Cisco zone based firewall

! Basic Configuration 

NET(config)#in et 1/1
NET(config-if)#ip address 200.1.1.1 255.255.255.0
NET(config-if)#no shutdown
NET(config-if)#in lo 1
NET(config-if)#ip address 8.8.8.8 255.255.255.255
NET(config-if)#in lo 2
NET(config-if)#ip address 4.2.2.2 255.255.255.255
NET(config-if)#exit
NET(config)#ip dhcp excluded-address 200.1.1.1 200.1.1.10
NET(config)#ip dhcp pool DHCP-1
NET(dhcp-config)#dns-server 8.8.8.8
NET(dhcp-config)#domain-name ITTSM.BLOGSPOT.COM
NET(dhcp-config)#default-router 200.1.1.1
NET(dhcp-config)#network 200.1.1.0 255.255.255.0

ZBF(config)#in eth 1/1
ZBF(config-if)#no shutdown
ZBF(config-if)#description WAN
ZBF(config-if)#ip address dhcp
ZBF(config)#in eth 0/3
ZBF(config-if)#des LAN
ZBF(config-if)#no shutdown
ZBF(config-if)#ip address 10.1.1.1 255.255.255.0
ZBF(config-if)#exit
ZBF(config)#ip access-list extended NAT
ZBF(config-ext-nacl)#permit ip 10.1.1.0 0.0.0.255 any
ZBF(config-ext-nacl)#exit
ZBF(config)#in eth 0/3
ZBF(config-if)#ip nat inside
ZBF(config-if)#in eth 1/1
ZBF(config-if)#ip nat outside
ZBF(config-if)#exit
ZBF(config)#ip nat inside source list NAT interface eth 1/1 overload

PC(config)#in eth 0/3
PC(config-if)#ip address 10.1.1.10 255.255.255.0
PC(config-if)#no shutdown
PC(config-if)#exit
PC(config)#no ip routing
PC(config)#ip default-gateway 10.1.1.1
PC#ping 10.1.1.1
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 104/312/1136 ms
PC#ping 4.2.2.2
Sending 5, 100-byte ICMP Echos to 4.2.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 104/312/1136 ms

! Check NAT Service
ZBF#show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
icmp 200.1.1.11:2      10.1.1.10:2        4.2.2.2:2          4.2.2.2:2
icmp 200.1.1.11:3      10.1.1.10:3        4.2.2.2:3          4.2.2.2:3
icmp 200.1.1.11:4      10.1.1.10:4        8.8.8.8:4          8.8.8.8:4
icmp 200.1.1.11:5      10.1.1.10:5        8.8.8.8:5          8.8.8.8:5

! Configure Zone Base Firewall
ZBF(config)#zone security IN
ZBF(config-sec-zone)#exit
ZBF(config)#zone security OUT
ZBF(config-sec-zone)#exit

ZBF(config)#in ethernet 1/1
ZBF(config-if)#zone-member security OUT
ZBF(config-if)#in ethernet 0/3
ZBF(config-if)#zone-member security IN

ZBF(config)#zone-pair security IN-OUT source IN destination OUT
ZBF(config-sec-zone-pair)#exit

ZBF(config)#class-map type inspect match-any ALL
ZBF(config-cmap)#match protocol tcp
ZBF(config-cmap)#match protocol udp
ZBF(config-cmap)#match protocol icmp

ZBF(config)#policy-map type inspect POLICY
ZBF(config-pmap)#class ALL
ZBF(config-pmap-c)#inspect
ZBF(config-pmap-c)#exit
ZBF(config-pmap)#exit
ZBF(config)#zone-pair security IN-OUT source IN destination OUT
ZBF(config-sec-zone-pair)#service-policy type inspect POLICY

! Check Commands

ZBF#show zone-pair security
Zone-pair name IN-OUT
    Source-Zone IN  Destination-Zone OUT
    service-policy POLICY


ZBF#show policy-map type inspect
  Policy Map type inspect POLICY
    Class ALL
      Inspect
    Class class-default
      Drop

