XPost: linux.debian.security

Hello All, I have taken up to writing this bash script to change my
iptables rules. It seems the only issue I've found is that it seems to
not want to connect to certain websites at some moments and not
others, or generally but sometimes it let's it through without
changing anything. This completely stops if I add RELATED to my OUTPUT
ACCEPT next to NEW, just not sure how that impacts security exactly.

Also, any advice on making this script better, or stronger per
secuirty, would be appreciated as this is both my first time scripting
in bash from scratch and my first IPTABLES venture.

Oh, and don't mind the echo lines, those are solely for my
entertainment upon running.

#!/bin/sh

IPT=/sbin/iptables
IP6=/sbin/ip6tables
echo "[+] ENTRY PLUG EJECTED,
READY FOR PILOT ENTRY"
read OK

echo " $OK ENTRY PLUG
INSERTION COMPLETE"

echo "[+] Flooding the cockpit with LCL. Don't try and hold your
breath, just breath normal. It's weird at first, but you'll get used
to it "

$IPT -F

$IPT -F -t nat

$IPT -X

echo "[+] Synch ratio 99%, within permissable parameters..."

$IP6 -P INPUT DROP

$IP6 -P FORWARD DROP

$IP6 -P OUTPUT DROP

$IPT -P INPUT DROP

$IPT -P FORWARD DROP

$IPT -P OUTPUT DROP
## INPUT Rules ###

echo "[+] AT Field is active, moving EVA UNIT 1 to elevator 24..."

$IPT -A INPUT -m conntrack --ctstate INVALID -j LOG --log-prefix "INVALID_DROPS" --log-ip-options --log-tcp-options

$IPT -A INPUT -m conntrack --ctstate NEW -j LOG --log-prefix
"NEW_DROPS" --log-ip-options --log-tcp-options

$IPT -A INPUT -m conntrack --ctstate INVALID -j DROP

$IPT -A INPUT -p icmp --icmp-type echo-request -j DROP

$IPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

$IPT -A INPUT --in-interface lo -j ACCEPT

$IPT -A INPUT -p tcp --dport 443 -j ACCEPT

$IPT -A INPUT -p tcp --dport 80 -j ACCEPT

## FORWARD Rules ##

#$IPT -A FORWARD -m conntrack --ctstate INVALID -j LOG --log-prefix "INVALID_FORWARD" --log-ip-options --log-tcp-options

#$IPT -A FORWARD -i lo -j ACCEPT

#$IPT -A FORWARD -m conntrack --ctstate INVALID -j DROP

#$IPT -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
## OUTPUT Rules ##

echo "[+] It's up to you now, Shinji..."

$IPT -A OUTPUT --out-interface lo -j ACCEPT # Allows ALL Loopback traffic

$IPT -A OUTPUT -m conntrack --ctstate NEW -j ACCEPT # Only allow NEW
connection outbound.

$IPT -A OUTPUT -p tcp -m multiport --dports 80,443 -m owner
--uid-owner privoxy -j ACCEPT # Allows Privoxy via HTTP and HTTPS

$IPT -A OUTPUT -p tcp --dport 443 -j ACCEPT # ACCEPT outbound https

$IPT -A OUTPUT -p tcp --dport 80 -j ACCEPT # ACCEPT outbound http (DO
NOT LEAVE ACTIVE!)

$IPT -A OUTPUT -m owner --uid-owner root -j ACCEPT # Allows ALL root requests

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

--===============5643835119707789979==
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

I'm not saying knowing iptables is bad, but Shorewall is much
better than these kind of things.

I think you may have some unlogged drops, that'd be the first
thing to check.


Ralph Sanchez <rwsanchez3@gmail.com> wrote:

Hello All, I have taken up to writing this bash script to
change my iptables rules. It seems the only issue I've found is
that it seems to not want to connect to certain websites at
some moments and not others, or generally but sometimes it
let's it through without changing anything. This completely
stops if I add RELATED to my OUTPUT ACCEPT next to NEW, just
not sure how that impacts security exactly.

Also, any advice on making this script better, or stronger per
secuirty, would be appreciated as this is both my first time
scripting in bash from scratch and my first IPTABLES venture.

Oh, and don't mind the echo lines, those are solely for my
entertainment upon running.

