Search my site
Twitter
Flickr
Archives

Blog Posts

Wednesday
Mar042009

IPKungFu easy iptables based server firewall

IPKungFu Firewall and Basic Server setup

IPKungFu is an iptables-based Linux firewall. It aims to simplify the configuration of Internet connection sharing, port forwarding, and packet filtering. -- http://freshmeat.net/projects/ipkungfu/

IPKungFu better described as being a smart script that eases creation complex firewall rules. Creating a gateway firewall, internet sharing, or simply setting up a basic firewall are all simple tasks. By default it includes advanced logging, syn-flood protection, and port scanning protection.

Karate
Creative Commons License photo credit: masochismtango

I am going to describe how to setup a basic server firewall with this base system as the example:

  • Ubuntu Server 8.04 LTS (hardy)
  • basic apt sources. (hardy main, hardy-updates main, hardy-security main)

Install

  user@server# sudo apt-get install ipkungfu

Configure

open '/etc/ipkungfu/ipkungfu.conf' and change these settings:

  GATEWAY=0
  BLOCK_PINGS=1  #keep the ICMP port open for Nagios!!
  SUSPECT="DROP"	#'DROP' is the same as Stealth on consumer routers
  KNOWN_BAD="DROP"
  PORT_SCAN="DROP"
  GET_IP="AUTO"
  DISALLOW_PRIVATE=1  #for servers to reject private IPs as spoofs
  FAILSAFE=1

open '/etc/ipkungfu/services.conf' and add 'ACCEPT' to the services you want:

  # The defaults.  I set SSH, HTTP, and HTTPS services to 'ACCEPT'
  ftp-data:20:tcp
  ftp:21:tcp
  ssh:22:tcp:ACCEPT
  telnet:23:tcp
  smtp:25:tcp
  domain:53:tcp
  bootps:63:tcp
  http:80:tcp:ACCEPT
  pop3:110:tcp
  auth:113:tcp
  ntp:123:tcp
  imap:143:tcp
  https:443:tcp:ACCEPT
  imaps:993:tcp
  pop3s:995:tcp
  socks:1080:tcp

  # Custom Services
  # form: ServiceName:ServicePort:Protocol[:ACCEPT|DROP|REJECT|or any valid target)]
  splunk:8000:tcp:ACCEPT
It will be important to enable SSH if you are working on a remote machine. Otherwise your firewall will block you from creating new connections.

You can add custom IPTABLES rules to the '/etc/ipkungfu/custom.conf'. For example:

  ### Custom MAC address to be Accepted for full access to machine.
  $IPTABLES -A INPUT -m mac --mac-source xx:xx:xx:xx:xx:xx -j ACCEPT
Please note that MAC addresses are not a secure. They are trivially spoofed. This is used as an example.

Test Configuration

user@server# sudo ipkungfu --test

Should display something similar:

  Checking integrity: ..	PASSED
  Checking configuration...
   TTL support detected!
   MARK support detected!
  Clearing old chains and tables...
  Implementing custom rules...
  Handling Services On The Following Ports...
  -------------------------------
   Port  Protocol  Name   Target
  -------------------------------
   22    tcp       ssh    ACCEPT
   80    tcp       http   ACCEPT
   443   tcp       https  ACCEPT
  -------------------------------
  Creating proc settings cache:	OK
  Creating iptables rules cache:	OK
This should display all the ports you want to keep open. Did you open SSH? :)

Enable On Reboot

Edit '/etc/default/ipkungfu':

  IPKFSTART=1

Start the Service

  user@server# sudo ipkungfu

Other Resources

Sunday
Mar012009

wordpress migration with must have plugins

BarCamp / WordCamp Miami 2009
Creative Commons License photo credit: seanosh

zarzax blog engine moved to Wordpress:

Over the last few weeks I decided to move from Drupal to Wordpress. I've always liked Wordpress and is near impossible to beat as an Open Source blogging platform.

Some plugins of interest::

MobilePress

MobilePress is a WordPress plugin that will render your WordPress blog on mobile handsets, with the ability to use customized themes. The plugin also allows specific themes for specific devices / mobile browsers, such as iPhone, Opera Mini, Windows CE Mobile and other generic handset browsers. - http://mobilepress.co.za

Google XML Sitemaps

Creating custom xml sitemaps by hand is a pain. This plugin will create them dynamically and create a static xml page as well as a zipped version for lower bandwidth.

Twitter Tools

Twitter Tools integrates with Twitter by giving you the following functionality:
  • Archive your Twitter tweets (downloaded every 10 minutes)
  • Create a blog post from each of your tweets
  • Create a daily or weekly digest post of your tweets
  • Create a tweet on Twitter whenever you post in your blog, with a link to the blog post
  • Post a tweet from your sidebar
  • Post a tweet from the WP Admin screens
  • Pass your tweets along to another service (via API hook)
- http://alexking.org/projects/wordpress
More of my favorite plugins:
Saturday
Feb282009

latest twitter addict

I have made the jump into being a twitter addict.  Follow me at http://www.twitter.com/zarzax.

Tuesday
Dec022008

Mediawiki Skinning

I've been spending the last weeks finishing up a our redesign of the Nagios Network of sites (Nagios OSS Project, Nagios Community, Nagios Community Wiki). The wiki has been my latest challenge. I started our searching for a skin that was close to what I wanted and found the kindofblue skin. In the end I have ended up rewriting most of the php and css to come up with a fixed width theme that mixes well with the rest of our current look and feel. I will be posting our new theme soon. In the meantime you can check out the fruits of my labor here!

Page 1 ... 2 3 4 5 6