ZBF#show policy-map type inspect zone-pair
policy exists on zp IN-OUT
  Zone-pair: IN-OUT
  Service-policy inspect : POLICY
    Class-map: ALL (match-any)
      Match: protocol tcp
        1 packets, 24 bytes
        30 second rate 0 bps
      Match: protocol udp
        0 packets, 0 bytes
        30 second rate 0 bps
      Match: protocol icmp
        2 packets, 160 bytes
        30 second rate 0 bps
   Inspect
        Packet inspection statistics [process switch:fast switch]
        tcp packets: [0:20]
        icmp packets: [0:20]
        Session creations since subsystem startup or last reset 3
        Current session counts (estab/half-open/terminating) [0:0:0]
        Maxever session counts (estab/half-open/terminating) [2:1:1]
        Last session created 00:00:11
        Last statistic reset never
        Last session creation rate 3
        Maxever session creation rate 3
        Last half-open session total 0
        TCP reassembly statistics
        received 0 packets out-of-order; dropped 0
        peak memory usage 0 KB; current usage: 0 KB
        peak queue length 0
    Class-map: class-default (match-any)
      Match: any
      Drop
        0 packets, 0 bytes

ZBF#show policy-firewall session
        Session B24D87E8 (10.1.1.10:8)=>(4.2.2.2:0) icmp SIS_OPEN
          Created 00:00:01, Last heard 00:00:00
          ECHO request
          Bytes sent (initiator:responder) [28152:28152]
      Established Sessions = 1

ZBF#show policy-firewall session
        Session B24D8E98 (10.1.1.10:46048)=>(200.1.1.1:23) tcp SIS_OPEN/TCP_ESTAB
          Created 00:00:07, Last heard 00:00:02
          Bytes sent (initiator:responder) [95:248]
      Established Sessions = 1

ZBF#show policy-firewall session zone-pair
 Zone-pair: IN-OUT
  Service-policy inspect : POLICY
    Class-map : ALL(match-any)
      Established Sessions =  1
        Session B24D8E98 (10.1.1.10:46048)=>(200.1.1.1:23) tcp SIS_OPEN/TCP_ESTAB
          Created 00:00:45, Last heard 00:00:40
          Bytes sent (initiator:responder) [95:248]
    Class-map : class-default(match-any)

ZBF#show policy-firewall stats
Global Stats:
        Packet inspection statistics [process switch:fast switch]
        tcp packets: [0:169]
        icmp packets: [0:4020]
        Session creations since subsystem startup or last reset 6
        Current session counts (estab/half-open/terminating) [1:0:0]
        Maxever session counts (estab/half-open/terminating) [2:1:1]
        Last session created 00:01:25
        Last statistic reset never
        Last session creation rate 0
        Maxever session creation rate 3
        Last half-open session total 0

ZBF#show policy-firewall config zone
Zone: self
  Description: System defined zone

Zone: IN
  Member Interfaces:
    Ethernet0/3
  Member of Zone-pairs:
    Zone IN is source of Zone-pair IN-OUT

Zone: OUT
  Member Interfaces:
    Ethernet1/1
  Member of Zone-pairs:
    Zone OUT is destination of Zone-pair IN-OUT

ZBF#show policy-firewall stats drop-counters
DROP action found in policy-map                            4

ZBF#show policy-firewall mib connection-statistics policy POLICY zone-pair IN-OUT L4-Protocol all
Policy Target Protocol Based Connection Summary Stats
------------------------------------------------------
Policy                                            POLICY
Zone-Pair                                         IN-OUT
------------------------------------------------------
Protocol                                          icmp
Connections Attempted                             4
Connections Setup Aborted                         0
Connections Policy Declined                       0
Connections Resource Declined                     0
Connections Half Open                             0
Connections Active                                0
Connections Aborted                               0
------------------------------------------------------
Protocol                                          tcp
Connections Attempted                             2
Connections Setup Aborted                         0
Connections Policy Declined                       0
Connections Resource Declined                     0
Connections Half Open                             0
Connections Active                                0
Connections Aborted                               0
------------------------------------------------------

