2. Beyond Linux From Scratch 12.0
3. postlfs_security_iptables
4. Search

Filters

• Untranslated strings • state:empty
• Unfinished strings • state:<translated
• Translated strings • state:>=translated
• Strings marked for edit • state:needs-editing
• Strings with suggestions • has:suggestion
• Strings with variants • has:variant
• Strings with screenshots • has:screenshot
• Strings with labels • has:label
• Strings with context • has:context
• Unfinished strings without suggestions • state:<translated AND NOT has:suggestion
• Strings with comments • has:comment
• Strings with any failing checks • has:check
• Approved strings • state:approved
• Strings waiting for review • state:translated

state:>=translated

Position and priority

• Position and priority
• Position
• Priority
• Labels
• Source string
• Target string
• String age
• Last updated
• Number of words
• Number of comments
• Number of failing checks
• Key
• String location

	Translation	Source string	Target string
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	Configuring iptables	Configuration de iptables
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	Configuring iptables	Configurando iptables
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	In the following example configurations, <emphasis role="strong">LAN1</emphasis> is used for the internal LAN interface, and <emphasis role="strong">WAN1</emphasis> is used for the external interface connected to the Internet. You will need to replace these values with appropriate interface names for your system.	In the following example configurations, <emphasis role="strong">LAN1</emphasis> is used for the internal LAN interface, and <emphasis role="strong">WAN1</emphasis> is used for the external interface connected to the Internet. You will need to replace these values with appropriate interface names for your system.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	In the following example configurations, <emphasis role="strong">LAN1</emphasis> is used for the internal LAN interface, and <emphasis role="strong">WAN1</emphasis> is used for the external interface connected to the Internet. You will need to replace these values with appropriate interface names for your system.	Dans les exemples de configuration suivants, <emphasis role="strong">LAN1</emphasis> est utilisé pour l'interface LAN et <emphasis role="strong">WAN1</emphasis> pour l'interface externe connectée à Internet. Vous devrez remplacer ces valeurs avec les noms d'interfaces correspondants à votre système.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	In the following example configurations, <emphasis role="strong">LAN1</emphasis> is used for the internal LAN interface, and <emphasis role="strong">WAN1</emphasis> is used for the external interface connected to the Internet. You will need to replace these values with appropriate interface names for your system.	Nas seguintes configurações de exemplo, <emphasis role="strong">LAN1</emphasis> é usada para a interface interna da LAN e <emphasis role="strong">WAN1</emphasis> é usada para a interface externa conectada com a Internet. Você precisará substituir esses valores por nomes apropriados de interface para o seu sistema.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	Creating a Personal Firewall With iptables	Creating a Personal Firewall With iptables
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	Creating a Personal Firewall With iptables	Créer un pare-feu personnel avec iptables
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	Creating a Personal Firewall With iptables	Criando um Firewall Pessoal Com o iptables
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	Personal Firewall	Personal Firewall
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	Personal Firewall	Pare-feu personnel
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	Personal Firewall	Firewall Pessoal
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	A Personal Firewall is designed to let you access all the services offered on the Internet while keeping your computer secure and your data private.	A Personal Firewall is designed to let you access all the services offered on the Internet while keeping your computer secure and your data private.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	A Personal Firewall is designed to let you access all the services offered on the Internet while keeping your computer secure and your data private.	Un pare-feu personnel est conçu pour vous permettre d'accéder à tous les services offerts sur internet, mais de garder votre ordinateur sécurisé et vos données privées.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	A Personal Firewall is designed to let you access all the services offered on the Internet while keeping your computer secure and your data private.	Um Firewall Pessoal é projetado para permitir que você acesse todos os serviços oferecidos na Internet enquanto mantém o seu computador seguro e os seus dados privados.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	Below is a slightly modified version of Rusty Russell's recommendation from the <ulink url="https://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html"> Linux 2.4 Packet Filtering HOWTO</ulink>. It is still applicable to the Linux 5.x kernels.	Below is a slightly modified version of Rusty Russell's recommendation from the <ulink url="https://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html"> Linux 2.4 Packet Filtering HOWTO</ulink>. It is still applicable to the Linux 5.x kernels.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	Below is a slightly modified version of Rusty Russell's recommendation from the <ulink url="https://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html"> Linux 2.4 Packet Filtering HOWTO</ulink>. It is still applicable to the Linux 5.x kernels.	Voici une version légèrement modifiée de la recommandation de Rusty Russell sur <ulink url="https://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html">le guide de Packet Filter de Linux 2.4</ulink>. Elle est toujours d'actualité pour les noyaux 5.x.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	Below is a slightly modified version of Rusty Russell's recommendation from the <ulink url="https://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html"> Linux 2.4 Packet Filtering HOWTO</ulink>. It is still applicable to the Linux 5.x kernels.	Abaixo está uma versão ligeiramente modificada da recomendação do Rusty Russell oriunda do <ulink url="https://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html">Linux 2.4 Packet Filtering HOWTO</ulink>. Ela ainda é aplicável aos núcleos Linux 5.x.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin rc.iptables # Insert connection-tracking modules # (not needed if built into the kernel) modprobe nf_conntrack modprobe xt_LOG # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects # Do not send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface, where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians # be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # disable Explicit Congestion Notification # too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local-only connections iptables -A INPUT -i lo -j ACCEPT # Free output on any interface to any ip for any service # (equal to -P ACCEPT) iptables -A OUTPUT -j ACCEPT # Permit answers on already established connections # and permit new connections related to established ones # (e.g. port mode ftp) iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Drop any incoming MULTICAST or BROADCAST packet before logging: # The box outputs several of them when using netbios or mDNS, and those # appear immediately as incoming, which clutters the log. iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP # Log everything else. iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " # End $rc_base/rc.iptables</literal> EOF chmod 700 /etc/rc.d/rc.iptables</userinput>	<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin rc.iptables # Insert connection-tracking modules # (not needed if built into the kernel) modprobe nf_conntrack modprobe xt_LOG # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects # Do not send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface, where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians # be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # disable Explicit Congestion Notification # too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local-only connections iptables -A INPUT -i lo -j ACCEPT # Free output on any interface to any ip for any service # (equal to -P ACCEPT) iptables -A OUTPUT -j ACCEPT # Permit answers on already established connections # and permit new connections related to established ones # (e.g. port mode ftp) iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Drop any incoming MULTICAST or BROADCAST packet before logging: # The box outputs several of them when using netbios or mDNS, and those # appear immediately as incoming, which clutters the log. iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP # Log everything else. iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " # End $rc_base/rc.iptables</literal> EOF chmod 700 /etc/rc.d/rc.iptables</userinput>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin rc.iptables # Insert connection-tracking modules # (not needed if built into the kernel) modprobe nf_conntrack modprobe xt_LOG # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects # Do not send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface, where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians # be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # disable Explicit Congestion Notification # too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local-only connections iptables -A INPUT -i lo -j ACCEPT # Free output on any interface to any ip for any service # (equal to -P ACCEPT) iptables -A OUTPUT -j ACCEPT # Permit answers on already established connections # and permit new connections related to established ones # (e.g. port mode ftp) iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Drop any incoming MULTICAST or BROADCAST packet before logging: # The box outputs several of them when using netbios or mDNS, and those # appear immediately as incoming, which clutters the log. iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP # Log everything else. iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " # End $rc_base/rc.iptables</literal> EOF chmod 700 /etc/rc.d/rc.iptables</userinput>	<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Début de rc.iptables # Insertion des modules de suivie de connection # (inutile si vous les avez construit en dur dans le noyau) modprobe nf_conntrack modprobe xt_LOG # Activation de la protection contre echo en broadcast echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Désactivation des paquets routés à la source echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route # Activation de la protection du cookie TCP SYN echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Désactivation de l'acceptation des redirections ICMP echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects # Ne pas envoyer de messages de redirection echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Abandon des paquets spoofés qui arrivent sur une interface si une réponse # demanderait d'envoyer la réponse sur une autre interface. echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Enregistrement des paquets avec des adresses impossibles. