken dan unroutable vr 28 14:14 < Fruit> 2000::/3 is gewoon de enige die routeerbaar is, de rest is lokaal vr 28 14:26 < Fruit> 2001:0DB8::/32 has been assigned as a NON-ROUTABLE range to be used for documentation purpose [RFC3849]. vr 28 14:26 < Fruit> daar gaat de mooie 2000::/3 regel :( -------------------------------------------------- - improve flush: Subject: Re: uruk Re: iptables leegflikkeren: lelijk maar robuust Wessel Dankers
21 јан 2019 uruk 20190121
uruk — wrapper for Linux iptables, for managing firewall rules
First, create an rc file. See uruk-rc(5) for info on how to do this. Once this file is created and installed (this script looks in /etc/uruk/rc by default), you're ready to run uruk. You might want to test your rc file by running uruk in debug mode, see uruk-rc(5). There are at least 3 ways to load your rc file. We'll first describe a low level one: using vanilla iptables.
Vanilla iptables
After editing rc, load your rules like this. First flush your current rules:
Using the Uruk init script
Assumed is the Uruk init script is installed as explained in the README file.
Optionally, install /etc/default/uruk (or /etc/sysconfig/uruk) and
tweak it. An example file is in /usr/share/doc/uruk/examples/default (You might like to enable
support for uruk-save.) Now activate uruk by doing:
When rebooting, everything will be fine: /etc/init.d/uruk stores state in /var/lib/uruk/iptables, using iptables-save(8), which comes with Linux iptables.
Using Debian ifupdown
In case you have just one network interface which should get protected, you
could use interfaces(5) from the Debian ifupdown package instead of the
init script. Suppose you'd like to protect ppp0, and would like not to
interfere with traffic on eth0: your other network interface.
First write an rc file. Be sure it features
Similar tricks might be possible on GNU/Linux systems from other distributions. The author is interested.
Using the Uruk init script
Do
The script urukctl (and thus the uruk init script) will use uruk-save only if asked to do so in /etc/default/uruk (or /etc/sysconfig/uruk). If this file features
It rejects packets with source nor destination for one of our IPs.
Packets belonging to locally initiated sessions are allowed: we match state; the local host can act as a client for any remote service.
By default, uruk drops all ICMP packets (except those for interfaces in $interfaces_unprotect) with type other than
By default, the FORWARD chain is left untouched, so has policy ACCEPT. (This won't do much harm, since packet forwarding is disabled by default in the Linux kernel. However, if you don't mind being paranoid, you might want to add a
By default, uruk logs all UDP and TCP packets which are blocked by the user defined policies. Loglevel is debug, logprefix is "iptables:". See also the notes on loglevel in uruk-rc(5).
Blocked TCP packets are answered with a tcp-reset.
iptables(8), iptables-save(8), iptables-restore(8), ip6tables(8), ip6tables-save(8), ip6tables-restore(8), http://www.netfilter.org/
interfaces(5), http://packages.debian.org/ifupdown.
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.
21 јан 2019 uruk-save 20190121
uruk-save — save uruk rc configuration in iptables-save-style format
uruk-save [-6]
Things will likely break if you do very fancy stuff in an rc hook file. If your rc file is in verbose mode (i.e. it features set -x) or in no-act mode (i.e. it features a hardcoded iptables='echo iptables'), uruk-save fails.
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.
21 јан 2019 urukctl 20190121
urukctl — uruk control script
urukctl is the user interface for the uruk system. It is used to create or change saved iptables rulesets, to change the current loaded rulesets and to report on uruk's status.
See uruk(8) for information on how to get started with the Uruk system, and for a tutorial. This manpage gives just the details on urukctl.
The urukctl script calls uruk to process /etc/uruk/rc. (The uruk init script calls urukctl.)
These 4 ruleset pairs (for both IPv4 and IPv6) exist in a system using uruk:
arguments
urukctl should be called as either urukctl argument or
urukctl argument option. Possible values are:
If not yet done, save current iptables status in "inactive" ruleset. (Re)build and load the "active" ruleset.
Save the current iptables status in given ruleset.
Create an "active" or "inactive" ruleset with sane defaults: "active" will be based upon the uruk rc file. "inactive" will allow all traffic.
Load a saved ruleset
(Re)build and load the "active" ruleset, without temporarily clearing the current iptables status.
(Re)build and load the "active" ruleset, in case uruk is running.
Load the "inactive" ruleset.