ZBF#show policy-firewall mib connection-statistics policy POLICY zone-pair IN-OUT L7-Protocol all
Policy Target Protocol Based Connection Summary Stats
------------------------------------------------------
Policy                                            POLICY
Zone-Pair                                         IN-OUT
------------------------------------------------------
Protocol                                          telnet
Connections Attempted                             2
Connections Setup Aborted                         0
Connections Policy Declined                       0
Connections Resource Declined                     0
Connections Half Open                             0
Connections Active                                0
Connections Aborted                               0
------------------------------------------------------

ZBF#show policy-firewall config
Zone: self
  Description: System defined zone

Zone: IN
  Member Interfaces:
    Ethernet0/3

Zone: OUT
  Member Interfaces:
    Ethernet1/1

Zone-pair              : IN-OUT
Source Zone            : IN
Destination Zone       : OUT
Service-policy inspect : POLICY
  Class-map : ALL(match-any)
  Action : inspect

  Class-map : class-default(match-any)
  Action : drop log

Parameter-map Config:
 Global:
  alert on
  sessions maximum 2147483647
  waas disabled
  l2-transparent dhcp-passthrough disabled
  log dropped-packets disabled
  log summary disabled
  max-incomplete low 2147483647
  max-incomplete high 2147483647
  one-minute low 2147483647
  one-minute high 2147483647
  tcp reset-PSH disabled
 Default:
  audit-trail off
  alert on
  max-incomplete low 2147483647
  max-incomplete high 2147483647
  one-minute low 2147483647
  one-minute high 2147483647
  udp idle-time 30
  icmp idle-time 10
  dns-timeout 5
  tcp idle-time 3600
  tcp finwait-time 5
  tcp synwait-time 30
  tcp max-incomplete host 4294967295 block-time 0
  sessions maximum 2147483647

Secure Server With IPT

#!/bin/bash

###
### IPTables config file
###
### define variables
###

### path to iptables
IPT=/sbin/iptables

### This contains a list of approved Debian sites to get software updates.
DEBIAN_SITES=('194.109.137.218' '212.219.56.139' '212.219.56.133' '212.219.56.134' '212.219.56.135' '212.219.56.138')

### This contains the authorised DNS servers configured in /etc/resolv.conf.
DNS_SERVERS=('8.8.8.8' '4.4.4.4')

### This is a list of external IPs that you want to allow ssh access from.
OTHER_GATEWAYS=('')

### This is a list of hosts authorised to try ICMP probes to check if the
### server is running. This could be your ISP's IPs
CONTROL_GATEWAYS=('')

### Types of ICMP probes to allow from the previous servers
ICMP_TYPES=('echo-reply' 'destination-unreachable' 'echo-request' 'ttl-exceeded')

#### NTP servers for time synch
NTP_SERVERS=('')

### ---------------------- do not change below this line
###
### INPUT
###
### will flush the chains or all rules one by one. Therefore all new rules will be created.
$IPT -F

### allows inbound packets to be processed
$IPT -P INPUT ACCEPT

### drops packets so that they can not come through one interface and flow out of another.
$IPT -P FORWARD DROP

### This allows outbound packets to be processed
$IPT -P OUTPUT ACCEPT

### allows ICMP types (defined above) for hosts in the control list
for IP in ${CONTROL_GATEWAYS[@]}; do
for ICMP in ${ICMP_TYPES[@]}; do
$IPT -A INPUT -s $IP -p icmp --icmp-type $ICMP -j ACCEPT
done
done

### this accepts connections for http and https access from anywhere
$IPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

### this allows remote administration using ssh from your other gateways.
for IP in ${OTHER_GATEWAYS[@]}; do
$IPT -A INPUT -s $IP -p tcp -m tcp --dport 22 -j ACCEPT
done

### this allows packets to start a new connection or allows packets that are
### already associated with a connection, required for stateful inspection.
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

