1 00:00:00,000 --> 00:00:11,240 In this lesson, you will learn about IP tables firewalls. So IP tables is a classic tool 2 00:00:11,240 --> 00:00:17,680 for managing advanced firewalls. The fun thing is that at some point IP tables got deprecated, 3 00:00:17,680 --> 00:00:24,440 but there's a lot of people that like it. So now it's living a revival. So IP tables 4 00:00:24,440 --> 00:00:30,000 has been rebranded and you can use it to write firewall rules that are compatible to the 5 00:00:30,000 --> 00:00:35,639 current syntax. Why would you want to do that? Because it offers advanced features for configuring 6 00:00:35,639 --> 00:00:42,040 very specific firewall rules. So if you are a powerful firewall user, IP tables is a very 7 00:00:42,040 --> 00:00:48,799 nice utility. In modern Red Hat, NFT is provided as a standard solution to manage advanced 8 00:00:48,799 --> 00:00:54,560 firewalling. And as I just mentioned, the IP tables tool has been reworked to generate NF 9 00:00:54,560 --> 00:01:00,880 tables firewall rules. And what is the reason behind that? Well, NF tables is quite complex, 10 00:01:00,880 --> 00:01:07,160 and the rules are not as easily written as IP tables rules. So that is why you might want to 11 00:01:07,160 --> 00:01:14,080 use IP tables instead of NF tables. Now when you work with IP tables, you should understand the 12 00:01:14,080 --> 00:01:22,919 command anatomy. So how does it work? Well, IP tables first has either a minus A or a minus I. 13 00:01:22,919 --> 00:01:32,120 Minus A is for append, and minus I is for insert. Minus A appends to the end of the chain. Now the 14 00:01:32,120 --> 00:01:39,120 fact is that in an IP tables firewall, the position of your rules does matter. Because if you first 15 00:01:39,120 --> 00:01:46,320 are going to allow all SSH traffic, and then you are going to deny all SSH traffic for a specific 16 00:01:46,320 --> 00:01:53,080 host, well, that's not going to work. Because the allow rule matches the incoming traffic also for 17 00:01:53,080 --> 00:01:59,720 the denied host before you meet the deny rule. And that is why generically, you want more specific 18 00:01:59,720 --> 00:02:07,199 exceptions first, and the generic rules to the end. Next component is minus I or minus O, I have 19 00:02:07,480 --> 00:02:14,160 name. So that is the input or output interface name, which is optional, by the way. If you don't 20 00:02:14,160 --> 00:02:20,399 specify an interface name, it just applies to all interfaces. Now we have minus S or minus D for 21 00:02:20,399 --> 00:02:27,639 source or destination followed by an IP address with its CIDR subnet mask. Next, you get minus P, 22 00:02:27,639 --> 00:02:36,360 UDP, or TCP, which is always followed by a minus minus D port or a minus minus S port for the 23 00:02:36,360 --> 00:02:44,479 destination port or the source port. And the final component is minus J. Minus J is specifying what 24 00:02:44,479 --> 00:02:50,880 exactly you want to do. And your options are log and accept and reject and drop. Well, log is 25 00:02:50,880 --> 00:02:58,240 writing to the logs, accept is obviously accepting it, reject will reject while sending an error 26 00:02:58,240 --> 00:03:03,720 message so that the initiator of the traffic can know what was going wrong, and drop will silently 27 00:03:03,720 --> 00:03:11,440 drop it. Let me demonstrate. So I'm going to do this on my CentOS 10 host, and in order to do so, I need 28 00:03:11,440 --> 00:03:24,679 systemctl disable minus minus now firewalld. And then I'm going to use IP tables minus L, which is 29 00:03:24,679 --> 00:03:30,279 listing, and I can see that I have an input chain and a forward chain and an output chain, and the 30 00:03:30,279 --> 00:03:36,919 policy is set to accept. So input is for incoming packets, output is for outcoming packets, and 31 00:03:36,919 --> 00:03:43,360 forward is a chain that I'm going to ignore here. The policy is set to accept. If you want a decent 32 00:03:43,360 --> 00:03:50,759 firewall that is really holding off everything, then it's a good idea to use policy first. So minus P, 33 00:03:50,759 --> 00:03:59,119 output, must be in uppercase by the way, drop. And I'm also going to set the policy on input to drop. 34 00:03:59,679 --> 00:04:05,360 And now let's try to ping google.com. And what do we get? We get a name or service not known. 