FILTER SYNTAX
5
January 7, 2004
input eth0 source foo dest bar proto tcp dport http accept; input eth0 source foo dest bar proto tcp dport https accept; input eth0 source foo dest bar proto tcp dport nntp accept; input eth0 source foo dest bar proto tcp sport 1:1023 dport ssh accept; ... filter allows you to group rules with a set syntax:
input eth0 source foo dest bar proto tcp {
dport http;
dport https;
dport nntp;
sport 1:1023 dport ssh;
} accept;
Matches which accept arguments can also be grouped:
input eth0 source foo dest bar proto tcp {
dport {http https nntp};
sport 1:1023 dport ssh;
} accept;
input eth0 source foo dest bar proto tcp {
dport {http https nntp};
sport 1:1023 dport ssh;
} accept;
input eth0 source baz dest quux proto tcp {
dport {1264 1521 1984 8008 8080 26000};
} accept;
The above generates 11 rules, and every additional port adds another rule through which packets will pass (well, ones which don't match any of the above). The first four output rules have the same source and destination hosts and protocol, and we know that if it doesn't match those on the first rule, it won't on the next three, either. Out-of-line groups use this fact to streamline things somewhat:
input eth0 source foo dest bar [
proto tcp {
dport {http https nntp};
sport 1:1023 dport ssh;
} accept;
];
input eth0 source baz dest quux [
proto tcp { dport {1264 1521 1984 8008 8080 26000}; } accept;
];
Where the underlying system supports it, everything inside the square brackets is moved into a separate "chain" (in ipchains and iptables-speak) or "group" (in ipfilter-speak). Thus, any packet not matching "source foo dest bar" or "source baz dest quux" above will be checked against only two rules, not eleven. Note that matches which must appear together, like "proto tcp" and "sport 12345" need to be either both in the group, or both out of it.
#
# Example filter for (for example) a mail server
#
# Unfortunately, we don't have time to audit the
# communications which go on locally
{input lo; output lo} accept;
# But we want to be a bit more careful when speaking
# to the outside world
input eth0 {
# Sadly, we share a DMZ with Windows machines.
# Don't log their netbios noise
proto {tcp udp} source ournet/24 dport 137:139 drop;
proto tcp {
dport { smtp pop-3 } accept;
dport ssh source ournet/24 accept;
# We don't answer this, but don't want to
# cause timeouts by blocking it
dport auth reject;
log drop;
};
# We don't run any UDP (or other non-TCP)
# services
log drop;
};
output eth0 {
proto tcp {
dport { smtp auth } accept;
log drop;
};
# Outbound DNS is OK
proto udp dport domain dest { ns0 ns1 } accept;
log drop;
};
|
||||||||||