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians # être verbeux pour les adresses dynamiques (inutile pour les adresses IP statiques) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # désactivation de la notification de congestion explicite # trop de routeurs les ignorent encore echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Appliquer un état connu iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # Ces lignes se trouvent ici au cas où les règles seraient déjà mises en place et que le # script est relancé à la volée. Nous voulons supprimer toutes les règles et # les chaînes personnalisées préexistantes avant d'implanter de nouvelles règles. iptables -F iptables -X iptables -Z iptables -t nat -F # Permettre les connections locales iptables -A INPUT -i lo -j ACCEPT # Libère la sortie sur toutes les interfaces vers n'importe quelle IP pour n'importe quel service # (équivalent à -P ACCEPT) iptables -A OUTPUT -j ACCEPT # Permet au réponses aux connections déjà établie et permet de nouvelles connections # liées à celles qui sont déjà établies # (p. ex. le mode port de ftp) iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Supprime tous les paquets MULTICAST ou BROADCAST entrants avant de journaliser : # Votre box en crée plusieurs lorsqu'elle utilise netbios ou mDNS, et ils apparaissent # immédiatement comme entrants, ce qui encombre les journaux. iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP # Enregistrer tout le reste. iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " # Find de $rc_base/rc.iptables</literal> EOF chmod 700 /etc/rc.d/rc.iptables</userinput>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin rc.iptables # Insert connection-tracking modules # (not needed if built into the kernel) modprobe nf_conntrack modprobe xt_LOG # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects # Do not send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface, where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians # be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # disable Explicit Congestion Notification # too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local-only connections iptables -A INPUT -i lo -j ACCEPT # Free output on any interface to any ip for any service # (equal to -P ACCEPT) iptables -A OUTPUT -j ACCEPT # Permit answers on already established connections # and permit new connections related to established ones # (e.g. port mode ftp) iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Drop any incoming MULTICAST or BROADCAST packet before logging: # The box outputs several of them when using netbios or mDNS, and those # appear immediately as incoming, which clutters the log. iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP # Log everything else. iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " # End $rc_base/rc.iptables</literal> EOF chmod 700 /etc/rc.d/rc.iptables</userinput>	<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Início do rc.iptables # Insere módulos de rastreamento de conexão # (não necessário se construído internamente ao kernel) modprobe nf_conntrack modprobe xt_LOG # Habilita difusão echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Desabilita Pacotes Fonte Roteados echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route # Habilita a Proteção SYN Cookie do TCP echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Desabilita a Aceitação de Redireção de ICMP echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects # Não envia Mensagens de Redireção echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Descarta Pacotes Falsificados entrantes em uma interface, onde as # respostas resultariam na resposta indo para uma interface diferente. echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Registra pacotes com endereços impossíveis. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians # Seja detalhado acerca de endereços de IP dinâmicos (não necessário no caso de IP estático) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # Desabilita a Notificação Explícita de Congestão # roteadores demais ainda são ignorantes echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Configura um estado conhecido iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # Estas linhas estão aqui no caso das regras já estiverem no lugar e o conjunto de comandos sequenciais for até mesmo # reexecutado em tempo real. Nós queremos remover todas as regras e cadeias preexistentes definidas por usuário(a) # antes de implementarmos novas regras. iptables -F iptables -X iptables -Z iptables -t nat -F # Permite conexões locais somente iptables -A INPUT -i lo -j ACCEPT # Libera a saída gerada em qualquer interface para qualquer IP para # qualquer serviço (igual a -P ACCEPT) iptables -A OUTPUT -j ACCEPT # Permite respostas em conexões já estabelecidas e permite novas # conexões relacionadas às estabelecidas (por exemplo, modo de porta # ftp) iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Descarte qualquer pacote MULTICAST ou BROADCAST entrante antes de registrar: # A caixa gera vários deles ao usar netbios ou mDNS e aqueles aparecem imediatamente # como entrantes, o que sobrecarrega o log. iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP # Registra tudo o mais. iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " # Fim do $rc_base/rc.iptables</literal> EOF chmod 700 /etc/rc.d/rc.iptables</userinput>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin /etc/systemd/scripts/iptables # Insert connection-tracking modules # (not needed if built into the kernel) modprobe nf_conntrack modprobe xt_LOG # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects # Do not send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface, where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians # be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # disable Explicit Congestion Notification # too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local-only connections iptables -A INPUT -i lo -j ACCEPT # Free output on any interface to any ip for any service # (equal to -P ACCEPT) iptables -A OUTPUT -j ACCEPT # Permit answers on already established connections # and permit new connections related to established ones # (e.g. port mode ftp) iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Log everything else. iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " # End /etc/systemd/scripts/iptables</literal> EOF chmod 700 /etc/systemd/scripts/iptables</userinput>	<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin /etc/systemd/scripts/iptables # Insert connection-tracking modules # (not needed if built into the kernel) modprobe nf_conntrack modprobe xt_LOG # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects # Do not send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface, where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians # be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # disable Explicit Congestion Notification # too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local-only connections iptables -A INPUT -i lo -j ACCEPT # Free output on any interface to any ip for any service # (equal to -P ACCEPT) iptables -A OUTPUT -j ACCEPT # Permit answers on already established connections # and permit new connections related to established ones # (e.g. port mode ftp) iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Log everything else. iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " # End /etc/systemd/scripts/iptables</literal> EOF chmod 700 /etc/systemd/scripts/iptables</userinput>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin /etc/systemd/scripts/iptables # Insert connection-tracking modules # (not needed if built into the kernel) modprobe nf_conntrack modprobe xt_LOG # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects # Do not send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface, where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians # be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # disable Explicit Congestion Notification # too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local-only connections iptables -A INPUT -i lo -j ACCEPT # Free output on any interface to any ip for any service # (equal to -P ACCEPT) iptables -A OUTPUT -j ACCEPT # Permit answers on already established connections # and permit new connections related to established ones # (e.g. port mode ftp) iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Log everything else. iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " # End /etc/systemd/scripts/iptables</literal> EOF chmod 700 /etc/systemd/scripts/iptables</userinput>	<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Début de /etc/systemd/scripts/iptables # Insertion des modules de suivie de connection # (inutile si vous les avez construit en dur dans le noyau) modprobe nf_conntrack modprobe xt_LOG # Activation de la protection contre echo en broadcast echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Désactivation des paquets routés à la source echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route # Activation de la protection du cookie TCP SYN echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Désactivation de l'acceptation des redirections ICMP echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects # Ne pas envoyer de messages de redirection echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Abandon des paquets spoofés qui arrivent sur une interface si une réponse # demanderait d'envoyer la réponse sur une autre interface. echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Enregistrement des paquets avec des adresses impossibles. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians # être verbeux pour les adresses dynamiques (inutile pour les adresses IP statiques) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # désactivation de la notification de congestion explicite # trop de routeurs les ignorent encore echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Appliquer un état connu iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # Ces lignes se trouvent ici au cas où les règles seraient déjà mises en place et que le # script est relancé à la volée. Nous voulons supprimer toutes les règles et # les chaînes personnalisées préexistantes avant d'implanter de nouvelles règles. iptables -F iptables -X iptables -Z iptables -t nat -F # Permettre les connections locales iptables -A INPUT -i lo -j ACCEPT # Libère la sortie sur toutes les interfaces vers n'importe quelle IP pour n'importe quel service # (équivalent à -P ACCEPT) iptables -A OUTPUT -j ACCEPT # Permet au réponses aux connections déjà établie et permet de nouvelles connections # liées à celles qui sont déjà établies # (p. ex. le mode port de ftp) iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Enregistrer tout le reste. iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " # Fin de /etc/systemd/scripts/iptables</literal> EOF chmod 700 /etc/systemd/scripts/iptables</userinput>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin /etc/systemd/scripts/iptables # Insert connection-tracking modules # (not needed if built into the kernel) modprobe nf_conntrack modprobe xt_LOG # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects # Do not send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface, where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians # be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # disable Explicit Congestion Notification # too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local-only connections iptables -A INPUT -i lo -j ACCEPT # Free output on any interface to any ip for any service # (equal to -P ACCEPT) iptables -A OUTPUT -j ACCEPT # Permit answers on already established connections # and permit new connections related to established ones # (e.g. port mode ftp) iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Log everything else. iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " # End /etc/systemd/scripts/iptables</literal> EOF chmod 700 /etc/systemd/scripts/iptables</userinput>	<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Início do /etc/systemd/scripts/iptables # Insere módulos de rastreamento de conexão (não necessário se # construído internamente ao kernel) modprobe nf_conntrack modprobe xt_LOG # Habilita difusão echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Desabilita Pacotes Fonte Roteados echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route # Habilita a Proteção SYN Cookie do TCP echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Desabilita a Aceitação de Redireção de ICMP echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects # Não envia Mensagens de Redireção echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Descarta Pacotes Falsificados entrantes em uma interface, onde as # respostas resultariam na resposta indo para uma interface diferente. echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Registra pacotes com endereços impossíveis. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians # Seja verboso acerca de endereços dinâmicos de IP (não necessário no caso de IP estático) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # Desabilita a Notificação Explícita de Congestão # roteadores demais ainda são ignorantes echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Configura um estado conhecido iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # Estas linhas estão aqui no caso das regras já estiverem no lugar e o script for mesmo # reexecutado em tempo real. Nós queremos remover todas as regras e cadeias preexistentes # definidas por usuário(a) antes de implementarmos novas regras. iptables -F iptables -X iptables -Z iptables -t nat -F # Permite conexões locais somente iptables -A INPUT -i lo -j ACCEPT # Libera a saída gerada em qualquer interface para qualquer IP para # qualquer serviço (igual a -P ACCEPT) iptables -A OUTPUT -j ACCEPT # Permite respostas em conexões já estabelecidas e permite novas # conexões relacionadas às estabelecidas (por exemplo, modo de porta # ftp) iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # Registra tudo o mais. iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " # Fim do /etc/systemd/scripts/iptables</literal> EOF chmod 700 /etc/systemd/scripts/iptables</userinput>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	This script is quite simple, it drops all traffic coming into your computer that wasn't initiated from your computer, but as long as you are simply surfing the Internet you are unlikely to exceed its limits.	This script is quite simple, it drops all traffic coming into your computer that wasn't initiated from your computer, but as long as you are simply surfing the Internet you are unlikely to exceed its limits.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	This script is quite simple, it drops all traffic coming into your computer that wasn't initiated from your computer, but as long as you are simply surfing the Internet you are unlikely to exceed its limits.	Ce script est assez simple, il jette tout le trafic entrant dans votre ordinateur s'il n'a pas été initié par votre ordinateur, mais tant que vous vous contentez de surfer sur internet, vous ne dépasserez pas les limites.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	This script is quite simple, it drops all traffic coming into your computer that wasn't initiated from your computer, but as long as you are simply surfing the Internet you are unlikely to exceed its limits.	Esse script é bastante simples; ele descarta todo o tráfego entrante no seu computador que não foi iniciado a partir do seu computador; porém, considerando que você está simplesmente surfando na Internet, é improvável que exceda os limites dele.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	If you frequently encounter certain delays at accessing FTP servers, take a look at <xref linkend="fw-BB-4-ipt"/>.	If you frequently encounter certain delays at accessing FTP servers, take a look at <xref linkend="fw-BB-4-ipt"/>.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	If you frequently encounter certain delays at accessing FTP servers, take a look at <xref linkend="fw-BB-4-ipt"/>.	Si vous rencontrez régulièrement des délais lors de l'accès à des serveurs FTP, regardez <xref linkend="fw-BB-4-ipt"/>.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	If you frequently encounter certain delays at accessing FTP servers, take a look at <xref linkend="fw-BB-4-ipt"/>.	Se você encontrar frequentemente certos atrasos ao acessar servidores FTP, [então] dê uma olhada em <xref linkend="fw-BB-4-ipt"/>.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	Even if you have daemons or services running on your system, these will be inaccessible everywhere but from your computer itself. If you want to allow access to services on your machine, such as <command>ssh</command> or <command>ping</command>, take a look at <xref linkend="fw-busybox-ipt"/>.	Even if you have daemons or services running on your system, these will be inaccessible everywhere but from your computer itself. If you want to allow access to services on your machine, such as <command>ssh</command> or <command>ping</command>, take a look at <xref linkend="fw-busybox-ipt"/>.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	Even if you have daemons or services running on your system, these will be inaccessible everywhere but from your computer itself. If you want to allow access to services on your machine, such as <command>ssh</command> or <command>ping</command>, take a look at <xref linkend="fw-busybox-ipt"/>.	Même si vous avez des démons ou des services qui tournent sur votre système, ils seront inaccessibles de n'importe où en dehors de l'ordinateur lui-même. Si vous voulez permettre l'accès aux services sur votre machine, comme <command>ssh</command> ou <command>ping</command>, regardez <xref linkend="fw-busybox-ipt"/>.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	Even if you have daemons or services running on your system, these will be inaccessible everywhere but from your computer itself. If you want to allow access to services on your machine, such as <command>ssh</command> or <command>ping</command>, take a look at <xref linkend="fw-busybox-ipt"/>.	Mesmo se você tiver processos de segundo plano ou serviços executando em seu sistema, esses estarão inacessíveis em todos os lugares, exceto a partir do seu próprio computador. Se quiser permitir o acesso a serviços na sua máquina, tais como o <command>ssh</command> ou o <command>ping</command>, [então] dê uma olhada em <xref linkend="fw-busybox-ipt"/>.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	Creating a Masquerading Router With iptables	Creating a Masquerading Router With iptables
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	Creating a Masquerading Router With iptables	Création d'un routeur masquant avec iptables
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	Creating a Masquerading Router With iptables	Criando um Roteador de Mascaramento Com o iptables
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	Masquerading Router	Masquerading Router
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	Masquerading Router	Routeur masquant
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	Masquerading Router	Roteador de Mascaramento
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	A Network Firewall has two interfaces, one connected to an intranet, in this example <emphasis role="strong">LAN1</emphasis>, and one connected to the Internet, here <emphasis role="strong">WAN1</emphasis>. To provide the maximum security for the firewall itself, make sure that there are no unnecessary servers running on it such as <application>X11</application>. As a general principle, the firewall itself should not access any untrusted service (think of a remote server giving answers that makes a daemon on your system crash, or even worse, that implements a worm via a buffer-overflow).	A Network Firewall has two interfaces, one connected to an intranet, in this example <emphasis role="strong">LAN1</emphasis>, and one connected to the Internet, here <emphasis role="strong">WAN1</emphasis>. To provide the maximum security for the firewall itself, make sure that there are no unnecessary servers running on it such as <application>X11</application>. As a general principle, the firewall itself should not access any untrusted service (think of a remote server giving answers that makes a daemon on your system crash, or even worse, that implements a worm via a buffer-overflow).
