Apache Firewall Script

[rhonneil]

Hi Gurus,

Anyone here has a working firewall script for Apache Webserver that they can share? Or perhaps, comment on my script?

I have a script but doesn't allow my clients to access my webserver.

First here's my initial firewall entries:

IPADDR=`ifconfig eth0 | fgrep -i inet | cut -d : -f 2 | cut -d " " -f 1`

EXTERNAL_INTERFACE="eth0"
LOOPBACK_INTERFACE="lo"
LOCAL_INTERFACE_1="eth1" # Internal LAN interface
INTRANET="192.168.0.0/16" # Private IP Addr Range
PRIMARY_NAMESERVER="203.x.x.3"
SECONDARY_NAMESERVER="203.x.x.4"
LOOPBACK="127.0.0.0/8"

Now, here's my firewall rule for apache:

# ------------------------------------------------------------------
# HTTP client (80)
# ------------------------------------------------------------------

iptables -A INPUT -i $EXTERNAL_INTERFACE -p tcp ! --syn \
--source-port 80 \
-d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp \
-s $IPADDR --source-port $UNPRIVPORTS \
--destination-port 80 -j ACCEPT

I will appreciate any help.

Thanks alot!

[demian]

Just to make sure I understand your setup: You're running a firewall on the same machine that acts as webserver and the IP of that machine is $IPADDR.

iptables -A INPUT -i $EXTERNAL_INTERFACE -p tcp ! --syn --source-port 80 -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

First: [...] -p tcp ! --syn [...]

Why did you do that? A packet with the syn flag is the first packet in a tcp/ip handshake that requests a new connection to be established. If you deny these packets (! --syn -j ACCEPT is the same as --syn -j DROP (provided your default policy for the INPUT chain is DROP)) no connections will ever be established.

Also what's up with your ports? We're talking about a webserver here, right? --source-port 80 should be --destination-port 80

Third: Are your client sitting on the LAN (and thus access the web server via $LOCAL_INTERFACE) or do they come from the outside?

iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp \
-s $IPADDR --source-port $UNPRIVPORTS \
--destination-port 80 -j ACCEPT

This allows http connections from the webserver to other webservers. Is that what you want?

Also, what's $UNPRIVPORTS?