Re: [Cerowrt-users] firewalling suggestion

[Dave Taht <dave.taht@gmail.com>]

you can allow in ssh in the specific /etc/xinet.d/ssh file.

On Sun, Nov 25, 2012 at 9:31 PM, Marc MERLIN <marc@merlins.org> wrote:
> Howdy,
>
> I like having my ssh port available on the internet side so that I can get
> into my router from there if needed.
>
> To do so, I had to edit /etc/xinetd.conf which prevents any connection from
> outside to a bunch of services, including dropbear/ssh.
>
> In turn, this enables a bunch of services to the internet, I'm not looking
> at enabling, so I firewalled them with iptables.
>
> But this brings the question: can the default config be fixed accordingly?
> Firewalling with inetd and hosts.allow is so early 1990's :)
>
> I changed the firewalling config as such:
>
> config rule
>         option src 'wan'
>         option proto 'tcp udp'
>         option target 'ACCEPT'
>         option name 'allow outside mgmt'
>         option dest_port '22 81 443'
>
> config rule
>         option src 'wan'
>         option proto 'tcp udp'
>         option name 'blockconfig'
>         option target 'DROP'
>         option dest_port '1-65535'
>
> config rule
>         option src 'guest'
>         option proto 'tcp udp'
>         option dest_port '80 81 137 138 139 445'
>         option name 'blockconfig2'
>         option target 'DROP'
>
> This isn't one size fits all, but changing the default to allow all from xinetd,
> block all from wan, except a few services, is probably a good idea, no?
>
> Marc
> --
> "A mouse is a device used to point at the xterm you want to type in" - A.S.R.
> Microsoft is to operating systems ....
>                                       .... what McDonalds is to gourmet cooking
> Home page: http://marc.merlins.org/
> _______________________________________________
> Cerowrt-users mailing list
> Cerowrt-users@lists.bufferbloat.net
> https://lists.bufferbloat.net/listinfo/cerowrt-users



-- 
Dave Täht

Fixing bufferbloat with cerowrt: http://www.teklibre.com/cerowrt/subscribe.html