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	A Network Firewall has two interfaces, one connected to an intranet, in this example <emphasis role="strong">LAN1</emphasis>, and one connected to the Internet, here <emphasis role="strong">WAN1</emphasis>. To provide the maximum security for the firewall itself, make sure that there are no unnecessary servers running on it such as <application>X11</application>. As a general principle, the firewall itself should not access any untrusted service (think of a remote server giving answers that makes a daemon on your system crash, or even worse, that implements a worm via a buffer-overflow).	Un pare-feu réseau a deux interface, l'une connectée à un intranet, dans cet exemple <emphasis role="strong">LAN1</emphasis> et l'autre connectée à internet, ici <emphasis role="strong">WAN1</emphasis>. Pour fournir le plus de sécurité au pare-feu lui-même, assurez-vous qu'il n'y a pas de serveurs inutiles dessus comme <application>X11</application> et compagnie. En général, le pare-feu lui-même ne devrait pas accéder à des services qui ne sont pas de confiance (pensez à un serveur distant qui donne des réponses qui font crasher un démon de votre système, ou pire, qui implémente un vers via un dépassement de tampon).
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	A Network Firewall has two interfaces, one connected to an intranet, in this example <emphasis role="strong">LAN1</emphasis>, and one connected to the Internet, here <emphasis role="strong">WAN1</emphasis>. To provide the maximum security for the firewall itself, make sure that there are no unnecessary servers running on it such as <application>X11</application>. As a general principle, the firewall itself should not access any untrusted service (think of a remote server giving answers that makes a daemon on your system crash, or even worse, that implements a worm via a buffer-overflow).	Um Firewall de Rede de Comunicação tem duas interfaces, uma conectada com uma intranet, neste exemplo <emphasis role="strong">LAN1</emphasis> e uma conectada com a Internet, aqui <emphasis role="strong">WAN1</emphasis>. Para fornecer a máxima segurança para o próprio firewall, tenha certeza de que não existem servidores desnecessários executando nele, tais como o <application>X11</application>. Como um princípio geral, o próprio firewall não deveria acessar qualquer serviço não confiável (pense em um servidor remoto dando respostas que fazem com que um processo de segundo plano no seu sistema quebre; ou ainda pior, que implementa um verme via um estouro do buffer).
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin rc.iptables echo echo "You're using the example configuration for a setup of a firewall" echo "from Beyond Linux From Scratch." echo "This example is far from being complete, it is only meant" echo "to be a reference." echo "Firewall security is a complex issue, that exceeds the scope" echo "of the configuration rules below." echo "You can find additional information" echo "about firewalls in Chapter 4 of the BLFS book." echo "https://www.&lfs-domainname;/blfs" echo # Insert iptables modules (not needed if built into the kernel). modprobe nf_conntrack modprobe nf_conntrack_ftp modprobe xt_conntrack modprobe xt_LOG modprobe xt_state # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects # Don't send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians # Be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # Disable Explicit Congestion Notification # Too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local connections iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow forwarding if the initiated on the intranet iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT # Do masquerading # (not needed if intranet is not using private ip-addresses) iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE # Log everything for debugging # (last of all rules, but before policy rules) iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD " iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT " # Enable IP Forwarding echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal> EOF chmod 700 /etc/rc.d/rc.iptables</userinput>	<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin rc.iptables echo echo "You're using the example configuration for a setup of a firewall" echo "from Beyond Linux From Scratch." echo "This example is far from being complete, it is only meant" echo "to be a reference." echo "Firewall security is a complex issue, that exceeds the scope" echo "of the configuration rules below." echo "You can find additional information" echo "about firewalls in Chapter 4 of the BLFS book." echo "https://www.&lfs-domainname;/blfs" echo # Insert iptables modules (not needed if built into the kernel). modprobe nf_conntrack modprobe nf_conntrack_ftp modprobe xt_conntrack modprobe xt_LOG modprobe xt_state # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects # Don't send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians # Be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # Disable Explicit Congestion Notification # Too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local connections iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow forwarding if the initiated on the intranet iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT # Do masquerading # (not needed if intranet is not using private ip-addresses) iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE # Log everything for debugging # (last of all rules, but before policy rules) iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD " iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT " # Enable IP Forwarding echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal> EOF chmod 700 /etc/rc.d/rc.iptables</userinput>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin rc.iptables echo echo "You're using the example configuration for a setup of a firewall" echo "from Beyond Linux From Scratch." echo "This example is far from being complete, it is only meant" echo "to be a reference." echo "Firewall security is a complex issue, that exceeds the scope" echo "of the configuration rules below." echo "You can find additional information" echo "about firewalls in Chapter 4 of the BLFS book." echo "https://www.&lfs-domainname;/blfs" echo # Insert iptables modules (not needed if built into the kernel). modprobe nf_conntrack modprobe nf_conntrack_ftp modprobe xt_conntrack modprobe xt_LOG modprobe xt_state # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects # Don't send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians # Be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # Disable Explicit Congestion Notification # Too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local connections iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow forwarding if the initiated on the intranet iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT # Do masquerading # (not needed if intranet is not using private ip-addresses) iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE # Log everything for debugging # (last of all rules, but before policy rules) iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD " iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT " # Enable IP Forwarding echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal> EOF chmod 700 /etc/rc.d/rc.iptables</userinput>	<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Début de rc.iptables echo echo "Vous utilisez la configuration d'exemple de mise en place d'un pare-feu" echo "de Beyond Linux From Scratch." echo "Cet exemple est loin d'être complet, il n'est conçu que" echo "pour référence." echo "La sécurité des pare-feux est un problème complexe qui dépasse la portée" echo "des règles de configuration ci-dessous." echo "Vous trouverez des compléments d'information" echo "sur les pare-feux au chapitre 4 du livre BLFS." echo "https://www.&lfs-domainname;/blfs" echo # Insertion des modules iptables (inutile si vous les avez construits en dur dans le noyau). modprobe nf_conntrack modprobe nf_conntrack_ftp modprobe xt_conntrack modprobe xt_LOG modprobe xt_state # Activation de la protection contre echo en broadcast echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Désactivation des paquets routés à la source echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route # Activation de la protection du cookie TCP SYN echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Désactivation de l'acceptation des redirections ICMP echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects # Ne pas envoyer de messages de redirection echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Abandon des paquets spoofés qui arrivent sur une interface si une réponse # demanderait d'envoyer la réponse sur une autre interface. echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Enregistrement des paquets avec des adresses impossibles. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians # être verbeux pour les adresses dynamiques (inutile pour les adresses IP statiques) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # désactivation de la notification de congestion explicite # trop de routeurs les ignorent encore echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Appliquer un état connu iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # Ces lignes se trouvent ici au cas où les règles seraient déjà mises en place et que le # script est relancé à la volée. Nous voulons supprimer toutes les règles et # les chaînes personnalisées préexistantes avant d'implanter de nouvelles règles. iptables -F iptables -X iptables -Z iptables -t nat -F # Permettre les connections locales iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Permettre le transfert s'il est initié par l'intranet iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT # Effectuer le masquage # (pas requis si l'intranet n'utilise pas des adresses IP privéesf intranet is not using private ip-addresses) iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE # Tout enregistrer pour le débogage # (dernière de toutes les règles, mais avant les règles de politique) iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD " iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT " # Activation du transfert IP echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal> EOF chmod 700 /etc/rc.d/rc.iptables</userinput>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin rc.iptables echo echo "You're using the example configuration for a setup of a firewall" echo "from Beyond Linux From Scratch." echo "This example is far from being complete, it is only meant" echo "to be a reference." echo "Firewall security is a complex issue, that exceeds the scope" echo "of the configuration rules below." echo "You can find additional information" echo "about firewalls in Chapter 4 of the BLFS book." echo "https://www.