Firewall

Iptables

Iptables works with tables

Default: filter

Within tables there are:

• Chaines
  • Input
  • Output
  • Forward
  • Pre route (before routing a packet)
  • Post route (after ...)

Within a chain there are:

• Rules: what should happen to a packet

  • Ordering is important
  • If rule matches it will be applied and nothing more will be happend
  • the -j switch, specifies the target:
    • accept
    • drop
    • reject: sender will get an ICMP message that something went wrong

• Policy

  • Policy is the default behavior
  • It's a good practice to have policy that drops everything that don't match a rule in a chain

basic syntax

iptable -a CHAIN [-i/-o if] [-s/-d  source/dest addr]  -p (protocol) --sport/--dport NUM -j TARGET

-a : append to the end of a chain: INPUT/OUT/...
-i : income interface
-o : outgoing interface
-s : source address
-d : destination addresss
-p : protocol
--sport: source port
--dport: destination port
-j : target: accept, reject, drop

List everything that been currently used:

iptables -L # List everything that been currently in use

iptables -F # flush everything

Policies

iptables -P [INPUT/OUTPUT/FORWARD] DROP

iptables -P INPUT DROP

iptables -P OUTPUT ACCEPT

Enable in/out on loopback

iptables -A INPUT -j ACCEPT -i lo

iptables -A OUTPUT -j ACCEPT -o lo

Allow ssh

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT

Allow http

iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT

Allow DNS

iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

Allow related traffic

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Logging

iptables -A INPUT -j LOG

iptables -A OUTOUT -j LOG

Save and restore sttings

iptables-save > rules.txt

iptables-restore < rules.txt

ufw

ufw status

Status: inactive

ufw --help | head

Usage: ufw COMMAND

Commands:
 enable                          enables the firewall
 disable                         disables the firewall
 default ARG                     set default policy
 logging LEVEL                   set logging to LEVEL
 allow ARGS                      add allow rule
 deny ARGS                       add deny rule

ufw enable

ufw status

Status: active

ufw allow ssh

grep ssh /etc/services

ssh		22/tcp				# SSH Remote Login Protocol
ssh		22/udp

ufw reject out ssh

ufw deny proto tcp from 192.168.56.1 to any port 22

ufw logging on