Difference between revisions of "IPTables"

Revision as of 19:59, 6 July 2018

Packet filtering affords opening access only to these services you have decided to open. The TCP or UDP packets include a piece of information called the port number, that is used to identify the type of service. Secure ports were defined as SSL counterparts of the native ports but were superseded by TLS and are now deprecated due to security weaknesses in the SSL protocol. SSL should not be used any longer. Instead, use TLS. Current version is v1.2.

On server side, the services are provided by applications that may have vulnerabilities and be attacked. Examples of attacks are buffer overflow or format string attacks, that afford getting full access on the target machine by crafting special strings sent to it. An attacker could then obtain any information present there or modify or destroy the system.

To reduce the number of possible attacks, the number of services authorized, or who can access the system, must be restricted. This is known as packet filtering. It is only an aspect of security (obviously, the applications on the server side must also be secured ...), but it is important. Never *** ever *** connect to the network a computer not protected by a packet filter !

To illustrate, let's configure our two-interfaces computer to be its own firewall. eth0 is the Internet interface, it uses network 192.168.0.x, the gateway is an ADSL router/switch at 192.168.0.254. eth1 is the (Intranet) interface to the internal network 192.168.1.x.

Iptables Filtering

Since Linux 2.4, packet filtering is effected inside the kernel, and configuration effected by the iptables user-space program. In addition to rules for incoming and outgoing packets, iptables affords defining rules for routing between the interfaces. The iptables command affords entering the rules one by one. Using a script affords entering all the rules. iptable -L -v affords viewing the current rules.

For more information, see the netfilter official site. This site has links to various documents, including a simple introduction to packet filtering in this HOWTO.

In Slackware, the script used is /etc/rc.d/rc.firewall. It is called automatically when the system starts or stops, using commands ./rc.firewall start or ./rc.firewall stop.

#! /bin/sh
#
# startup script for local packet filter
#
fw_start () {
echo "Loading packet filter rules"

The flush command affords deleting all the active nat and filtering rules:

# flush old rules
iptables -t nat --flush
iptables -flush

The -P option affords defining the default policy. A good practise is to forbid by default everything not authorized. This is done here for packets incoming, outgoing, and routed between the interfaces:

# drop by default
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

The -A option affords adding a rule. Here all the packets on the loopback interface are accepted:

# pass all traffic for network 127.0.0.0/8 on loopback interface
iptables -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
iptables -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT

Broadcast traffic is also OK:

# pass all broadcast traffic
iptables -A INPUT -s 0.0.0.0 -d 255.255.255.255 -j ACCEPT
iptables -A OUTPUT -s 255.255.255.255 -d 0.0.0.0 -j ACCEPT

Connections already established are authorized to continue:

# accept packets that are part of previously OK'ed sessions
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A OUTPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED 

Some noisy VoiP packets are dropped:

# drop SIP Cirpack KeepAlive Packet
iptables -A INPUT -p udp -j DROP --dport 5060 -m string --string "Cirpack KeepAlive Packet" --algo bm

On both interfaces, we forbid communications where the remote address is a private network address, as specified by RFC 1918 (except 192.168.x.x, that we use internally). On the Internet, addresses of RFC 1918 private networks are not routable. So packets with such addresses are not expected on the internal network:

# INBOUND POLICY

# multicast traffic
iptables -A INPUT -s 0.0.0.0/8 -d 224.0.0.0/8 -j LOG --log-prefix "INPUT multicast traffic "
iptables -A INPUT -s 0.0.0.0/8 -d 224.0.0.0/8 -j DROP

# anti-spoofing rules
iptables -A INPUT -s 0.0.0.0/8 -j LOG --log-prefix "INPUT spoofed IP "
iptables -A INPUT -s 0.0.0.0/8 -j DROP
iptables -A INPUT -s 10.0.0.0/8 -j LOG --log-prefix "INPUT spoofed IP "
iptables -A INPUT -s 10.0.0.0/8 -j DROP
iptables -A INPUT -s 127.0.0.0/8 -j LOG --log-prefix "INPUT spoofed IP "
iptables -A INPUT -s 127.0.0.0/8 -j DROP
iptables -A INPUT -s 172.16.0.0/12 -j LOG --log-prefix "INPUT spoofed IP "
iptables -A INPUT -s 172.16.0.0/12 -j DROP
iptables -A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "INPUT spoofed IP "
iptables -A INPUT -s 255.0.0.0/8 -j DROP

The protocols corresponding to services offered externally are accepted:

# services SMTP HTTP HTTPS
iptables -A INPUT -p tcp -j ACCEPT --dport 25 -m state --state NEW
iptables -A INPUT -p tcp -j ACCEPT --dport 80 -m state --state NEW
iptables -A INPUT -p tcp -j ACCEPT --dport 143 -m state --state NEW
iptables -A INPUT -p tcp -j ACCEPT --dport 443 -m state --state NEW

The protocols corresponding to services offered on the local network are accepted:

# services on local network FTP DNS BOOTP NNTP SUBMIT VNC VOIP
iptables -A INPUT -p tcp -j ACCEPT --dport 20 -m state --state NEW -s 192.168.0.0/24
iptables -A INPUT -p tcp -j ACCEPT --dport 21 -m state --state NEW -s 192.168.0.0/24
iptables -A INPUT -p udp -j ACCEPT --dport 53 -s 192.168.0.0/16
iptables -A INPUT -p tcp -j ACCEPT --dport 53 -m state --state NEW -s 192.168.0.0/16
iptables -A INPUT -p udp -j ACCEPT --dport 69 -s 192.168.0.0/24
iptables -A INPUT -p tcp -j ACCEPT --dport 119 -m state --state NEW -s 192.168.0.0/16
iptables -A INPUT -p tcp -j ACCEPT --dport 587 -m state --state NEW -s 192.168.0.0/16
iptables -A INPUT -p tcp -j ACCEPT --dport 5088 -m state --state NEW -s 192.168.0.0/16
iptables -A INPUT -p tcp -j ACCEPT --dport 5900:5910 -m state --state NEW -s 192.168.0.0/16
iptables -A INPUT -p udp -j ACCEPT --dport 5060:5061 -s 192.168.0.0/16
iptables -A INPUT -p udp -j ACCEPT --dport 10000:20000 -s 192.168.0.0/16

We accept NFS on the local network and fix the NFS ports:

# NFS ports
iptables -A INPUT -p udp -j ACCEPT --dport 111 -s 192.168.0.0/24
iptables -A INPUT -p tcp -j ACCEPT --dport 111 -m state --state NEW -s 192.168.0.0/24
iptables -A INPUT -p udp -j ACCEPT --dport 2049 -s 192.168.0.0/24
iptables -A INPUT -p tcp -j ACCEPT --dport 2049 -m state --state NEW -s 192.168.0.0/24
iptables -A INPUT -p udp -j ACCEPT --dport 32764 -s 192.168.0.0/24
iptables -A INPUT -p tcp -j ACCEPT --dport 32764 -m state --state NEW -s 192.168.0.0/24
iptables -A INPUT -p udp -j ACCEPT --dport 32765 -s 192.168.0.0/24
iptables -A INPUT -p tcp -j ACCEPT --dport 32765 -m state --state NEW -s 192.168.0.0/24
iptables -A INPUT -p udp -j ACCEPT --dport 32766 -s 192.168.0.0/24
iptables -A INPUT -p tcp -j ACCEPT --dport 32766 -m state --state NEW -s 192.168.0.0/24
iptables -A INPUT -p udp -j ACCEPT --dport 32767 -s 192.168.0.0/24
iptables -A INPUT -p tcp -j ACCEPT --dport 32767 -m state --state NEW -s 192.168.0.0/24
iptables -A INPUT -p udp -j ACCEPT --dport 32768 -s 192.168.0.0/24
iptables -A INPUT -p tcp -j ACCEPT --dport 32768 -m state --state NEW -s 192.168.0.0/24
iptables -A INPUT -p udp -j ACCEPT --dport 32769 -s 192.168.0.0/24
iptables -A INPUT -p tcp -j ACCEPT --dport 32769 -m state --state NEW -s 192.168.0.0/24

