FIREWALL linux (ubuntu)

[Pietia]

My question is what is the best firewall for ubuntu ? is there any protection against ping /ddos/dos ? xD I think there is not .i'm not experinced user of linux but i need just to be sure of that.

 

[Kayan]

Iptables?

 

[Dulin]

Iptables?

Is not required

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

 

[Dark Warrior]

@up
Thanks i didn know that

No more pings <;

 

[joffily]

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "1" > /proc/sys/net/ipv4/tcp_syncookies

iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD --protocol tcp --tcp-flags ALL SYN,ACK -j DROP
iptables -A FORWARD -m unclean -j DROP
iptables -N VALID_CHECK
iptables -A VALID_CHECK -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags ALL ALL -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags ALL FIN -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags ALL NONE -j DROP

 

[Dark Warrior]

@up Plx explain more for what are each command ):

 

[Kayan]

iptables -A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
iptables -A INPUT -f -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP

 

[kornholi]

Why are you disabling icmp echo replies?....

btw, PF is ze best fijahwall

ps: lol at kiel

 

[Pietia]

because of pingers ? u can ping some1 if u don't have this..

 

[kornholi]

What's wrong if someone pings you?...

 

[Kayan]

Kornholijo.

Why lol?

 

[Pietia]

well look out http://en.wikipedia.org/wiki/Ping_flood

 

[JayBeee]

... In english?

 

[kornholi]

well look out Ping flood - Wikipedia, the free encyclopedia

Like anyone does that anymore...

 

[Pietia]

yea it's in english i have edited the post

 

[ntmr]

Why are you disabling icmp echo replies?....

btw, PF is ze best fijahwall

ps: lol at kiel

ipfw :wub:

 

[Pietia]

Like anyone does that anymore...

yea now ddos rocks but im not exacly know how it works :> maybe u can explain me some things ?:d
edit :is there is any way to protect yourself from ddos attacks ?

 

[Pro Warbringer]

yea now ddos rocks but im not exacly know how it works :> maybe u can explain me some things ?:d
edit :is there is any way to protect yourself from ddos attacks ?

DDoS is when thousends or hungreds of computer are pinging you so your computer shuts down or your internet wont even respond on you it will tell's its BUSY etc....

 

[kornholi]

Your computer wont shut down, and DDoS is not pinging(icmp) but rather tcp syn/etc or udp flood..