Enhance the security of the netfilter conntrack helpers

[ipfire-2.x.git] / src / initscripts / init.d / firewall

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index 8ca02bc9d1932b4530556d5baf29ef0053eb090d..8040ed4038b3fe7276cfea43f9f180be14a9fe57 100644 (file)
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -21,9 +21,11 @@ iptables_init() {
        iptables -F
        iptables -t nat -F
        iptables -t mangle -F
+       iptables -t raw -F
        iptables -X
        iptables -t nat -X
        iptables -t mangle -X
+       iptables -t raw -X
 
        # Set up policies
        iptables -P INPUT DROP
@@ -84,10 +86,36 @@ iptables_init() {
        iptables -A INPUT   -p tcp -j BADTCP
        iptables -A FORWARD -p tcp -j BADTCP
 
-       # Connection tracking chain
+       # Connection tracking chains
        iptables -N CONNTRACK
-       iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+       iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT
        iptables -A CONNTRACK -m conntrack --ctstate INVALID -j DROP
+       iptables -t raw -N CONNTRACK
+       iptables -t raw -A PREROUTING -j CONNTRACK
+
+       # Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
+
+       # SIP
+       iptables -A CONNTRACK -m conntrack --ctstate RELATED \
+               -m helper --helper sip -j ACCEPT
+       for proto in udp tcp; do
+               iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper sip
+       done
+
+       # FTP
+       iptables -A CONNTRACK -m conntrack --ctstate RELATED \
+               -m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
+       iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp
+
+       # PPTP
+       iptables -A CONNTRACK -m conntrack --ctstate RELATED \
+               -m helper --helper pptp -j ACCEPT
+       iptables -t raw -A CONNTRACK -p udp --dport 1723 -j CT --helper pptp
+
+       # TFTP
+       iptables -A CONNTRACK -m conntrack --ctstate RELATED \
+               -m helper --helper tftp -j ACCEPT
+       iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp
 
        # Fix for braindead ISP's
        iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu