Some explanation of rules used in the firewall script files
All IP packet headers contain the source and destination IP addresses and the type of IP protocol message (ICMP, UDP or TCP) this packet contains. The only means of identification under the Internet Protocol (IP) is the source address in the IP packet header. This is a problem that opens the door to source address spoofing, where the sender may replaces its address with either a nonexistent address, or the address of some other site.
# Refuse spoofed packets pretending to be from the external address,
ipchains -A input -i $EXTERNAL_INTERFACE -s $IPADDR -I -j DENY
Also, there are at least seven sets of source addresses you should refuse on your external interface in all cases.
These are incoming packets claiming to be from:
• Your external IP address
• Class A private IP addresses
• Class B private IP addresses
• Class C private IP addresses
• Class D multicast addresses
• Class E reserved addresses
• The loopback interface
With the exception of your own IP address, blocking outgoing packets containing these source addresses protects you from possible configuration errors on your part.
NOTE: Don’t forget to exclude your own IP address from outgoing packets blocked. By default I choose to exclude the Class C private IP addresses since it’s the most used by the majority of people at this time. If you used another class instead of the class C, then you must comment out the lines that refer to your class under the “SPOOFING & BAD ADDRESSES” section of the firewall script file.
The rest of the rules
Other rules used in the firewall scripts files are:
• Accessing a Service from the Outside World
• Offering a Service to the Outside World
• Masquerading the Internal Machines