We accept samba traffic on the local network:

# samba ports
iptables -A INPUT -p tcp -j ACCEPT --dport 135 -m state --state NEW -s 192.168.0.0/16
iptables -A INPUT -p udp -j ACCEPT --dport 135 -s 192.168.0.0/16
iptables -A INPUT -p tcp -j ACCEPT --dport 137 -m state --state NEW -s 192.168.0.0/16
iptables -A INPUT -p udp -j ACCEPT --dport 137 -s 192.168.0.0/16
iptables -A INPUT -p udp -j ACCEPT --dport 138 -s 192.168.0.0/16
iptables -A INPUT -p tcp -j ACCEPT --dport 139 -m state --state NEW -s 192.168.0.0/16
iptables -A INPUT -p tcp -j ACCEPT --dport 445 -m state --state NEW -s 192.168.0.0/16
iptables -A INPUT -p udp -j ACCEPT --dport 445 -s 192.168.0.0/16

We accept VOIP traffic from freephonie.net:

# services to freephonie network VOIP
iptables -A INPUT -p udp -j ACCEPT --dport 5060:5061 -s 212.27.52.0/24
iptables -A INPUT -p udp -j ACCEPT --dport 10000:20000 -s 212.27.52.0/24

We accept X-Window traffic on the local network:

# SSH-tunnelled X-Window output appears as input on interface lo
iptables -A INPUT -p udp -j ACCEPT --dport 177 -s 192.168.0.0/16
iptables -A INPUT -p tcp -j ACCEPT --dport 6000:6063 -m state --state NEW -s 192.168.0.0/16
iptables -A INPUT -i lo -p tcp -j ACCEPT --dport 6000:6063 -m state --state NEW -s 192.168.0.0/16

We accept pings on the local network:

# accept echo-request icmp packets
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT -s 192.168.0.0/16

We accept antispam dcc answers:

# accept dcc answers (dcc antispam service)
iptables -A INPUT -p udp -j ACCEPT --dport 1024:65535 --sport 6277

We log anything not accepted above:

# log anything not accepted above
iptables -A INPUT -j LOG --log-prefix "INPUT bad traffic "

We accept all outbound packets, which would for example afford using a network scanner. In a production environment, there would be a stricter policy:

# OUTBOUND POLICY

# accept all outbound packets
iptables -A OUTPUT -j ACCEPT

# log anything not accepted above
# iptables -A OUTPUT -j LOG --log-prefix "OUTPUT bad traffic "

For routing between the interfaces, everything is accepted. In a production environment, there might be a stricter policy:

# FORWARD POLICY

# forward all outbound packets
iptables -A FORWARD -j ACCEPT

# log anything not accepted above
# iptables -A FORWARD -j LOG --log-prefix "FORWARD bad traffic "

The Network Address Translation rule below affords replacing the source address in the packets coming from the internal interface by the source address of the external interface. The packets outgoing to the Internet then all seem to come from the external interface, whatever their real origin (this translation affords hiding to the outside the addresses used internally):

# POSTROUTING POLICY

# nat traffic going to internet with our local network address
iptables -t nat -A POSTROUTING -o br0 -j SNAT --to 192.168.0.1 
}

After the fw_start() function ends, the fw_stop() function is defined to authorize everything:

fw_stop () {
  echo "Unloading all packet filter rules"
  iptables -t nat --flush
  iptables -flush

# accept by default
  iptables -P INPUT ACCEPT
  iptables -P FORWARD ACCEPT
  iptables -P OUTPUT ACCEPT
  }

case "$1" in
‘start’)
  fw_start
  ;;
’stop’)
  fw_stop
  ;;
’restart’)
  fw_start
  ;;
*)
  echo "usage $0 start | stop | restart"

Testing the firewall

Use nmap -sU hostname (UDP) and nmap -sT hostname (TCP) to make sure what ports are visible locally and do the same from the outside.

Download example

Download file rc.firewall