&lfs-domainname;/blfs" echo # Insert iptables modules (not needed if built into the kernel). modprobe nf_conntrack modprobe nf_conntrack_ftp modprobe xt_conntrack modprobe xt_LOG modprobe xt_state # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects # Don't send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians # Be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # Disable Explicit Congestion Notification # Too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local connections iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow forwarding if the initiated on the intranet iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT # Do masquerading # (not needed if intranet is not using private ip-addresses) iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE # Log everything for debugging # (last of all rules, but before policy rules) iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD " iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT " # Enable IP Forwarding echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal> EOF chmod 700 /etc/rc.d/rc.iptables</userinput>	<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Início do rc.iptables echo echo "Você está usando a configuração de exemplo para uma configuração de um firewall" echo "oriunda do Beyond Linux From Scratch." echo "Este exemplo está longe de ser completo; ele é entendido para ser" echo "somente uma referência." echo "A segurança do firewall é um problema complexo, que excede o escopo" echo "das regras de configuração abaixo." echo "Você pode encontrar informação adicional" echo "acerca de firewalls no Capítulo 4 do livro BLFS." echo "https://www.&lfs-domainname;/blfs" echo # Insere módulos do iptables (não necessário se construído internamente ao kernel). modprobe nf_conntrack modprobe nf_conntrack_ftp modprobe xt_conntrack modprobe xt_LOG modprobe xt_state # Habilita difusão echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Desabilita Pacotes Fonte Roteados echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route # Habilita a Proteção SYN Cookie do TCP echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Desabilita a Aceitação de Redireção de ICMP echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects # Não envia Mensagens de Redireção echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Descarta Pacotes Falsificados entrantes em uma interface, onde as # respostas resultariam na resposta indo para uma interface diferente. echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Registra pacotes com endereços impossíveis. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians # Seja verboso a respeito de endereços dinâmicos de IP (não necessário no caso de IP estático) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # Desabilita a Notificação Explícita de Congestão # roteadores demais ainda são ignorantes echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Configura um estado conhecido iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # Estas linhas estão aqui no caso das regras já estiverem no lugar e o script for mesmo # reexecutado em tempo real. Nós queremos remover todas as regras e cadeias preexistentes # definidas por usuário(a) antes de implementarmos novas regras. iptables -F iptables -X iptables -Z iptables -t nat -F # Permite conexões locais iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Permite o encaminhamento se a iniciada na intranet iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT # Faz o mascaramento (não necessário se a intranet não estiver usando # endereços IP privados) iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE # Registra tudo para depuração (última de todas as regras, porém antes # das regras de política) iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD " iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT " # Habilita o Encaminhamento de IP echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal> EOF chmod 700 /etc/rc.d/rc.iptables</userinput>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin /etc/systemd/scripts/iptables echo echo "You're using the example configuration for a setup of a firewall" echo "from Beyond Linux From Scratch." echo "This example is far from being complete, it is only meant" echo "to be a reference." echo "Firewall security is a complex issue, that exceeds the scope" echo "of the configuration rules below." echo "You can find additional information" echo "about firewalls in Chapter 4 of the BLFS book." echo "https://www.&lfs-domainname;/blfs" echo # Insert iptables modules (not needed if built into the kernel). modprobe nf_conntrack modprobe nf_conntrack_ftp modprobe xt_conntrack modprobe xt_LOG modprobe xt_state # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects # Don't send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians # Be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # Disable Explicit Congestion Notification # Too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local connections iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow forwarding if the initiated on the intranet iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT # Do masquerading # (not needed if intranet is not using private ip-addresses) iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE # Log everything for debugging # (last of all rules, but before policy rules) iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD " iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT " # Enable IP Forwarding echo 1 &gt; /proc/sys/net/ipv4/ip_forward # The following sections allow inbound packets for specific examples # Uncomment the example lines and adjust as necessary # Allow ping on the external interface #iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT #iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT # Reject ident packets with TCP reset to avoid delays with FTP or IRC #iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset # Allow HTTP and HTTPS to 192.168.0.2 #iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 80 -j DNAT --to 192.168.0.2 #iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 443 -j DNAT --to 192.168.0.2 #iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 80 -j ACCEPT #iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 443 -j ACCEPT # End /etc/systemd/scripts/iptables</literal> EOF chmod 700 /etc/systemd/scripts/iptables</userinput>	<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin /etc/systemd/scripts/iptables echo echo "You're using the example configuration for a setup of a firewall" echo "from Beyond Linux From Scratch." echo "This example is far from being complete, it is only meant" echo "to be a reference." echo "Firewall security is a complex issue, that exceeds the scope" echo "of the configuration rules below." echo "You can find additional information" echo "about firewalls in Chapter 4 of the BLFS book." echo "https://www.&lfs-domainname;/blfs" echo # Insert iptables modules (not needed if built into the kernel). modprobe nf_conntrack modprobe nf_conntrack_ftp modprobe xt_conntrack modprobe xt_LOG modprobe xt_state # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects # Don't send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians # Be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # Disable Explicit Congestion Notification # Too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local connections iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow forwarding if the initiated on the intranet iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT # Do masquerading # (not needed if intranet is not using private ip-addresses) iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE # Log everything for debugging # (last of all rules, but before policy rules) iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD " iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT " # Enable IP Forwarding echo 1 &gt; /proc/sys/net/ipv4/ip_forward # The following sections allow inbound packets for specific examples # Uncomment the example lines and adjust as necessary # Allow ping on the external interface #iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT #iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT # Reject ident packets with TCP reset to avoid delays with FTP or IRC #iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset # Allow HTTP and HTTPS to 192.168.0.2 #iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 80 -j DNAT --to 192.168.0.2 #iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 443 -j DNAT --to 192.168.0.2 #iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 80 -j ACCEPT #iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 443 -j ACCEPT # End /etc/systemd/scripts/iptables</literal> EOF chmod 700 /etc/systemd/scripts/iptables</userinput>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin /etc/systemd/scripts/iptables echo echo "You're using the example configuration for a setup of a firewall" echo "from Beyond Linux From Scratch." echo "This example is far from being complete, it is only meant" echo "to be a reference." echo "Firewall security is a complex issue, that exceeds the scope" echo "of the configuration rules below." echo "You can find additional information" echo "about firewalls in Chapter 4 of the BLFS book." echo "https://www.