Firewalls
* I will be focusing on IP talbes as it is the backend for all linux based firewalls. Ip tables comes with almost all distos of linux and is built into the kernel so it is very fast.
[edit] What is a firewall
* firewalls are meant to control the traffic that is allowed into your network. For example we don't want people to be able to freely send malicious traffic into our network, but we do want to let the useful traffic through. The difficult part of a firewall is how to describe what traffic should be let in and what shouldn't.
[edit] Connection State
There are basically two types of traffic that we will look at:
* New connection traffic. This is traffic that is trying to establish a new connection. For example when you try to visit a website, it must first establish the connection and then transfer the data.
* Established connection traffic. This traffic is usually sent after the connection has been established. This sends the actual data that is being requested or sent.
[edit] Additional methods for categorising traffic
We've seen one way of categorising traffic, is it NEW or ESTABLISHED. But there are many other ways of categorising traffic. Here we will discuss four.
* Source IP address This is the IP that the traffic is coming from. This can be a single address or a subnet of addresses.
* Destination IP address The address that the traffic is being sent to. This can be a single address or a subnet of addresses.
* Source Port The port the traffic is coming from.
* Destination Port The port the traffic is being sent to.
[edit] Things that we can do with any given traffic
There are four basic things that we can do with some traffic.
* ACCEPT We let the traffic through. This is what would happen if there were no firewall.
* REJECT Here we don't let the traffic through and we tell the sender that we didn't let the traffic through.
* DROP Here we simply drop the traffic and don't notify the sender. This is as if we disconnect from the network.
* LOG This simply logs the traffic for later analysis.
[edit] The way Iptables works
Basicly there is a list of rules. A rule would contain something to classify the traffic as, so maybe IP address or connection state, and it would have something to do with that traffic, like drop. When Iptables gets a packet (a piece of traffic) it goes down the list of rules. The first rule that matches the piece of traffic is then followed, no further rules are looked at. So at the end of the chain of rules there is something called a policy which is followed by default.
[edit] Options for IP tables
First I'm going to show you the basic options. These will seem confusing at first, but soon we will see examples and it should start making sense.
* -A INPUT Puts the given rule at the end of the rule chain. So this rule would be looked at last.
* -I INPUT Puts the given rule at the beginning of the chain. This would rule would be looked at first.
* -p tcp --dport x In this the x is a variable. This describes what destination port the traffic is going to. So if we want to get web traffic x = 80, -p tcp --dport 80.
* -s y Here y is a variable for an IP address. This specifies what address the traffic is coming from, the source IP address. Here is an example of traffic coming from 192.168.1.1: -s 192.168.1.1
* -d y Once again y is a variable for IP address. This is the destination IP address. An example would be -d 192.168.1.1 to get all traffic that is going to 192.168.1.1
* -m conntrack --ctstate SOMETHING Here SOMETHING is a variable that can be one of the following:
o NEW This would get all new connections.
o ESTABLISHED,RELATED This gets all traffic that is already part of an existing connection.
[edit] Examples
Now we understand the basic way that IPtables operates. Now we'll learn how to turn what we understand into commands that we can give the computer. First let's look at a simple IPtables command.
iptables -A INPUT -j DROP
* The iptables at the beginning tells Unix that we are using IPtables, so we always need this when editing Iptables.
* Now we have -A. Everything that starts with a - is an option given to iptables. The -A INPUT option tells iptables to put this rule at the end of the INPUT list (or chain). The INPUT chain is data coming into this machine. For now we will only deal with the INPUT chain.
* -j DROP this tells iptables what to do with the traffic, in this case DROP it.
* Now what does this mean as a whole command? Well basicly it says drop all traffic coming into our computer.
iptables -L
* -L tells iptables to list all current rules. Try it!
Let's say we are running a webserver on port 80. Then we might add this rule.
iptables -I INPUT -p tcp --dport 80 -j ACCEPT
* -I INPUT The -I puts a rule at the beginning of the chain, as opposed to -A which put it at the end. So we are putting a rule at the beginning of the INPUT chain.
* -p tcp --dport 80 Here we specify the destination port or --dport. So this will catch all traffic that is destined for port 80. For now ignore the -p tcp part, just know it is necessary.
* -j ACCEPT Once again the -j option tells the computer what to do with this traffic. In this case we ACCEPT it, meaning it will be let through the firewall.
* So what does the rule do as a whole?
Now let's block traffic from a specific IP address. That we think is sending bad traffic.
iptables -I INPUT -s 192.168.32.43 -j DROP
* -s 192.168.32.43 This will get all traffic with the source address of 192.168.32.43.
* What does this rule do as a whole?
iptables -I INPUT -i lo -j ACCEPT
* We always need to let all loopback information flow freely.
[edit] Try yourself
* Try to create a firewall that will block all incoming traffic except: traffic on port 22 (ssh) from anywhere, and traffic on any port from your home machine(192.168.88.99).
* Try to create a firewall that will allow all incoming traffic except: traffic from your enemy's computer (172.34.45.88) and traffic that is destined for your room mate (192.168.22.33).
* Try to create a firewall that will block all incoming traffic except: ESTABLISHED,RELATED traffic and incoming traffic on port 22 and 80. Block outgoing traffic to the worst torrent site ever (34.53.52.4). (hint: you will need to use -I OUTPUT for this one.)
No comments:
Post a Comment