#!/bin/sh

IPT=/sbin/iptables
IP6=/sbin/ip6tables
echo "[+] ENTRY PLUG EJECTED, READY FOR PILOT ENTRY" read OK

echo " $OK ENTRY PLUG INSERTION COMPLETE"

echo "[+] Flooding the cockpit with LCL. Don't try and hold
your breath, just breath normal. It's weird at first, but
you'll get used to it "

$IPT -F

$IPT -F -t nat

$IPT -X

echo "[+] Synch ratio 99%, within permissable parameters..."

$IP6 -P INPUT DROP

$IP6 -P FORWARD DROP

$IP6 -P OUTPUT DROP

$IPT -P INPUT DROP

$IPT -P FORWARD DROP

$IPT -P OUTPUT DROP
## INPUT Rules ###

echo "[+] AT Field is active, moving EVA UNIT 1 to elevator
24..."

$IPT -A INPUT -m conntrack --ctstate INVALID -j LOG
--log-prefix "INVALID_DROPS" --log-ip-options --log-tcp-options

$IPT -A INPUT -m conntrack --ctstate NEW -j LOG --log-prefix
"NEW_DROPS" --log-ip-options --log-tcp-options

$IPT -A INPUT -m conntrack --ctstate INVALID -j DROP

$IPT -A INPUT -p icmp --icmp-type echo-request -j DROP

$IPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j
ACCEPT

$IPT -A INPUT --in-interface lo -j ACCEPT

$IPT -A INPUT -p tcp --dport 443 -j ACCEPT

$IPT -A INPUT -p tcp --dport 80 -j ACCEPT

## FORWARD Rules ##

#$IPT -A FORWARD -m conntrack --ctstate INVALID -j LOG
--log-prefix "INVALID_FORWARD" --log-ip-options
--log-tcp-options

#$IPT -A FORWARD -i lo -j ACCEPT

#$IPT -A FORWARD -m conntrack --ctstate INVALID -j DROP

#$IPT -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j
ACCEPT
## OUTPUT Rules ##

echo "[+] It's up to you now, Shinji..."

$IPT -A OUTPUT --out-interface lo -j ACCEPT # Allows ALL
Loopback traffic

$IPT -A OUTPUT -m conntrack --ctstate NEW -j ACCEPT # Only
allow NEW connection outbound.

$IPT -A OUTPUT -p tcp -m multiport --dports 80,443 -m owner
--uid-owner privoxy -j ACCEPT # Allows Privoxy via HTTP and
HTTPS

$IPT -A OUTPUT -p tcp --dport 443 -j ACCEPT # ACCEPT outbound
https

$IPT -A OUTPUT -p tcp --dport 80 -j ACCEPT # ACCEPT outbound
http (DO NOT LEAVE ACTIVE!)

$IPT -A OUTPUT -m owner --uid-owner root -j ACCEPT # Allows ALL
root requests

--===============5643835119707789979==
Content-Type: application/pgp-keys
Content-Transfer-Encoding: base64
Content-Id: 930e6ca
Content-Disposition: attachment;
filename="Encryption key for Jonathan Plews.asc"

