blob: c1bd6521f0bbec3eb41fe6e01b5a8c24a2929fd5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
|
# Firewall configuration for a router with a dynamic IP.
#
# Based on example by Max Kellermann <max@duempel.org>
# <http://ferm.foo-projects.org/download/examples/dsl_router.ferm>
# Interface towards the Internet.
@def $DEV_WORLD = eth0;
# Interfaces towards LAN.
@def $DEV_PRIVATE = (eth1 eth2 eth3);
# Address range for LAN.
@def $NET_PRIVATE = 10.0.0.0/16;
table filter {
chain INPUT {
policy DROP;
# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
# allow local connections
interface lo ACCEPT;
# respond to ping
proto icmp icmp-type echo-request ACCEPT;
# allow SSH connections from the private network and all
# Internet hosts. We do not want to restrict ssh to only a
# small number of "well known" hosts, since there's often a
# need to connect from net cafes and customer sites.
proto tcp dport ssh ACCEPT;
}
# outgoing connections are not limited
chain OUTPUT policy ACCEPT;
chain FORWARD {
policy DROP;
# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
# connections from the internal net to the internet or to other
# internal nets are allowed
interface $DEV_PRIVATE ACCEPT;
}
}
table nat {
chain POSTROUTING {
# masquerade private IP addresses
# saddr $NET_PRIVATE outerface $DEV_WORLD MASQUERADE;
MASQUERADE;
}
}
|
