Bekijk de volledige versie : firewall help??
these worms stuff really slowing down lots of my network traffic.
after fixing one pc, there come another ones...
it's endless job when the users doesnt know how to block those worms using firewall...
so, i plan to make it on router side.
which is on the linksys and wl500g.
but, i'm no linux expert also...
so, anyone please help..
how do i set up rules like these:
1. block all local connection (ie, from ip 192.168.1.100 to 192.168.1.200, etc..) because it's use only for internet
2. the only local connection allow is off course, between routers (linksys,wl500g,etc..)
3a. allow only certain ports to the internet (like web, proxy, mail: 80,3128,8080,110,25,etc) and block all the rest
OR
3b. block all ports that are known used by worms/virus/etc and allow all the rest
4. limit max connection allowed per ip address?
5. attack detection. if too many connection comes from an ip, that ip is block for few seconds. if the connection is on certain ports, that port blocked for few minutes.
6. send an alert about those attack. either to an email address and/or using windows' net send protocol to the 'infected' ip and admin's ip
t.i.a.
1. block all local connection (ie, from ip 192.168.1.100 to 192.168.1.200, etc..) because it's use only for internetGive each PC a different subnet (Don't use DHCP, but assign static IP's instead). That way they don't see eachother.
2. the only local connection allow is off course, between routers (linksys,wl500g,etc..)Because all pc's are connected using a switch in the router, this is impossible.
3a. allow only certain ports to the internet (like web, proxy, mail: 80,3128,8080,110,25,etc) and block all the rest
OR
3b. block all ports that are known used by worms/virus/etc and allow all the restEnable the internet firewall in the router. This will block all incoming connections. Use iptables to block all outgoing traffic unless it's originating from the ports you've given. As I'm not an iptables expert, I can't give you the correct rules.
4. limit max connection allowed per ip address?
5. attack detection. if too many connection comes from an ip, that ip is block for few seconds. if the connection is on certain ports, that port blocked for few minutes. I have no idea how this should be accomplished, and it's not a common construction I think. Do you really need this?
6. send an alert about those attack. either to an email address and/or using windows' net send protocol to the 'infected' ip and admin's ipYou can log all dropped packets into the syslog and use some sort of remote syslog analyser to perform that action.
Other things:
If you use Windows XP (I guess you do):
- Install SP2
- Enable Windows firewall
- Install an virusscanner and use it's protection options (run-time scanning)
- Install MS AntiSpyware and LavaSoft AdAware and scan multiple times
- Enable automatic security updates
Give each PC a different subnet (Don't use DHCP, but assign static IP's instead). That way they don't see eachother.
Because all pc's are connected using a switch in the router, this is impossible.
in my configuration, all pc use usb wifi and the routers is only used for repeater
Enable the internet firewall in the router. This will block all incoming connections. Use iptables to block all outgoing traffic unless it's originating from the ports you've given. As I'm not an iptables expert, I can't give you the correct rules.
yes, me too... know very little about iptables.
so. very much help needed here.
I have no idea how this should be accomplished, and it's not a common construction I think. Do you really need this?
yes this is quite important.
it even does some sort of QoS.
coz, this way, only the infected pc slowed down and all other pc can connect nicely to the internet.
You can log all dropped packets into the syslog and use some sort of remote syslog analyser to perform that action.
Other things:
If you use Windows XP (I guess you do):
- Install SP2
- Enable Windows firewall
- Install an virusscanner and use it's protection options (run-time scanning)
- Install MS AntiSpyware and LavaSoft AdAware and scan multiple times
- Enable automatic security updates
yes i have to go through all pc to do this and re-check this every once a while to make sure some 'smart' users dont change anything ...
this is what i does and waste lots of time.
that's why i need to do things in the router and sets it once and for all...
iptables is not really that hard. There is a good and extensive tutorial here:
http://iptables-tutorial.frozentux.net/iptables-tutorial.html
Start by looking at how the tables are traversed. And then see the targets and finally how commands are built.
As for blocking pc's between 100-200 you can:
-block all 192.168.1.x except a few that you specify (that have static adresses).
-use a clever subnetmask. (100-200 won't be possible, but all bigger then 32 or 64 or 128)
B.
PS: Some staring hints: http://wl500g.info/showthread.php?p=16014#post16014