LS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tClZlcnNpb246IEdudVBHIHYxCgpt UUVOQkZiWUhiVUJDQUN5R0FKejI4S2gydWc3RVdCQUFUYnVacDFQNXhGWDJmdGVkclZKc1duTDlD TDlrL1NNCmc5d2RYTUNDZXNKT1pHTVoydVpsb0NlL2lVM0NrZnJnR0RraDR3Rml1MjF0VmpzWWh0 a2lYYUt6WjRLL1dDb3oKZjVYMzJyMlRlcnBpa2R2R3hJV2VRT3YreitQTWZiQXcyNjQ1bnJRWHZv VnJrak1Md0VQS0FoZi9wTDlncnFZdQpIajZWL1JmL2Z6YVVneGh0aXpWOCsza1orY2c2SXdtYkFt R1lqUEFTTkpyMUM1Vll3WHNXbGhmbSttLzVxUmlYCm50UjFlbVNQblVobHRhd3dKNHh0TnBxWHdn RDJ4S24vU3E3NWJXQTZUWmFKYk0yVTZ0dHJwZm9oTC8xVVJGM1YKMm0rZXJySnhQQTN0NlZnVXFF dXpVcEM2N3JsUHIyY3UzQSt2QUJFQkFBRzBKa3B2Ym1GMGFHRnVJRkJzWlhkegpJRHhxYjI1aGRH aGhia0J3YkdWM2N5NXZjbWN1ZFdzK2lRRTRCQk1CQWdBaUJRSlcyQjIxQWhzREJnc0pDQWNECkFn WVZDQUlKQ2dzRUZnSURBUUllQVFJWGdBQUtDUkNTV1R3UGwzb1lQbU12Q0FDdGNQVGFhdnVRL1pQ N0lPSnMKUXlmd3NsRUJaQWpKS2JJaTB4c0llVSt5QjYvZkhpaG9iak5RbjZUYWZSOUpBNFEwUS9z bllXWXZ2UHlGT3pKcgpaMWhjKzF3NTRVTE51bEp5Yi9xSlE4RHNpUHBLWWttdjdBK3JYOUNJa0Zs SDVyRlVrTUFRZ1VLV0lrOUdQU3h6CjhmTHRkNG9YajF1cG9Zd3cwYU9GMm9SaGo3Sk9TdEl2Z1JW VVZzUWpCTjFISEtaOXhKZXR3Vjgrc1NNcnY0TG0KMURRZkF0Yk1OMm9Sdm9kQW83b3JwSTNsNndv VlRoOWx1dVRZRCt1QTJFUXpyMUhWYk1RNWd5RTVySERORFhobQo0R0hMWEhRYU9zaWtSYzdkYUQv THRGRmUrbmhka3g0WWxJZG9raUo0ZldQRkQ3V1RjQ0E4Um96YzROc3Rsc2hlClV6ZjN1UUVOQkZi WUhiVUJDQUNvbDBxRlhXc3RPN3hGZ2I0cTBBeTI4bE0yRjVBWktocG1mS1lpK1g5SGpuc0UKemtn U0dKRlZHbm5MLzdUVzVFRys1aGNUemNLTDNrN3VrSEF2UUdkWldmUlFWUlEwaUhHeE42UEJ3ZXdT TUpBTgpGUGgvY3h2QTdwUmd1bUhLTGFrWnVxQ1ZRRjN4eWJmQ3UyQnJVTCtZUCtQL2paN0E4YVVJ Zjkwc0M5ODZHb1A5CmJsK1o5eWs5dTJ1dURZc2RUWFk3MTEzb1VLSE9BaVZkRG81SDdQTk0yNmoy NUd4OGRsQTdtU2NTY0hUKzlwdWsKcGVDUFVVMFpzanhaOVcxeGNtV2toZ1AwejRKMkZBekFnL1lv UGhUWnZHMzJwbFMweFU2MG9DK3AyaTcwYnpJYgo3UGRQZklmeGJYcVg1UnZQZzRTVVI2UmEvU2N6 M3pEM0d3cWFtbHFoQUJFQkFBR0pBUjhFR0FFQ0FBa0ZBbGJZCkhiVUNHd3dBQ2drUWtsazhENWQ2 R0Q0TVZnZi9jWGhwdkorM0Y1ZnlzTUVBeiswR3ovMS95bUFIWS9ibEhoMnMKdG1KZHV1UjJBZE5i K0QzWnZpcThhYzNjWGVyaTJoUzMwVjhDOHRaTExJWU1EandjWUlVczJ4amRiV3dqZnZPcwpCTmNi SU5Cd29hRWJCcUpPZGZYUXdOS2c1aXBIMmFObkp1RlpmQWpwV3pPZmNFSW9hR25UUHBXSDBhN0ZX blIyCkl6ZjNwVWthT05DbTdsMGV3R00zV0trZnBBMytOMzUxWjFCcGswZURxSDZtUzd5ZUNPV1Zx NzRVSXZNREVQOGIKQktMV0JyTFFPQ3RKcEhZZHp2enliZlJ4ZWRlQTNZdXcwc1BGY3diNDJPNjJN YkVRSnQ5K01HMWJOWS9WTXE3SQpRRStqYlZLUDhOYjNEWXZhQ09HT0tiaGVmZEVQRVNIMERTNENk cWVGSk91R3ptbjFRZz09Cj11eVhuCi0tLS0tRU5EIFBHUCBQVUJMSUMgS0VZIEJMT0NLLS0tLS0K

