Firehol : Outil de simplification à la mise en place d'Iptables

From Deimos.fr / Bloc Notes Informatique
Jump to: navigation, search

1 Introduction

FireHOL is a stateful iptables packet filtering firewall configurator. It is abstracted, extensible, easy and powerful. It can handle any kind of firewall, but most importantly, it gives you the means to configure it, the same way you think of it.

http://firehol.sourceforge.net

Everybody, who tried to configure an iptables firewall knows, that it can be quite a PITA. firehol is a tool that helps us to configure iptables according to our needs. In this How-To, I will discribe how to set up an iptables firewal using firehol that only allows SSH and ICMP (the protocol responsible for ping and traceroute). Also, only incoming connections are filtered, and outgoing connections are allowed. Here we go:

2 Installing firehol

Installing firehol is quite easy, as it is in the official repositories. Just open a terminal and do a

Command 
sudo aptitude install firehol

and you're all ready. Don't close your terminal, because we will need it some more.

3 Setting firehol up

We have to edit two files. First, we have to enable firehol. Open and edit the file /etc/default/firehol, e.g. with VIM:

Command 
sudo vim /etc/default/firehol

Change the first line from

Configuration File /etc/default/firehol 
START_FIREHOL=NO

to

Configuration File /etc/default/firehol 
START_FIREHOL=YES

save and exit (in VIM, hit [ESC] and then ':wq').

Then we have to define the Firewall rules themselves:

Configuration File /etc/firehol/firehol.conf 
sudo vim /etc/firehol/firehol.conf

Paste this part into the file:

Configuration File /etc/firehol/firehol.conf 
version 5
# Accept all client traffic on any interface
interface any internet
        protection strong
        server "icmp ping ICMP ssh" accept
        client all accept

This filters all incoming connetions that are not related to SSH or ICMP. If you want to be less polite, you can drop them by adding

Configuration File /etc/firehol/firehol.conf 
policy drop

after 'protection strong'.

4 Starting and Fixing firehol

To start firehol just enter

Command 
sudo /etc/init.d/firehol start

and DON'T panic if you get a rather long error message. That is related to a bug currently in Ubuntu. To fix it, just enter the following sequence of commmands:

Command 
sudo sed 's/%q/%b/g' /lib/firehol/firehol > TMPFILE
sudo cp /lib/firehol/firehol /lib/firehol/firehol.backup
sudo mv TMPFILE /lib/firehol/firehol
sudo chmod 744 /lib/firehol/firehol

and now try it again:

Command

sudo /etc/init.d/firehol start


And now your computer won't accept connections from the outside unless it's a ping request, traceroute or ssh. Have fun!

Retrieved from "https://wiki.deimos.fr/index.php?title=Firehol_:_Outil_de_simplification_à_la_mise_en_place_d%27Iptables&oldid=5880"