### this allows NTP traffic from NTP server
for NTP in ${NTP_SERVERS[@]}; do
$IPT -A INPUT -s $NTP -p udp -m udp --sport 123 -j ACCEPT
done

### we are about to drop everything else, so first log the discarded traffic
### just in case we want to know what *they* are trying.
$IPT -A INPUT -j LOG

### this drops any traffic that does not match to the INPUT rules
$IPT -A INPUT -j DROP
###
### OUTPUT
###
### Allows traffic to authorised DNS servers
for IP in ${DNS_SERVERS[@]}; do
$IPT -A OUTPUT -d $IP -p udp -m udp --dport 53 -j ACCEPT
done

### Allows http traffic to debain sites for software updates.
### Initial config rule
for IP in ${DEBIAN_SITES[@]}; do
$IPT -A OUTPUT -d $IP -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
done

### this allows packets to start a new connection or allows packets that are
### already associated with a connection, required for stateful inspection.
$IPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

### this allows NTP traffic to the NTP servers
for NTP in ${NTP_SERVERS[@]}; do
$IPT -A OUTPUT -d $NTP -p udp -m udp --dport 123 -j ACCEPT
done

### this logs all OUTPUT traffic that does not match the rules before it beign
### dropped.
$IPT -A OUTPUT -j LOG

### this drops any traffic that does not match to the OUTPUT rules
$IPT -A OUTPUT -j DROP

# ------------------------------------- Done!

Install This Script.
cp firewall.sh /etc/init.d/firewall.sh
cd /etc/init.d/
chmod +x firewall.sh
update-rc.d firewall.sh defaults

If you ever want to remove it from the boot sequence just issue:-

update-rc.d -f firewall.sh remove

Iptables

### Flush the selected chain (all the chains in the table if none is given). This is equivalent to deleting all the rules one by one.

iptables -F

### SYN Flood Attack

Attack:
hping3 --flood –S –p 80 192.168.0.1

To defend against SYN Flood Attack:
iptables -N syn_flood 
iptables -A INPUT -p tcp --syn -j syn_flood 
iptables -A syn_flood -m limit --limit 1/s --limit-burst 3 -j RETURN 
iptables -A syn_flood -j DROP 

### UDP Flood Attack
Attack:
hping3 –p 80 –i u1000 --udp 192.168.0.1 

To defend against UDP Flood Attack:
iptables -N udp_flood 
iptables -A INPUT -p udp -j udp_flood 
iptables -A udp_flood -m state –state NEW –m recent –update –seconds 1 –hitcount 10 -j RETURN 
iptables -A udp_flood -j DROP 

### ICMP Flood Attack 
Attack:
hping3 –p 80 --flood --icmp 192.168.0.1

To defend against ICMP Flood Attack: 
iptables -N icmp_flood 
iptables -A INPUT -p icmp -j icmp_flood 
iptables -A icmp_flood -m limit --limit 1/s --limit-burst 3 -j RETURN 
iptables -A icmp_flood -j DROP 

### DROP INCOMING MALFORMED XMAS PACKETS:
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

### DROP OUTGOING MALFORMED XMAS PACKETS:
iptables -A OUTPUT -p tcp --tcp-flags ALL ALL -j DROP

### DROP OUTGOING MALFORMED NULL PACKETS:
iptables -A OUTPUT -p tcp --tcp-flags ALL NONE -j DROP

### DROP INCOMING MALFORMED NULL PACKETS:
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

### DROP INVALID SYN PACKETS:
iptables -A OUTPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
iptables -A OUTPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A OUTPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

### DROP PACKETS WITH INCOMING FRAGMENTS. THIS ATTACK RESULT INTO LINUX SERVER PANIC SUCH DATA LOSS
iptables -A INPUT -f -j DROP

### MAKE SURE NEW INCOMING TCP CONNECTIONS ARE SYN PACKETS; OTHERWISE WE NEED TO DROP THEM 
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

### ALLOW ONLY ESTABLISHED, RELATED:
iptables -A INPUT -p tcp -i $PUBIF -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p udp -i $PUBIF -m state --state ESTABLISHED,RELATED -j ACCEPT