--===============5643835119707789979==--

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAABAgAGBQJXQqqaAAoJEJJZPA+Xehg+xcgIALDbhxx+krR+JsnvmPAaBGbZ B0RkW/ku0LluyAlAMjSIqilIqZyfI3hkxFtkhLMD69D3n3w2Oma7FY7aFrM1fWBy eMcxikQOMPH7pljxG5SkmHvrj7D4W4lxvN0yys5GeYld91jhIvTNA58mghEx6Q+Z OgM/BLy+AW1repZJGrD/DbNtr5h589lPljNsVhiDDJofgR/dvR2PhrKpu43MYHS1 GfHRH9zQspsmseHivjClEvqUhREORgTiTqKK3/BcWcOjIhyTz7PoRhr+0thUGl6/ 5fzCGqRBA8rD/wLO5lg1Xf5f/96UcG4Z35QgZ8/OM6LLkfS39gd7h2xjcd6NJAA=
=WrMQ
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 2016-05-23 19:54, Ralph Sanchez wrote:

Yes, this is a personal laptop. If you notice, I have default POLICY
as DROP, which means if I don't accept on ports 80 and 443 I can't
accept HTTPS and HTTP, correct? I'm still learning how all this works,
but that's what it seemed to me and was explained in other guides and tutorials I needed to do. And if I don't ACCEPT there, i dont get any
web pages whatsoever so.

Whenever you perform an HTTP(S) request, the response should be treated
as RELATED, hence allowing all RELATED inbound traffic should suffice.

Thanks for the Advice on NEW, I haven't seen much said about it so
I'll take that advice and just enable RELATED as well, considering
that solves the biggest problem I had as far as still accessing the
web.

And as far as blocking outbound, I just don't see any reason to allow
any more data in or out at any moment then is absolutely needed, and
it should help mitigate some malicious software calling home even if
it does get through into my system.

It could still connect via 80,443. However, you are right, your setup
will block those malicious pieces of software, that do not try to use
those (and that do not gain root rights).

Thanks for the reading, that's where I'm heading now : )

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi,

I personally do not block outbound traffic at all, which in my opinion
does not impose a significant risk.

Furthermore, I do not see a good reason to allow all NEW connections
while blocking most RELATED ones. Usually it is done the other way
round: You decide upon a NEW connection whether it shall be allowed and
then you allow all RELATED traffic to pass as well.

In general I can only recommend the guides I (mainly) used: https://www.linode.com/docs/security/securing-your-server/ https://wiki.archlinux.org/index.php/Simple_stateful_firewall http://serverfault.com/questions/84963/why-not-block-icmp

By the way, is this a non-server machine? If so, why do you care about
the ports 80 and 443?

On 2016-05-23 01:30, Ralph Sanchez wrote:

Hello All, I have taken up to writing this bash script to change my
iptables rules. It seems the only issue I've found is that it seems to
not want to connect to certain websites at some moments and not
others, or generally but sometimes it let's it through without
changing anything. This completely stops if I add RELATED to my OUTPUT
ACCEPT next to NEW, just not sure how that impacts security exactly.

Also, any advice on making this script better, or stronger per
secuirty, would be appreciated as this is both my first time scripting
in bash from scratch and my first IPTABLES venture.

Oh, and don't mind the echo lines, those are solely for my
entertainment upon running.

#!/bin/sh

IPT=/sbin/iptables
IP6=/sbin/ip6tables
echo "[+] ENTRY PLUG EJECTED,
READY FOR PILOT ENTRY"
read OK

echo " $OK ENTRY PLUG
INSERTION COMPLETE"

echo "[+] Flooding the cockpit with LCL. Don't try and hold your
breath, just breath normal. It's weird at first, but you'll get used
to it "

$IPT -F

$IPT -F -t nat

$IPT -X

echo "[+] Synch ratio 99%, within permissable parameters..."

$IP6 -P INPUT DROP

$IP6 -P FORWARD DROP

$IP6 -P OUTPUT DROP

$IPT -P INPUT DROP

$IPT -P FORWARD DROP

$IPT -P OUTPUT DROP
## INPUT Rules ###

echo "[+] AT Field is active, moving EVA UNIT 1 to elevator 24..."

