Maximiliano, This is a good example of an ipchains firewall (thanks to Kurt Seifried who shares it on www.securityportal.com) Study it, learn from it. HTH Philipp #!/bin/bash # # This script sets up firewall rules appropriate for a server with 2 interfaces # running as a gateway # This script needs to be edited if you plan to use it. # We assume the internal machines call all talk to the gateway, so no rules block # internal traffic # # A couple of variables # # ETH0 is the IP address on ETH0 (the external interface) # ETH0NET is the network # ETH0NETMASK is the network mask # TRUSTEDHOST1 is a trusted host (for webmin/ssh) # TRUSTEDHOST2 is a trusted host (for webmin/ssh) # ETH1IP is the IP address on ETH1 (internal interface) # ETH1NET is the network # ETH1NETMASK is the network mask # ETH0IP=1.1.1.1 ETH0NET=1.1.1.0 ETH0NETMASK=24 TRUSTEDHOST1=1.5.1.1 TRUSTEDHOST2=1.5.1.2 ETH1IP=10.0.0.1 ETH1NET=10.0.0.0 ETH1NETMASK=24 # PATH=/sbin # FLUSH ALL RULES ipchains -F input ipchains -F output ipchains -F forward # ANTI-SPOOFING ipchains -A input -p all -j DENY -s 10.0.0.0/8 -i eth0 -d 0.0.0.0/0 ipchains -A input -p all -j DENY -s 127.0.0.0/8 -i eth0 -d 0.0.0.0/0 ipchains -A input -p all -j DENY -s 192.168.0.0/16 -i eth0 -d 0.0.0.0/0 ipchains -A input -p all -j DENY -s 172.16.0.0/16 -i eth0 -d 0.0.0.0/0 ipchains -A input -p all -j DENY -s $ETH0IP -i eth0 -d 0.0.0.0/0 # ICMP FIRST ipchains -A input -p icmp -j ACCEPT -s $ETH0NET/$ETH0NETMASK -i eth0 -d 0.0.0.0/0 ipchains -A input -p icmp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 # SSH ipchains -A input -p tcp -j ACCEPT -s $TRUSTEDHOST1 -i eth0 -d 0.0.0.0/0 22 ipchains -A input -p tcp -j ACCEPT -s $TRUSTEDHOST2 -i eth0 -d 0.0.0.0/0 22 # BLOCKING 1:1023 ipchains -A input -p tcp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 1:1023 ipchains -A input -p udp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 1:1023 # BLOCKING OTHER THINGS ipchains -A input -p tcp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 1109 ipchains -A input -p tcp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 1524 ipchains -A input -p tcp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 1600 ipchains -A input -p tcp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 2003 ipchains -A input -p udp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 2049 ipchains -A input -p tcp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 2105 ipchains -A input -p udp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 3001 ipchains -A input -p tcp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 3001 ipchains -A input -p udp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 3128:3130 ipchains -A input -p tcp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 3128:3130 ipchains -A input -p tcp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 3306 ipchains -A input -p udp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 3306 ipchains -A input -p tcp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 4444 ipchains -A input -p tcp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 6000:6100 ipchains -A input -p udp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 6000:6100 ipchains -A input -p tcp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 6667 ipchains -A input -p tcp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 7000 # WEBMIN ipchains -A input -p tcp -j ACCEPT -s $TRUSTEDHOST1 -i eth0 -d 0.0.0.0/0 10000 ipchains -A input -p tcp -j ACCEPT -s $TRUSTEDHOST2 -i eth0 -d 0.0.0.0/0 10000 ipchains -A input -p tcp -j DENY -s 0.0.0.0/0 -i eth0 -d 0.0.0.0/0 10000 # FORWARD RULES ipchains -P forward DENY ipchains -A forward -p all -j MASQ -s $ETH1NET/$ETH1NETMASK -d 0.0.0.0/0 -----Ursprüngliche Nachricht----- Von: Maximiliano A. Benitez [mailto:dnbu5497@satlink.com] Gesendet: Donnerstag, 19. April 2001 18:00 An: suse-security@suse.com Betreff: [suse-security] Firewall Howto i config firewall.rc.config in linux suse 7.0 and howto setup ipchains i have two ethernet adapter whit ip public