&lfs-domainname;/blfs" echo # Insert iptables modules (not needed if built into the kernel). modprobe nf_conntrack modprobe nf_conntrack_ftp modprobe xt_conntrack modprobe xt_LOG modprobe xt_state # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects # Don't send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians # Be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # Disable Explicit Congestion Notification # Too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local connections iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow forwarding if the initiated on the intranet iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT # Do masquerading # (not needed if intranet is not using private ip-addresses) iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE # Log everything for debugging # (last of all rules, but before policy rules) iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD " iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT " # Enable IP Forwarding echo 1 &gt; /proc/sys/net/ipv4/ip_forward # The following sections allow inbound packets for specific examples # Uncomment the example lines and adjust as necessary # Allow ping on the external interface #iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT #iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT # Reject ident packets with TCP reset to avoid delays with FTP or IRC #iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset # Allow HTTP and HTTPS to 192.168.0.2 #iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 80 -j DNAT --to 192.168.0.2 #iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 443 -j DNAT --to 192.168.0.2 #iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 80 -j ACCEPT #iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 443 -j ACCEPT # End /etc/systemd/scripts/iptables</literal> EOF chmod 700 /etc/systemd/scripts/iptables</userinput>	<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Début de /etc/systemd/scripts/iptables echo echo "Vous utilisez la configuration d'exemple de mise en place d'un pare-feu" echo "de Beyond Linux From Scratch." echo "Cet exemple est loin d'être complet, il n'est conçu que" echo "pour référence." echo "La sécurité des pare-feux est un problème complexe qui dépasse la portée" echo "des règles de configuration ci-dessous." echo "Vous trouverez des compléments d'information" echo "sur les pare-feux au chapitre 4 du livre BLFS." echo "https://www.&lfs-domainname;/blfs" echo # Insertion des modules iptables (inutile si vous les avez construits en dur dans le noyau). modprobe nf_conntrack modprobe nf_conntrack_ftp modprobe xt_conntrack modprobe xt_LOG modprobe xt_state # Activation de la protection contre echo en broadcast echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Désactivation des paquets routés à la source echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route # Activation de la protection du cookie TCP SYN echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Désactivation de l'acceptation des redirections ICMP echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects # Ne pas envoyer de messages de redirection echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Abandon des paquets spoofés qui arrivent sur une interface si une réponse # demanderait d'envoyer la réponse sur une autre interface. echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Enregistrement des paquets avec des adresses impossibles. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians # être verbeux pour les adresses dynamiques (inutile pour les adresses IP statiques) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # désactivation de la notification de congestion explicite # trop de routeurs les ignorent encore echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Appliquer un état connu iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # Ces lignes se trouvent ici au cas où les règles seraient déjà mises en place et que le # script est relancé à la volée. Nous voulons supprimer toutes les règles et # les chaînes personnalisées préexistantes avant d'implanter de nouvelles règles. iptables -F iptables -X iptables -Z iptables -t nat -F # Permettre les connections locales iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Permettre le transfert s'il est initié par l'intranet iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT # Effectuer le masquage # (pas requis si l'intranet n'utilise pas des adresses IP privéesf intranet is not using private ip-addresses) iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE # Tout enregistrer pour le débogage # (dernière de toutes les règles, mais avant les règles de politique) iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD " iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT " # Activer le transfert IP echo 1 &gt; /proc/sys/net/ipv4/ip_forward # Les sections suivantes permettent les paquets entrants pour des exemples spécifiques # Décommentez les lignes d'exemple et ajustez-les au besoin # Permet le ping sur l'interface externe #iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT #iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT # Rejette les paquets ident avec un TCP reset pour éviter les délais avec FTP ou IRC #iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset # Permet HTTP et HTTPS vers 192.168.0.2 #iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 80 -j DNAT --to 192.168.0.2 #iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 443 -j DNAT --to 192.168.0.2 #iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 80 -j ACCEPT #iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 443 -j ACCEPT # Fin de /etc/systemd/scripts/iptables</literal> EOF chmod 700 /etc/systemd/scripts/iptables</userinput>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Begin /etc/systemd/scripts/iptables echo echo "You're using the example configuration for a setup of a firewall" echo "from Beyond Linux From Scratch." echo "This example is far from being complete, it is only meant" echo "to be a reference." echo "Firewall security is a complex issue, that exceeds the scope" echo "of the configuration rules below." echo "You can find additional information" echo "about firewalls in Chapter 4 of the BLFS book." echo "https://www.&lfs-domainname;/blfs" echo # Insert iptables modules (not needed if built into the kernel). modprobe nf_conntrack modprobe nf_conntrack_ftp modprobe xt_conntrack modprobe xt_LOG modprobe xt_state # Enable broadcast echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable Source Routed Packets echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route # Enable TCP SYN Cookie Protection echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Disable ICMP Redirect Acceptance echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects # Don't send Redirect Messages echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Drop Spoofed Packets coming in on an interface where responses # would result in the reply going out a different interface. echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Log packets with impossible addresses. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians # Be verbose on dynamic ip-addresses (not needed in case of static IP) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # Disable Explicit Congestion Notification # Too many routers are still ignorant echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Set a known state iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # These lines are here in case rules are already in place and the # script is ever rerun on the fly. We want to remove all rules and # pre-existing user defined chains before we implement new rules. iptables -F iptables -X iptables -Z iptables -t nat -F # Allow local connections iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow forwarding if the initiated on the intranet iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT # Do masquerading # (not needed if intranet is not using private ip-addresses) iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE # Log everything for debugging # (last of all rules, but before policy rules) iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD " iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT " # Enable IP Forwarding echo 1 &gt; /proc/sys/net/ipv4/ip_forward # The following sections allow inbound packets for specific examples # Uncomment the example lines and adjust as necessary # Allow ping on the external interface #iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT #iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT # Reject ident packets with TCP reset to avoid delays with FTP or IRC #iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset # Allow HTTP and HTTPS to 192.168.0.2 #iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 80 -j DNAT --to 192.168.0.2 #iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 443 -j DNAT --to 192.168.0.2 #iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 80 -j ACCEPT #iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 443 -j ACCEPT # End /etc/systemd/scripts/iptables</literal> EOF chmod 700 /etc/systemd/scripts/iptables</userinput>	<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF" <literal>#!/bin/sh # Inicia /etc/systemd/scripts/iptables echo echo "Você está usando a configuração de exemplo para uma configuração de um firewall" echo "oriunda do Beyond Linux From Scratch." echo "Este exemplo está longe de ser completo; ele é entendido para ser" echo "somente uma referência." echo "A segurança do firewall é um problema complexo, que excede o escopo" echo "das regras de configuração abaixo." echo "Você pode encontrar informação adicional" echo "acerca de firewalls no Capítulo 4 do livro BLFS." echo "https://www.