$IPT -A INPUT -m conntrack --ctstate INVALID -j LOG --log-prefix "INVALID_DROPS" --log-ip-options --log-tcp-options

$IPT -A INPUT -m conntrack --ctstate NEW -j LOG --log-prefix
"NEW_DROPS" --log-ip-options --log-tcp-options

$IPT -A INPUT -m conntrack --ctstate INVALID -j DROP

$IPT -A INPUT -p icmp --icmp-type echo-request -j DROP

$IPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

$IPT -A INPUT --in-interface lo -j ACCEPT

$IPT -A INPUT -p tcp --dport 443 -j ACCEPT

$IPT -A INPUT -p tcp --dport 80 -j ACCEPT

## FORWARD Rules ##

#$IPT -A FORWARD -m conntrack --ctstate INVALID -j LOG --log-prefix "INVALID_FORWARD" --log-ip-options --log-tcp-options

#$IPT -A FORWARD -i lo -j ACCEPT

#$IPT -A FORWARD -m conntrack --ctstate INVALID -j DROP

#$IPT -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
## OUTPUT Rules ##

echo "[+] It's up to you now, Shinji..."

$IPT -A OUTPUT --out-interface lo -j ACCEPT # Allows ALL Loopback traffic

$IPT -A OUTPUT -m conntrack --ctstate NEW -j ACCEPT # Only allow NEW connection outbound.

$IPT -A OUTPUT -p tcp -m multiport --dports 80,443 -m owner
--uid-owner privoxy -j ACCEPT # Allows Privoxy via HTTP and HTTPS

$IPT -A OUTPUT -p tcp --dport 443 -j ACCEPT # ACCEPT outbound https

$IPT -A OUTPUT -p tcp --dport 80 -j ACCEPT # ACCEPT outbound http (DO
NOT LEAVE ACTIVE!)

$IPT -A OUTPUT -m owner --uid-owner root -j ACCEPT # Allows ALL root requests

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Mon, May 23, 2016 at 4:13 PM, <deb023@respiranto.de> wrote:

On 2016-05-23 19:54, Ralph Sanchez wrote:

Yes, this is a personal laptop. If you notice, I have default POLICY
as DROP, which means if I don't accept on ports 80 and 443 I can't
accept HTTPS and HTTP, correct? I'm still learning how all this works,
but that's what it seemed to me and was explained in other guides and
tutorials I needed to do. And if I don't ACCEPT there, i dont get any
web pages whatsoever so.

> Whenever you perform an HTTP(S) request, the response should be treated

as RELATED, hence allowing all RELATED inbound traffic should suffice.

So, would it be better to not based any outgoing connections of
stateful connections and simply just allow it via port, since either
way the port is doing to allow both wanted traffic and possible
subversion, if malicious software passed the input? Or maybe put the
443 ACCEPT before the stateful filtering, and only allow established
state?

Thanks for the Advice on NEW, I haven't seen much said about it so
I'll take that advice and just enable RELATED as well, considering
that solves the biggest problem I had as far as still accessing the
web.

And as far as blocking outbound, I just don't see any reason to allow
any more data in or out at any moment then is absolutely needed, and
it should help mitigate some malicious software calling home even if
it does get through into my system.

It could still connect via 80,443. However, you are right, your setup
will block those malicious pieces of software, that do not try to use
those (and that do not gain root rights).

Yeah, i wasn't sure whether i should leave those options in or just go
off stateful...see previous statement. Also, if something gain root
rights in my system, then I've got more problems then a faulty
firewall.

Thanks for the reading, that's where I'm heading now : )

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Thanks for the clarification : ) And you didn't confuse the two
explicitly, but i wasn't sure if you were advising allow NEW,RELATED/ NEW,ESTABLISHED or ESTABLISHED,RELATED on outbound packet, but now I
know.

I have read through quite a few manuals and online forums, although no RFCs...I'm not really sure I know what they are even haha. I have
configured myself pretty wall, editing PAM and my sysctl.conf file
rigourously, BIOS passwording and denying USB boots without admin
access to the BIOS, as well as other various activities including
attempting to configure SELinux, which is nigh impossible to do it and
have it have any effect on Jessie right now, at least as far as me and
someone else could find.

I have noticed that DROP on invalid first actually drops more packets
then simply allowing Established, related...does this imply a packet
can have more then one state??

On Mon, May 23, 2016 at 5:20 PM, Einhard Leichtfuß <el@respiranto.de> wrote:

On 2016-05-23 22:32, Ralph Sanchez wrote:

On Mon, May 23, 2016 at 4:13 PM, <deb023@respiranto.de> wrote:

On 2016-05-23 19:54, Ralph Sanchez wrote:

Yes, this is a personal laptop. If you notice, I have default POLICY
as DROP, which means if I don't accept on ports 80 and 443 I can't
accept HTTPS and HTTP, correct? I'm still learning how all this works, >>>> but that's what it seemed to me and was explained in other guides and
tutorials I needed to do. And if I don't ACCEPT there, i dont get any
web pages whatsoever so.