Perform stop-actions followed by start-actions.
Print the current status of the service: show which ruleset is loaded, and wether uruk is "running".
Remove all rules and user-defined chains, set default policy to ACCEPT.
Remove all rules and user-defined chains, set default policy to DROP.
Flush all rules from the current iptables status.
configuration
urukctl uses the file /etc/default/uruk (on Debian, Ubuntu and related
systems) or /etc/sysconfig/uruk (on Red Hat, Fedora and related systems) for
configuration. Variables used in this file are:
wether to check for existence and sanity of uruk rc file; set to false if you don't like this, e.g. when using the uruk initscript for managing saved rulesets only (i.e. not for calling uruk or uruk-save).
set to false to disable IPv6 support. Set to $(enable-ipv6) to dynamically decide wether to filter IPv6 traffic.
enable calling the unstable uruk-save script.
set to "false" to disable autosaving the active ruleset when going from start to stop.
set to "false" to disable saving table counters with rulesets.
iptables(8), iptables-save(8), iptables-restore(8), ip6tables(8), ip6tables-save(8), ip6tables-restore(8), http://www.netfilter.org/
interfaces(5), http://packages.debian.org/ifupdown.
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.
21 јан 2019 uruk-rc 20190121
uruk-rc — uruk resource file, defining access policy
/etc/uruk/rc
rc lists IP addresses, allowed to use services.
default
The simplest valid rc file is the empty file. This rc file blocks all TCP
and UDP connection attempts to services on our host: this is the default
behaviour.
simplest
The simplest rc file which does allow traffic to our services looks like e.g.:
realistic
If you'd like to block traffic on wlan0 and allow traffic to ssh on your
wired interface, and don't like to explicitly set your IPs in rc:
autodetect-ips
The script autodetect-ips --as used in the previous example-- looks for files
/etc/sysconfig/network-scripts/ifcfg-* (commonly found at e.g. Red Hat and
Fedora systems) and /etc/network/interfaces (as found at e.g. Debian and Ubuntu
systems), and, for each interface nic, and each found IPv4 and IPv6
address and network, sets variables ip_nic_default,
ip6_nic_default, net_nic_default and
net6_nic_default . Then it calls ip(8) and adds any other found
nic, ip and net triplets (for IPv4 and, for IPv6, only addresses
in scope "global").
The script autodetect-ips is useful if you'd like to share your rc file among different hosts.
another example
For an even more reasonable rc file, look at the well-commented example rc
file in /usr/share/doc/uruk/examples/rc.
You can mix IPv4 and IPv6-addresses in sources_*. E.g.:
If svejk.example.com has both an IPv4 PTR record in DNS, as well as an IPv6 PTR record, connection attempts from svejk to the ssh and ftp TCP ports are allowed, via both IPv4 and IPv6.
Uruk used to require variables sources6_* to be set to support ip6tables. Since uruk version 20140319 (The Alfama Release), this is no longer needed; setting sources_* suffices. To be precise, the semantics since uruk version 20140319 is: 1) If both sources_* and sources6_* are defined (even if they're just empty), each is used for its respective address family. (This ensures backwards compatibility.) 2) If sources6_* is undefined, sources_* is used for both v4 and v6. 3) In either case, v4 literals in v6 context and v6 literals in v4 context are silently (!) ignored.
allowing broadcasts
In rc, there is:
allowing non-matching returntraffic
In rc there is:
allowing NAT
In rc there is:
allowing IPv6 tunneling
In rc there is:
allowing any traffic on an interface
In rc there is:
using multiple hooks at one entry point in the main uruk process
In case rc_a, rc_b, ... , or rc_i does not have a file as its value, but a
directory, all files matching "$rc_x"/*.rc will get sourced. This helps
configuration management in complex situations involving lots of uruk
configuration files for lots of hosts.
See the section "THE GORY DETAILS: uruk INTERNALS" in uruk(8) (or the uruk source) to find out which hook (there are hooks rc_a, rc_b, ... , rc_i) to use.
If ips_nic is set, e.g. like
In multiple-IP mode, IP addresses are listed as e.g.
Logging
By default, uruk logs denied packets. This is adjustable using the
loglevel variable. The settings are:
Debugging
To debug the uruk script, invoke uruk as
If you'd rather prefer not to execute, but just watch what would've been done, invoke uruk as
If you'd like to test a new rc file before installing it, run something like:
Of course, all these tweaks can be combined.
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.