&lfs-domainname;/blfs" echo # Insere módulos do iptables (não necessário se construído internamente ao núcleo). modprobe nf_conntrack modprobe nf_conntrack_ftp modprobe xt_conntrack modprobe xt_LOG modprobe xt_state # Habilita difusão echo Protection echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Desabilita Pacotes Fonte Roteados echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route # Habilitar Proteção de "Cookies" "SYN" do "TCP" echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies # Desabilitar Aceitação de Redirecionamento "ICMP" echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects # Não envia Mensagens de Redireção echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects # Descarta Pacotes Falsificados entrantes em uma interface, onde as # respostas resultariam na resposta indo para uma interface diferente. echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter # Registra pacotes com endereços impossíveis. echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians # Seja verboso a respeito de endereços de IP dinâmicos (não necessário no caso de IP estático) echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr # Desabilita a Notificação Explícita de Congestão # roteadores demais ainda são ignorantes echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn # Configura um estado conhecido iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # Estas linhas estão aqui no caso das regras já estiverem no lugar e o script for # mesmo reexecutado em tempo real. Nós queremos remover todas as regras e # cadeias preexistentes definidas por usuário(a) antes de implementarmos novas regras. iptables -F iptables -X iptables -Z iptables -t nat -F # Permite conexões locais iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Permite o encaminhamento se a iniciada na intranet iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT # Faz o mascaramento (não necessário se a intranet não estiver usando # endereços IP privados) iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE # Registra tudo para depuração (última de todas as regras, porém antes # das regras de política) iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD " iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT " # Habilita o Encaminhamento de IP echo 1 &gt; /proc/sys/net/ipv4/ip_forward # As seções seguintes permitem pacotes de entrada para exemplos específicos; # descomente as linhas de exemplo e ajuste conforme necessário # Permite ping na interface externa #iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT #iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT # Rejeita pacotes idênticos com reconfiguração de TCP para evitar atrasos com o FTP ou o IRC #iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset # Permite HTTP e HTTPS para 192.168.0.2 #iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 80 -j DNAT --to 192.168.0.2 #iptables -A PREROUTING -t nat -i WAN1 -p tcp --dport 443 -j DNAT --to 192.168.0.2 #iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 80 -j ACCEPT #iptables -A FORWARD -p tcp -d 192.168.0.2 --dport 443 -j ACCEPT # Termina /etc/systemd/scripts/iptables</literal> EOF chmod 700 /etc/systemd/scripts/iptables</userinput>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	With this script your intranet should be reasonably secure against external attacks. No one should be able to setup a new connection to any internal service and, if it's masqueraded, makes your intranet invisible to the Internet. Furthermore, your firewall should be relatively safe because there are no services running that a cracker could attack.	With this script your intranet should be reasonably secure against external attacks. No one should be able to setup a new connection to any internal service and, if it's masqueraded, makes your intranet invisible to the Internet. Furthermore, your firewall should be relatively safe because there are no services running that a cracker could attack.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	With this script your intranet should be reasonably secure against external attacks. No one should be able to setup a new connection to any internal service and, if it's masqueraded, makes your intranet invisible to the Internet. Furthermore, your firewall should be relatively safe because there are no services running that a cracker could attack.	Avec ce script votre intranet devrait être raisonnablement sécurisé contre les attaques externes. Personne ne devrait être capable d'initialiser une nouvelle connexion vers un service interne et, s'il est masquant, le pare-feu rend votre intranet invisible depuis internet. En plus, votre pare-feu devrait être relativement sécurisé parce qu'aucun service attaquable ne tourne dessus.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	With this script your intranet should be reasonably secure against external attacks. No one should be able to setup a new connection to any internal service and, if it's masqueraded, makes your intranet invisible to the Internet. Furthermore, your firewall should be relatively safe because there are no services running that a cracker could attack.	Com esse script sua intranet deveria estar razoavelmente segura contra ataques externos. Ninguém deveria estar apto(a) a configurar uma conexão nova para qualquer serviço interno e, se estiver mascarada, torna a sua intranet invisível para a Internet. Além disso, o seu firewall deveria estar relativamente a salvo, pois não existem serviços executando que um cracker pudesse atacar.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	Creating a BusyBox With iptables	Creating a BusyBox With iptables
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	Creating a BusyBox With iptables	Créer un BusyBox avec iptables
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	Creating a BusyBox With iptables	Criando um BusyBox Com o iptables
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	BusyBox	BusyBox
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	BusyBox	BusyBox
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	BusyBox	BusyBox
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	This scenario isn't too different from the <xref linkend="fw-masqRouter-ipt"/>, but additionally offers some services to your intranet. Examples of this can be when you want to administer your firewall from another host on your intranet or use it as a proxy or a name server.	This scenario isn't too different from the <xref linkend="fw-masqRouter-ipt"/>, but additionally offers some services to your intranet. Examples of this can be when you want to administer your firewall from another host on your intranet or use it as a proxy or a name server.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	This scenario isn't too different from the <xref linkend="fw-masqRouter-ipt"/>, but additionally offers some services to your intranet. Examples of this can be when you want to administer your firewall from another host on your intranet or use it as a proxy or a name server.	Ce scénario n'est pas très différent de <xref linkend="fw-masqRouter-ipt"/>, mais en plus fournit des services à votre intranet. C'est le cas par exemple si vous voulez administrer votre pare-feu depuis un autre hôte sur votre intranet ou si vous voulez l'utiliser comme proxy ou serveur de nom.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	This scenario isn't too different from the <xref linkend="fw-masqRouter-ipt"/>, but additionally offers some services to your intranet. Examples of this can be when you want to administer your firewall from another host on your intranet or use it as a proxy or a name server.	Este cenário não é muito diferente do <xref linkend="fw-masqRouter-ipt"/>, porém, adicionalmente, oferece alguns serviços para a sua intranet. Exemplos disto podem ser quando você quer administrar o seu firewall a partir de outro dispositivo na sua intranet ou usá-lo como um proxy ou como um servidor de nome.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	Outlining specifically how to protect a server that offers services on the Internet goes far beyond the scope of this document. See the references in <xref linkend="fw-extra-info"/> for more information.	Outlining specifically how to protect a server that offers services on the Internet goes far beyond the scope of this document. See the references in <xref linkend="fw-extra-info"/> for more information.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	Outlining specifically how to protect a server that offers services on the Internet goes far beyond the scope of this document. See the references in <xref linkend="fw-extra-info"/> for more information.	Expliquer comment protéger un serveur qui offre des services sur internet n'est pas du ressort de ce document. Consultez les références dans <xref linkend="fw-extra-info"/> pour plus d'informations.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	Outlining specifically how to protect a server that offers services on the Internet goes far beyond the scope of this document. See the references in <xref linkend="fw-extra-info"/> for more information.	Delinear especificamente como proteger um servidor que oferece serviços na Internet vai bem além do escopo deste documento. Vejam-se as referências em <xref linkend="fw-extra-info"/> para mais informação.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	Be cautious. Every service you have enabled makes your setup more complex and your firewall less secure. You are exposed to the risks of misconfigured services or running a service with an exploitable bug. A firewall should generally not run any extra services. See the introduction to the <xref linkend="fw-masqRouter-ipt"/> for some more details.	Be cautious. Every service you have enabled makes your setup more complex and your firewall less secure. You are exposed to the risks of misconfigured services or running a service with an exploitable bug. A firewall should generally not run any extra services. See the introduction to the <xref linkend="fw-masqRouter-ipt"/> for some more details.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	Be cautious. Every service you have enabled makes your setup more complex and your firewall less secure. You are exposed to the risks of misconfigured services or running a service with an exploitable bug. A firewall should generally not run any extra services. See the introduction to the <xref linkend="fw-masqRouter-ipt"/> for some more details.	Soyez prudent. Chaque service activé rend votre configuration plus complexe et votre pare-feu moins sécurisé. Vous vous exposez au risque d'avoir un service mal configuré ou de lancer un service avec un bogue exploitable. Un pare-feu ne devrait en général faire tourner aucun service supplémentaire. Consultez l'introduction de <xref linkend="fw-masqRouter-ipt"/> pour plus de détails.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	Be cautious. Every service you have enabled makes your setup more complex and your firewall less secure. You are exposed to the risks of misconfigured services or running a service with an exploitable bug. A firewall should generally not run any extra services. See the introduction to the <xref linkend="fw-masqRouter-ipt"/> for some more details.	Seja cauteloso(a). Cada serviço que você tenha habilitado torna a sua configuração mais complexa e o seu firewall menos seguro. Você está exposto(a) aos riscos dos serviços mal configurados ou de executar um serviço com um defeito explorável. Um firewall geralmente não deveria executar quaisquer serviços extras. Veja-se a introdução ao <xref linkend="fw-masqRouter-ipt"/> para mais alguns detalhes.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	If you want to add services such as internal Samba or name servers that do not need to access the Internet themselves, the additional statements are quite simple and should still be acceptable from a security standpoint. Just add the following lines into the script <emphasis>before</emphasis> the logging rules.	