Whenever you perform an HTTP(S) request, the response should be treated
as RELATED, hence allowing all RELATED inbound traffic should suffice.

So, would it be better to not based any outgoing connections of
stateful connections and simply just allow it via port, since either
way the port is doing to allow both wanted traffic and possible
subversion, if malicious software passed the input? Or maybe put the
443 ACCEPT before the stateful filtering, and only allow established
state?

As I said, I would simply allow all RELATED (and ESTABLISHED btw.) in-
and outbound connections. I might have mixed up RELATED and ESTABLISHED
at little in the former emails, by the way. Apart from that, you may
block as much as you want. And I would suggest blocking any other INPUT (except for icmp (possibly partly) and lo). But again, if you really
want to secure your box, take the time to thoroughly read a few manuals
and possibly even a few RFCs.

Thanks for the Advice on NEW, I haven't seen much said about it so
I'll take that advice and just enable RELATED as well, considering
that solves the biggest problem I had as far as still accessing the
web.

And as far as blocking outbound, I just don't see any reason to allow
any more data in or out at any moment then is absolutely needed, and
it should help mitigate some malicious software calling home even if
it does get through into my system.

It could still connect via 80,443. However, you are right, your setup
will block those malicious pieces of software, that do not try to use
those (and that do not gain root rights).

Yeah, i wasn't sure whether i should leave those options in or just go
off stateful...see previous statement. Also, if something gain root
rights in my system, then I've got more problems then a faulty
firewall.

Thanks for the reading, that's where I'm heading now : )

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 2016-05-23 23:28, Ralph Sanchez wrote:

Thanks for the clarification : ) And you didn't confuse the two
explicitly, but i wasn't sure if you were advising allow NEW,RELATED/ NEW,ESTABLISHED or ESTABLISHED,RELATED on outbound packet, but now I
know.

I have read through quite a few manuals and online forums, although no RFCs...I'm not really sure I know what they are even haha. I have
configured myself pretty wall, editing PAM and my sysctl.conf file rigourously, BIOS passwording and denying USB boots without admin
access to the BIOS, as well as other various activities including
attempting to configure SELinux, which is nigh impossible to do it and
have it have any effect on Jessie right now, at least as far as me and someone else could find.

I have noticed that DROP on invalid first actually drops more packets
then simply allowing Established, related...does this imply a packet
can have more then one state??

No (though I don't know about DNAT and SNAT), hence it must be due to
other rules.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 2016-05-23 22:32, Ralph Sanchez wrote:

On Mon, May 23, 2016 at 4:13 PM, <deb023@respiranto.de> wrote:

On 2016-05-23 19:54, Ralph Sanchez wrote:

Yes, this is a personal laptop. If you notice, I have default POLICY
as DROP, which means if I don't accept on ports 80 and 443 I can't
accept HTTPS and HTTP, correct? I'm still learning how all this works,
but that's what it seemed to me and was explained in other guides and
tutorials I needed to do. And if I don't ACCEPT there, i dont get any
web pages whatsoever so.

Whenever you perform an HTTP(S) request, the response should be treated
as RELATED, hence allowing all RELATED inbound traffic should suffice.

So, would it be better to not based any outgoing connections of
stateful connections and simply just allow it via port, since either
way the port is doing to allow both wanted traffic and possible
subversion, if malicious software passed the input? Or maybe put the
443 ACCEPT before the stateful filtering, and only allow established
state?

As I said, I would simply allow all RELATED (and ESTABLISHED btw.) in-
and outbound connections. I might have mixed up RELATED and ESTABLISHED
at little in the former emails, by the way. Apart from that, you may
block as much as you want. And I would suggest blocking any other INPUT
(except for icmp (possibly partly) and lo). But again, if you really
want to secure your box, take the time to thoroughly read a few manuals
and possibly even a few RFCs.

Thanks for the Advice on NEW, I haven't seen much said about it so
I'll take that advice and just enable RELATED as well, considering
that solves the biggest problem I had as far as still accessing the
web.

And as far as blocking outbound, I just don't see any reason to allow
any more data in or out at any moment then is absolutely needed, and
it should help mitigate some malicious software calling home even if
it does get through into my system.