35 00:04:06,160 --> 00:04:11,759 A name or service not known? That's a DNS message. And that is right, because the very first thing 36 00:04:11,759 --> 00:04:18,239 that is happening when you are pinging google.com, you need to connect to DNS to find the IP address, 37 00:04:18,239 --> 00:04:24,559 and DNS cannot be reached. So we need to make sure that this is going to happen. And how do we do 38 00:04:24,559 --> 00:04:32,880 that? Well, by using IP tables, minus A, output. So I'm working on the output chain. Minus P for 39 00:04:32,880 --> 00:04:39,040 protocol, ICMP, for the internet core message protocol. That's a protocol that is used by 40 00:04:39,040 --> 00:04:47,839 the ping command. And minus J, accept. So I want to accept outgoing ping. Now this is not going to be 41 00:04:47,839 --> 00:04:54,959 any better, because we still have two problems. And problem number one is that I do accept ping 42 00:04:54,959 --> 00:05:02,559 now, but I still cannot reach out to DNS. Second problem is the return traffic. I'll show you in 43 00:05:02,559 --> 00:05:12,239 a bit. But first, IP tables, minus A, output, minus P, TCP, minus minus D port is 53, minus J, 44 00:05:12,239 --> 00:05:19,839 accept. Port 53, that's your DNS port, and that is now accepted. In case you are not too sure about 45 00:05:19,839 --> 00:05:25,839 the ports, well, remember ETC services. You can find it in ETC services. I'm going to do 46 00:05:26,559 --> 00:05:34,480 almost exactly the same, but this time minus P, UDP, also accept. And that is because DNS traffic 47 00:05:34,480 --> 00:05:40,799 can go over TCP as well as over UDP. Now what do you think? Are we all right at this moment? 48 00:05:40,880 --> 00:05:47,839 Well, when we ping google.com, we still don't get anything. So that doesn't work, and that is because 49 00:05:47,839 --> 00:05:55,440 of the return packets. Look, IP tables minus L is showing that we now have some traffic that we allow 50 00:05:55,440 --> 00:06:02,480 in the output chain, but nothing is allowed back. And to take care of that, I'm using IP tables minus 51 00:06:02,880 --> 00:06:11,519 A, input, minus M, state. This minus M command is to call a kernel module, and we are calling the state 52 00:06:11,519 --> 00:06:18,239 kernel module, which is tracking package state. And I'm going to look for state is established 53 00:06:19,040 --> 00:06:27,119 or related, minus J, accept. And what does that mean? That means that we are going to accept 54 00:06:27,119 --> 00:06:33,760 incoming traffic only if it's an answer to a state that was already existing. So only if it's 55 00:06:33,760 --> 00:06:40,320 an answer to authorized outgoing traffic. And you can see that that is now listed in the firewall 56 00:06:40,320 --> 00:06:47,519 rules, and we can try to ping google.com again. And now it works. Now let's do one more thing, 57 00:06:47,600 --> 00:06:55,519 control C first to interrupt the ping. I'm going to use IP tables minus A, output, there we go, 58 00:06:56,399 --> 00:07:10,000 and minus T, minus P, TCP, and minus minus D port is 80, 443. And oh boy, what do we see? Doesn't 59 00:07:10,000 --> 00:07:16,480 work with a comma separated list. Okay, then we need to do it one by one. So port 80 as well as 60 00:07:16,480 --> 00:07:24,720 port 443, because you probably want to allow some web traffic to go out as well. And at this point, 61 00:07:24,720 --> 00:07:33,519 we have a pretty decent IP tables firewall configuration. Now I am going to reboot this 62 00:07:33,519 --> 00:07:38,320 system to get rid of all the IP tables configuration. I don't want to make it 63 00:07:39,040 --> 00:07:41,839 persistent. I just wanted to explain how it works.