Fire wall - ip table - thanks to Scot

Firewalls

* I will be focusing on IP talbes as it is the backend for all linux based firewalls. Ip tables comes with almost all distos of linux and is built into the kernel so it is very fast.

[edit] What is a firewall

* firewalls are meant to control the traffic that is allowed into your network. For example we don't want people to be able to freely send malicious traffic into our network, but we do want to let the useful traffic through. The difficult part of a firewall is how to describe what traffic should be let in and what shouldn't.

[edit] Connection State

There are basically two types of traffic that we will look at:

* New connection traffic. This is traffic that is trying to establish a new connection. For example when you try to visit a website, it must first establish the connection and then transfer the data.
* Established connection traffic. This traffic is usually sent after the connection has been established. This sends the actual data that is being requested or sent.

[edit] Additional methods for categorising traffic

We've seen one way of categorising traffic, is it NEW or ESTABLISHED. But there are many other ways of categorising traffic. Here we will discuss four.

* Source IP address This is the IP that the traffic is coming from. This can be a single address or a subnet of addresses.
* Destination IP address The address that the traffic is being sent to. This can be a single address or a subnet of addresses.
* Source Port The port the traffic is coming from.
* Destination Port The port the traffic is being sent to.

[edit] Things that we can do with any given traffic

There are four basic things that we can do with some traffic.

* ACCEPT We let the traffic through. This is what would happen if there were no firewall.
* REJECT Here we don't let the traffic through and we tell the sender that we didn't let the traffic through.
* DROP Here we simply drop the traffic and don't notify the sender. This is as if we disconnect from the network.
* LOG This simply logs the traffic for later analysis.

[edit] The way Iptables works

Basicly there is a list of rules. A rule would contain something to classify the traffic as, so maybe IP address or connection state, and it would have something to do with that traffic, like drop. When Iptables gets a packet (a piece of traffic) it goes down the list of rules. The first rule that matches the piece of traffic is then followed, no further rules are looked at. So at the end of the chain of rules there is something called a policy which is followed by default.
[edit] Options for IP tables

First I'm going to show you the basic options. These will seem confusing at first, but soon we will see examples and it should start making sense.

* -A INPUT Puts the given rule at the end of the rule chain. So this rule would be looked at last.
* -I INPUT Puts the given rule at the beginning of the chain. This would rule would be looked at first.
* -p tcp --dport x In this the x is a variable. This describes what destination port the traffic is going to. So if we want to get web traffic x = 80, -p tcp --dport 80.
* -s y Here y is a variable for an IP address. This specifies what address the traffic is coming from, the source IP address. Here is an example of traffic coming from 192.168.1.1: -s 192.168.1.1
* -d y Once again y is a variable for IP address. This is the destination IP address. An example would be -d 192.168.1.1 to get all traffic that is going to 192.168.1.1
* -m conntrack --ctstate SOMETHING Here SOMETHING is a variable that can be one of the following:
o NEW This would get all new connections.
o ESTABLISHED,RELATED This gets all traffic that is already part of an existing connection.

[edit] Examples

Now we understand the basic way that IPtables operates. Now we'll learn how to turn what we understand into commands that we can give the computer. First let's look at a simple IPtables command.

iptables -A INPUT -j DROP

* The iptables at the beginning tells Unix that we are using IPtables, so we always need this when editing Iptables.
* Now we have -A. Everything that starts with a - is an option given to iptables. The -A INPUT option tells iptables to put this rule at the end of the INPUT list (or chain). The INPUT chain is data coming into this machine. For now we will only deal with the INPUT chain.
* -j DROP this tells iptables what to do with the traffic, in this case DROP it.
* Now what does this mean as a whole command? Well basicly it says drop all traffic coming into our computer.

iptables -L

* -L tells iptables to list all current rules. Try it!

Let's say we are running a webserver on port 80. Then we might add this rule.

iptables -I INPUT -p tcp --dport 80 -j ACCEPT

* -I INPUT The -I puts a rule at the beginning of the chain, as opposed to -A which put it at the end. So we are putting a rule at the beginning of the INPUT chain.
* -p tcp --dport 80 Here we specify the destination port or --dport. So this will catch all traffic that is destined for port 80. For now ignore the -p tcp part, just know it is necessary.
* -j ACCEPT Once again the -j option tells the computer what to do with this traffic. In this case we ACCEPT it, meaning it will be let through the firewall.
* So what does the rule do as a whole?