It could still connect via 80,443. However, you are right, your setup
will block those malicious pieces of software, that do not try to use
those (and that do not gain root rights).

Yeah, i wasn't sure whether i should leave those options in or just go
off stateful...see previous statement. Also, if something gain root
rights in my system, then I've got more problems then a faulty
firewall.

Thanks for the reading, that's where I'm heading now : )

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 2016-05-24 00:01, Ralph Sanchez wrote:

Also, it seems if I only allow Related and Established on OUTPUT I
cannot access the internet, 90 percent of packets get dropped when I
try to connect to anything, but allowing new established allows connection...but also any software would be able to call home.

That is correct behaviour, since there always needs to be a NEW
connection before any other may be RELATED or ESTABLISHED. Hence, if you
want to block outgoing traffic, you should allow at least ports 80 and
443 as you did before.

I assume you want your browser to be ablte to call anywhere, right?
Hence also home. Who tells you, that your browser is not a malicious
program? Or run by such a program?

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Also, it seems if I only allow Related and Established on OUTPUT I
cannot access the internet, 90 percent of packets get dropped when I
try to connect to anything, but allowing new established allows connection...but also any software would be able to call home.

On Mon, May 23, 2016 at 5:28 PM, Ralph Sanchez <rwsanchez3@gmail.com> wrote:

Thanks for the clarification : ) And you didn't confuse the two
explicitly, but i wasn't sure if you were advising allow NEW,RELATED/ NEW,ESTABLISHED or ESTABLISHED,RELATED on outbound packet, but now I
know.

I have read through quite a few manuals and online forums, although no RFCs...I'm not really sure I know what they are even haha. I have
configured myself pretty wall, editing PAM and my sysctl.conf file rigourously, BIOS passwording and denying USB boots without admin
access to the BIOS, as well as other various activities including
attempting to configure SELinux, which is nigh impossible to do it and
have it have any effect on Jessie right now, at least as far as me and someone else could find.

I have noticed that DROP on invalid first actually drops more packets
then simply allowing Established, related...does this imply a packet
can have more then one state??

On Mon, May 23, 2016 at 5:20 PM, Einhard Leichtfuß <el@respiranto.de> wrote:

On 2016-05-23 22:32, Ralph Sanchez wrote:

On Mon, May 23, 2016 at 4:13 PM, <deb023@respiranto.de> wrote:

On 2016-05-23 19:54, Ralph Sanchez wrote:

Yes, this is a personal laptop. If you notice, I have default POLICY >>>>> as DROP, which means if I don't accept on ports 80 and 443 I can't
accept HTTPS and HTTP, correct? I'm still learning how all this works, >>>>> but that's what it seemed to me and was explained in other guides and >>>>> tutorials I needed to do. And if I don't ACCEPT there, i dont get any >>>>> web pages whatsoever so.

Whenever you perform an HTTP(S) request, the response should be treated >>>> as RELATED, hence allowing all RELATED inbound traffic should suffice.

So, would it be better to not based any outgoing connections of
stateful connections and simply just allow it via port, since either
way the port is doing to allow both wanted traffic and possible
subversion, if malicious software passed the input? Or maybe put the
443 ACCEPT before the stateful filtering, and only allow established
state?

As I said, I would simply allow all RELATED (and ESTABLISHED btw.) in-
and outbound connections. I might have mixed up RELATED and ESTABLISHED
at little in the former emails, by the way. Apart from that, you may
block as much as you want. And I would suggest blocking any other INPUT
(except for icmp (possibly partly) and lo). But again, if you really
want to secure your box, take the time to thoroughly read a few manuals
and possibly even a few RFCs.

Thanks for the Advice on NEW, I haven't seen much said about it so
I'll take that advice and just enable RELATED as well, considering
that solves the biggest problem I had as far as still accessing the
web.

And as far as blocking outbound, I just don't see any reason to allow >>>>> any more data in or out at any moment then is absolutely needed, and >>>>> it should help mitigate some malicious software calling home even if >>>>> it does get through into my system.

It could still connect via 80,443. However, you are right, your setup
will block those malicious pieces of software, that do not try to use
those (and that do not gain root rights).

Yeah, i wasn't sure whether i should leave those options in or just go
off stateful...see previous statement. Also, if something gain root
rights in my system, then I've got more problems then a faulty
firewall.

Thanks for the reading, that's where I'm heading now : )

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)