minimal iptables ruleset for laptop

Sorry for this newbie question - I'm just learning about iptables.

What I have is a laptop that I want to protect against external
intrusion. Relevant interfaces are

- eth0, which is LAN and sometimes DHCP sometimes pppoe
- eth1, which is WLAN and sometimes behind my private AP
and sometimes behind company's or public APs

Of course, this laptop would never have to act as a router.
I want to prevent any external intrusion but be able to connect myself
to any external service. AND I want to be able to run some services
(X11, CUPS, Tomcat,...) just for myself.

From somewhere on the internet I got the following snippet which I think
may be suitable for ppp0 as the only interface. But I couldn't find out
how to change it for my needs.

-------------------------------------------------------------------------
# Generated by iptables-save v1.2.11 on Mon May 23 15:54:20 2005
*filter
:INPUT ACCEPT [10502:1065067]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1529512:141800679]
:block - [0:0]
-A INPUT -j block
-A FORWARD -j block
-A block -m state --state RELATED,ESTABLISHED -j ACCEPT
-A block -i ! ppp0 -m state --state NEW -j ACCEPT
-A block -j DROP
COMMIT
# Completed on Mon May 23 15:54:20 2005
-------------------------------------------------------------------------

Any help will be much appreciated.
--
Volkm@r

On Mon, 23 May 2005 16:07:01 +0200, Volkm@r wrote:

> Sorry for this newbie question - I'm just learning about iptables.

Everyone has to start somewhere

> -------------------------------------------------------------------------
> # Generated by iptables-save v1.2.11 on Mon May 23 15:54:20 2005
> *filter
> :INPUT ACCEPT [10502:1065067]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [1529512:141800679]
> :block - [0:0]
> -A INPUT -j block
> -A FORWARD -j block
> -A block -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A block -i ! ppp0 -m state --state NEW -j ACCEPT
> -A block -j DROP
> COMMIT
> # Completed on Mon May 23 15:54:20 2005
> -------------------------------------------------------------------------

FORWARD is used only for packets that will be passing through your system.
This should do the trick:


# Clear IPTABLES
################
iptables -F
iptables -Z
iptables -X


# Local Loopback
################
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT


# Set Default Policies
######################
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP


# Accept All Related Connections
################################
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT


# Allow all OUT going connection
################################
iptables -A OUTPUT -o eth0 -j ACCEPT
iptables -A OUTPUT -o eth1 -j ACCEPT


# DROP everything else
######################
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP


--

Regards
Robert

Smile... it increases your face value!


----== Posted via Newsfeeds.Com - Unlimited-Uncensored-Secure Usenet News==----
http://www.newsfeeds.com The #1 Newsgroup Service in the World! 120,000+ Newsgroups
----= East and West-Coast Server Farms - Total Privacy via Encryption =----