[Cerowrt-users] firewalling suggestion

[Marc MERLIN <marc@merlins.org>]

Howdy,

I like having my ssh port available on the internet side so that I can get
into my router from there if needed.

To do so, I had to edit /etc/xinetd.conf which prevents any connection from
outside to a bunch of services, including dropbear/ssh.

In turn, this enables a bunch of services to the internet, I'm not looking
at enabling, so I firewalled them with iptables.

But this brings the question: can the default config be fixed accordingly?
Firewalling with inetd and hosts.allow is so early 1990's :)

I changed the firewalling config as such:

config rule
        option src 'wan'
        option proto 'tcp udp'
        option target 'ACCEPT'
        option name 'allow outside mgmt'
        option dest_port '22 81 443'

config rule
        option src 'wan'
        option proto 'tcp udp'
        option name 'blockconfig'
        option target 'DROP'
        option dest_port '1-65535'

config rule
        option src 'guest'
        option proto 'tcp udp'
        option dest_port '80 81 137 138 139 445'
        option name 'blockconfig2'
        option target 'DROP'

This isn't one size fits all, but changing the default to allow all from xinetd, 
block all from wan, except a few services, is probably a good idea, no?

Marc
-- 
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems ....
                                      .... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/