Now let's block traffic from a specific IP address. That we think is sending bad traffic.

iptables -I INPUT -s 192.168.32.43 -j DROP

* -s 192.168.32.43 This will get all traffic with the source address of 192.168.32.43.
* What does this rule do as a whole?

iptables -I INPUT -i lo -j ACCEPT

* We always need to let all loopback information flow freely.

[edit] Try yourself

* Try to create a firewall that will block all incoming traffic except: traffic on port 22 (ssh) from anywhere, and traffic on any port from your home machine(192.168.88.99).

* Try to create a firewall that will allow all incoming traffic except: traffic from your enemy's computer (172.34.45.88) and traffic that is destined for your room mate (192.168.22.33).

* Try to create a firewall that will block all incoming traffic except: ESTABLISHED,RELATED traffic and incoming traffic on port 22 and 80. Block outgoing traffic to the worst torrent site ever (34.53.52.4). (hint: you will need to use -I OUTPUT for this one.)

add user in linux

#to create a new user in a linux machine:
sudo useradd yonten

# then add a passwd to the user we created
passwd yonten

#now we need to change the group to give the permissin but berfore that we can see what are the group we have

groups

#useradd -G admin vivek

ubuntu-dhcp-and-two-interface-config

sudo apt-get update......

1.IP address configuration......
vi /etc/network/interface

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
auto eth1
iface eth0 inet static
address 192.168.1.10
netmask 255.255.255.0
gateway 192.168.1.1

iface eth1 inet static
address 10.10.10.1
netmask 255.255.255.0
~


2.DNS to assign a dns to the computer
vi /etc resolv.conf

nameserver 192.168.111.50
nameserver 8.8.8.8


3. how to make NAT
vi /etc rc.local

# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE # write this script to run NAT while boot

exit 0
~
4.IP Forward
sudo sysctl -w net.ipv4.ip_forward=1



5.DHCP config
vi /etc/dhcp3/dhcpd.conf

# option definitions common to all supported networks...
#option domain-name "example.org";
#option domain-name-servers ns1.example.org, ns2.example.org;
option domain-name-servers 8.8.8.8;

default-lease-time 600;
max-lease-time 7200;

# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.
authoritative;
subnet 10.10.10.0 netmask 255.255.255.0 {
range 10.10.10.10 10.10.10.30;
option subnet-mask 255.255.255.0;
option routers 10.10.10.1;
}

Samba .config

#documentation on how to configure a samba file server with your local machine
#The first step is to install the samba package.

sudo apt-get install samba

#we need to edited something in the configuration of samba
#edit these : its in Global section.

vi /etc/samba/smb.conf

workgroup = EXAMPLE
...
security = user

#Create a new section at the bottom of the file,for the directory to be shared:
[share]
comment = Ubuntu File Server Share
path = /srv/samba/share
browsable = yes
guest ok = yes
read only = no
create mask = 0755
#we need to create directory that we want to share

sudo mkdir -p /srv/samba/share

#The -p tells mkdir to create the entire directory tree if it doesn't exist.

#now we need to change the permission to the directory we created.
sudo chown nobody.nogroup /srv/samba/share/

#we need to just restart the samba to give effect to the change we made

sudo restart smbd
sudo restart nmbd


#now a simple samba is configured
#congrats and Save Tibet...

ifup eth0

ssh with pass word and login name

# this scrip will auto login without asking anything
#first intall this pakage to work on your system
sudo apt-get install sshpass

sshpass -p [yourpassword] ssh [yourusername]@[host] -l root -o StrictHostKeyChecking=no

bash

#!/bin/bash

#Auther : yonten
#date :26.01.2011
#purpose :to Decript the file

#echo -n -e "This Program will Decript your Encripted file to human readable form \n"

#echo "Username:"
#read username
#if [ "$username" == "tamdin | karma | yonten | gompo | donam " ]; then
echo -n "Enter the name of the file you want to decript:"
read filename
# continue

openssl enc -bf -in $filename.enc -out $filename.dec -d -a

echo -n -e "______________________________________________________________\n\n\n"


cat $filename.dec

echo -n -e "______________________________________________________________\n\n\n"


rm $filename.dec
echo -n -e "######################Airjaldi.net########################