[Cerowrt-users] firewalling suggestion

[Marc MERLIN]

On Sun, Nov 25, 2012 at 09:48:06PM +0100, Dave Taht wrote:
> you can allow in ssh in the specific /etc/xinet.d/ssh file.
 
Sure, I can do that.
But I don't get the point: why mix iptables firewalling and userspace IP
blocking in xinetd?

Marc

> On Sun, Nov 25, 2012 at 9:31 PM, Marc MERLIN <marc at merlins.org> wrote:
> > Howdy,
> >
> > I like having my ssh port available on the internet side so that I can get
> > into my router from there if needed.
> >
> > To do so, I had to edit /etc/xinetd.conf which prevents any connection from
> > outside to a bunch of services, including dropbear/ssh.
> >
> > In turn, this enables a bunch of services to the internet, I'm not looking
> > at enabling, so I firewalled them with iptables.
> >
> > But this brings the question: can the default config be fixed accordingly?
> > Firewalling with inetd and hosts.allow is so early 1990's :)
> >
> > I changed the firewalling config as such:
> >
> > config rule
> >         option src 'wan'
> >         option proto 'tcp udp'
> >         option target 'ACCEPT'
> >         option name 'allow outside mgmt'
> >         option dest_port '22 81 443'
> >
> > config rule
> >         option src 'wan'
> >         option proto 'tcp udp'
> >         option name 'blockconfig'
> >         option target 'DROP'
> >         option dest_port '1-65535'
> >
> > config rule
> >         option src 'guest'
> >         option proto 'tcp udp'
> >         option dest_port '80 81 137 138 139 445'
> >         option name 'blockconfig2'
> >         option target 'DROP'
> >
> > This isn't one size fits all, but changing the default to allow all from xinetd,
> > block all from wan, except a few services, is probably a good idea, no?
> >
> > Marc
> > --
> > "A mouse is a device used to point at the xterm you want to type in" - A.S.R.
> > Microsoft is to operating systems ....
> >                                       .... what McDonalds is to gourmet cooking
> > Home page: http://marc.merlins.org/
> > _______________________________________________
> > Cerowrt-users mailing list
> > Cerowrt-users at lists.bufferbloat.net
> > https://lists.bufferbloat.net/listinfo/cerowrt-users
> 
> 
> 
> -- 
> Dave Täht
> 
> Fixing bufferbloat with cerowrt: http://www.teklibre.com/cerowrt/subscribe.html
> 

-- 
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems ....
                                      .... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/