### Drop Ping from address-mask-request

iptables -A INPUT -p icmp -m icmp --icmp-type address-mask-request -j DROP

### Drop Ping from timestamp-request

iptables -A INPUT -p icmp -m icmp --icmp-type timestamp-request -j DROP

### Drop Rate Limit Ping from outside

iptables -A INPUT -p icmp -m icmp -m limit --limit 1/second -j ACCEPT

### DROP INVALID
iptables -A INPUT -m state --state INVALID -j DROP

### Block a specific ip-address
BLOCK_THIS_IP="x.x.x.x"
iptables -A INPUT -s "$BLOCK_THIS_IP" -j DROP

### Allow ALL incoming SSH
#iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

### Allow incoming SSH only from a sepcific network
#iptables -A INPUT -i eth0 -p tcp -s 192.168.200.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

### Allow incoming HTTP
#iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

### Allow incoming HTTPS
#iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

### MultiPorts (Allow incoming SSH, HTTP, and HTTPS)
iptables -A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport --sports 22,80,443 -m state --state ESTABLISHED -j ACCEPT

### Allow outgoing SSH
iptables -A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

### Allow outgoing SSH only to a specific network
#iptables -A OUTPUT -o eth0 -p tcp -d 192.168.101.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

### Allow outgoing HTTPS
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

### Load balance incoming HTTPS traffic
#iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 0 -j DNAT --to-destination 192.168.1.101:443
#iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 1 -j DNAT --to-destination 192.168.1.102:443
#iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 2 -j DNAT --to-destination 192.168.1.103:443

### Ping from inside to outside
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

### Ping from outside to inside
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT

### Allow IMAP and IMAPS
iptables -A INPUT -i eth0 -p tcp --dport 143 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 143 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -i eth0 -p tcp --dport 993 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 993 -m state --state ESTABLISHED -j ACCEPT

### Allow POP3 and POP3S
iptables -A INPUT -i eth0 -p tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -i eth0 -p tcp --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT

### Port forwarding 422 to 22
iptables -t nat -A PREROUTING -p tcp -d 192.168.102.37 --dport 422 -j DNAT --to 192.168.102.37:22
iptables -A INPUT -i eth0 -p tcp --dport 422 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 422 -m state --state ESTABLISHED -j ACCEPT

### Allow loopback access
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

### Allow packets from internal network to reach external network.
# if eth1 is connected to external network (internet)
# if eth0 is connected to internal network (Lan)
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

### Allow outbound DNS
iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT

### Allow SSL Packets
iptables -A INPUT -p tcp -m tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
### Allow SMTP packets
iptables -A OUTPUT -o eth0 -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT


### Reject Invalid networks (Spoof)

iptables -A INPUT -s 10.0.0.0/8       -j DROP
iptables -a INPUT -s 192.0.0.1/24     -j DROP
iptables -A INPUT -s 169.254.0.0/16   -j DROP
iptables -A INPUT -s 172.16.0.0/12    -j DROP
iptables -A INPUT -s 224.0.0.0/4      -j DROP
iptables -A INPUT -d 224.0.0.0/4      -j DROP
iptables -A INPUT -s 240.0.0.0/5      -j DROP
iptables -A INPUT -d 240.0.0.0/5      -j DROP
iptables -A INPUT -s 0.0.0.0/8        -j DROP
iptables -A INPUT -d 0.0.0.0/8        -j DROP
iptables -A INPUT -d 239.255.255.0/24 -j DROP
iptables -A INPUT -d 255.255.255.255  -j DROP
### FTP_BRUTE FORCE CHAIN
iptables -A INPUT -p tcp -m multiport --dports 20,21 -m state --state NEW -m recent --set --name FTP_BRUTE
iptables -A INPUT -p tcp -m multiport --dports 20,21 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name FTP_BRUTE -j DROP


### Block Ip Address
iptables -A INPUT -s "BLOCK_THIS_IP" -j DROP


### Log dropped packets
iptables -N LOGGING

iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
iptables -A LOGGING -j DROP