If you want to add services such as internal Samba or name servers that do not need to access the Internet themselves, the additional statements are quite simple and should still be acceptable from a security standpoint. Just add the following lines into the script <emphasis>before</emphasis> the logging rules.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	If you want to add services such as internal Samba or name servers that do not need to access the Internet themselves, the additional statements are quite simple and should still be acceptable from a security standpoint. Just add the following lines into the script <emphasis>before</emphasis> the logging rules.	Si vous voulez ajouter un service interne comme un serveur Samba ou un serveur de nom qui n'ont pas eux-même besoin d'accéder à internet, les règles supplémentaires sont assez simples et devraient toujours être acceptables du point de vue de la sécurité. Ajoutez simplement les lignes suivantes au script <emphasis>avant</emphasis> les règles de journalisation.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	If you want to add services such as internal Samba or name servers that do not need to access the Internet themselves, the additional statements are quite simple and should still be acceptable from a security standpoint. Just add the following lines into the script <emphasis>before</emphasis> the logging rules.	Se você quiser acrescentar serviços, tais como servidores internos Samba ou de nome, que não precisem acessar eles próprios a Internet, [então] as declarações adicionais são bastante simples e ainda deveriam ser aceitáveis a partir de um ponto de vista da segurança. Apenas acrescente as seguintes linhas no script <emphasis>antes</emphasis> das regras de registro.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	<literal>iptables -A INPUT -i ! WAN1 -j ACCEPT iptables -A OUTPUT -o ! WAN1 -j ACCEPT</literal>	<literal>iptables -A INPUT -i ! WAN1 -j ACCEPT iptables -A OUTPUT -o ! WAN1 -j ACCEPT</literal>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	<literal>iptables -A INPUT -i ! WAN1 -j ACCEPT iptables -A OUTPUT -o ! WAN1 -j ACCEPT</literal>	<literal>iptables -A INPUT -i ! WAN1 -j ACCEPT iptables -A OUTPUT -o ! WAN1 -j ACCEPT</literal>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	<literal>iptables -A INPUT -i ! WAN1 -j ACCEPT iptables -A OUTPUT -o ! WAN1 -j ACCEPT</literal>	<literal>iptables -A INPUT -i ! WAN1 -j ACCEPT iptables -A OUTPUT -o ! WAN1 -j ACCEPT</literal>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	If daemons, such as squid, have to access the Internet themselves, you could open OUTPUT generally and restrict INPUT.	If daemons, such as squid, have to access the Internet themselves, you could open OUTPUT generally and restrict INPUT.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	If daemons, such as squid, have to access the Internet themselves, you could open OUTPUT generally and restrict INPUT.	Si des démons, comme squid, doivent accéder à internet, vous pouvez ouvrir OUTPUT par défaut et restreindre INPUT.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	If daemons, such as squid, have to access the Internet themselves, you could open OUTPUT generally and restrict INPUT.	Se processos de segundo plano, tais como o squid, tiverem que acessar eles próprios a Internet, [então] você geralmente poderia abrir OUTPUT e restringir INPUT.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	<literal>iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -j ACCEPT</literal>	<literal>iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -j ACCEPT</literal>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	<literal>iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -j ACCEPT</literal>	<literal>iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -j ACCEPT</literal>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	<literal>iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -j ACCEPT</literal>	<literal>iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -j ACCEPT</literal>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	However, it is generally not advisable to leave OUTPUT unrestricted. You lose any control over trojans who would like to "call home", and a bit of redundancy in case you've (mis-)configured a service so that it broadcasts its existence to the world.	However, it is generally not advisable to leave OUTPUT unrestricted. You lose any control over trojans who would like to "call home", and a bit of redundancy in case you've (mis-)configured a service so that it broadcasts its existence to the world.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	However, it is generally not advisable to leave OUTPUT unrestricted. You lose any control over trojans who would like to "call home", and a bit of redundancy in case you've (mis-)configured a service so that it broadcasts its existence to the world.	Cependant, il n'est généralement pas recommandé de laisser OUTPUT sans restriction. Vous perdez le contrôle sur les chevaux de Troie qui aiment «&nbsp;appeler la maison&nbsp;» et une redondance dans la sécurité au cas où vous auriez mal configuré un service qui annoncerait sa présence au monde entier.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	However, it is generally not advisable to leave OUTPUT unrestricted. You lose any control over trojans who would like to "call home", and a bit of redundancy in case you've (mis-)configured a service so that it broadcasts its existence to the world.	Entretanto, geralmente não é aconselhável deixar OUTPUT irrestrito. Você perde algum controle sobre trojans que gostariam de "chamar home", e um monte de redundância no caso de você tiver (mal) configurado um serviço, de forma que difunda a existência dele para o mundo.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	To accomplish this, you should restrict INPUT and OUTPUT on all ports except those that it's absolutely necessary to have open. Which ports you have to open depends on your needs: mostly you will find them by looking for failed accesses in your log files.	To accomplish this, you should restrict INPUT and OUTPUT on all ports except those that it's absolutely necessary to have open. Which ports you have to open depends on your needs: mostly you will find them by looking for failed accesses in your log files.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	To accomplish this, you should restrict INPUT and OUTPUT on all ports except those that it's absolutely necessary to have open. Which ports you have to open depends on your needs: mostly you will find them by looking for failed accesses in your log files.	Pour cela, vous devriez restreindre INPUT et OUTPUT sur tous les ports sauf ceux qui sont absolument nécessaires. Les ports à ouvrir dépendent de vos besoins&nbsp;: vous les trouverez surtout en regardant les accès échoués dans vos journaux.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	To accomplish this, you should restrict INPUT and OUTPUT on all ports except those that it's absolutely necessary to have open. Which ports you have to open depends on your needs: mostly you will find them by looking for failed accesses in your log files.	Para realizar isso, você deveria restringir INPUT e OUTPUT em todas as portas, exceto naquelas que sejam absolutamente necessárias ter abertas. Quais portas você tem de abrir depende das suas necessidades: a maioria você as encontrará procurando por acessos falhos nos seus arquivos de registro.
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	Have a Look at the Following Examples:	Have a Look at the Following Examples:
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	Have a Look at the Following Examples:	Consultez les exemples suivants&nbsp;:
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	Have a Look at the Following Examples:	Dê Uma Olhada nos Seguintes Exemplos:
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	Squid is caching the web:	Squid is caching the web:
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	Squid is caching the web:	Squad crée un cache du web&nbsp;:
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	Squid is caching the web:	O Squid está armazenando a web em cache:
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	<literal>iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED \ -j ACCEPT</literal>	<literal>iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED \ -j ACCEPT</literal>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	<literal>iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED \ -j ACCEPT</literal>	<literal>iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED \ -j ACCEPT</literal>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	<literal>iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED \ -j ACCEPT</literal>	<literal>iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED \ -j ACCEPT</literal>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	Your caching name server (e.g., named) does its lookups via UDP:	Your caching name server (e.g., named) does its lookups via UDP:
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	Your caching name server (e.g., named) does its lookups via UDP:	Votre serveur de cache de noms de domaines (p. ex. named) lance ses requêtes en UDP&nbsp;:
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	Your caching name server (e.g., named) does its lookups via UDP:	Seu servidor de nome de cache (por exemplo, named) faz as pesquisas dele via UDP:
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	<literal>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT</literal>	<literal>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT</literal>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	<literal>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT</literal>	<literal>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT</literal>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — Portuguese (Brazil)	<literal>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT</literal>	<literal>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT</literal>
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — English	You want to be able to ping your computer to ensure it's still alive:	You want to be able to ping your computer to ensure it's still alive:
	Beyond Linux From Scratch 12.0/postlfs_security_iptables — French	You want to be able to ping your computer to ensure it's still alive:	Si vous voulez pouvoir envoyer un ping à votre ordinateur pour vous assurer qu'il est toujours lancé&nbsp;:

• 2 / 4
  / 4