TABLE OF CONTENTS


iptables/DNS [ Policy ]

[ Top ] [ Policy ]

POLICY

Accept UDP dns replies

APPLIES TO

Any host using DROPDNSRETURN

SYNOPSIS

For host that drop a lot of dns reply packets. The packets come from the DNS server IP's and are sourced from port 53. cause of the drop is unknown. May be:

   * udp reply takes > than 30 second lifetime of the udp "established"
     connection
   * bug in the "established" code for udp packets for these firewalls

In any case rather than trying to figure it out, tag these hosts with DROPSDNSRETURN in the uses clause to enable accepting packets sourced from 192.168.x.x at port 53.


iptables/dns/external [ Policy ]

[ Top ] [ Policy ]

POLICY

Allow any host access to external DNS server

APPLIES TO

hosts in DNSEXT class

SYNOPSIS

Allow port 53 udp for all hosts not in the 192.168.0.0/16 net.


iptables/external [ Policy ]

[ Top ] [ Policy ]

APPLIES TO

any VPNIPSEC hosts

SYNOPSIS

drop spoofed traffic

DESCRIPTION

drop spoofed traffic


iptables/MAIL1, iptables/MAIL2 [ Policy ]

[ Top ] [ Policy ]

POLICY

Access lists for email

APPLIES TO

hosts in MAIL1 or MAIL2 class, hosts in MAILINT class

SYNOPSIS

Hosts support smtp and smtps. for machines on 192.168.0.0/16 net. If not in MAILINT group, supports smtp and smtps for any host.

DESCRIPTION

Allow access to ports 25 and 465 from all 192.168.0.0/16 hosts UNLESS machine is part of MAILINT group. If part of MAILINT only allows access to ports 25 and 465 from hosts on 192.168.0.0/16.


iptables/NFSSERV [ Policy ]

[ Top ] [ Policy ]

POLICY

Access lists nfs in site_lax1

APPLIES TO

hosts in NFSSERV

SYNOPSIS

Hosts allow nfs clients to connect

DESCRIPTION

Allow access to ports 111,632,633,634,635,2049 from appropriate hosts


iptables/NTP, iptables/port/123 [ Policy ]

[ Top ] [ Policy ]

POLICY

Access list for top level ntp servers

APPLIES TO

All top level ntp servers

SYNOPSIS

Allow access to ntp servers from internal and selected external hosts

DESCRIPTION

Allow access to port 123/udp


iptables/openvpn/routing [ Policy ]

[ Top ] [ Policy ]

POLICY

Services accessible from openvpn connected hosts.

APPLIES TO

hosts accessing network via openvpn

SYNOPSIS

Allow tcp traffic, udp DNS and icmp traffic to/from systems

DESCRIPTION

Allows all tcp traffic subject to vpn host's access restrictions. Allows port 53 udp traffic (to selected dns servers) Allows icmp traffic again subject to firewalls for openvpn host.


iptables/snmp, iptables/port/161 [ Policy ]

[ Top ] [ Policy ]

POLICY

Access list for snmp servers

APPLIES TO

all hosts

SYNOPSIS

Allow access to snmp servers from cacti and nagios servers.

DESCRIPTION

Allow access to port 161 from cacti and nagios servers.


iptables/VPNOPEN [ Policy ]

[ Top ] [ Policy ]

POLICY

Rules for openvpn natting of addresses

APPLIES TO

hosts in VPNOPEN

SYNOPSIS

set the source address of packets received from openvpn clients

DESCRIPTION

Rewrite the source address (which for the clients is on the 172.16.1.0 net) to the internal address of the openvpn server if the packet is to be routed out the eth0 interface, and to the external address of the openvpn server if it is to be routed out any other interface.

Note that these rules are automatically installed by the ovpn.up script pushed to the openvpn servers. So changes to these rules require corresponding changes to the ovpn.up script to prevent duplicate or conflicitng rules.