Databases, Systems & Networks

Source: phoenixnap

All modern operating systems include a firewall, an application that regulates network traffic to and from a computer. Firewalls use rules to control incoming and outgoing traffic, creating a network security layer.

iptables is the primary firewall utility program developed for Linux systems. The program enables system administrators to define rules and policies for filtering network traffic.

In this tutorial, learn how to install, configure, and use iptables in Linux.

Prerequisites

• A Linux system.
• A user account with sudo privileges.
• Access to a terminal window/command line.

What Is iptables?

iptables is a command-line utility for configuring the built-in Linux kernel firewall. It enables administrators to define chained rules that control incoming and outgoing network traffic.

The rules provide a robust security mechanism that defines which network packets can pass through and which should be blocked. iptables protects Linux systems from data breaches, unauthorized access, and other network security threats.

Administrators use iptables to enforce network security policies and protect a Linux system from various network-based attacks. Lire la suite…

Source: geekforgeeks

iptables is a Linux command-line firewall tool used to control and secure network traffic by defining packet-filtering rules. It works with the Netfilter framework in the Linux kernel to decide whether packets are accepted, dropped, or forwarded.

• Controls incoming, outgoing, and forwarded traffic based on IP addresses, ports, and protocols.
• Uses tables, chains, and rules to define how network packets should be handled.
• Performs actions such as ACCEPT, DROP, REJECT, or FORWARD when packets match rules.
• Helps protect servers and networks by allowing trusted traffic and blocking unauthorized access.

Core Components of iptables

iptables works using a structured model consisting of tables, chains, rules, and targets.

Tables in Iptables

Tables are collections of chains that define how packets should be processed for specific purposes, iptables uses different tables for handling various types of packet processing.

• filter: Default used table for packet filtering. It includes chains like INPUT, OUTPUT and FORWARD.
• nat: Related to Network Address Translation. It includes PREROUTING and POSTROUTING chains.
• mangle: For specialised packet alteration. Inbuilt chains include PREROUTING and OUTPUT.
• raw: Configures exemptions from connection tracking. Built-in chains are PREROUTING and OUTPUT.
• security: Used for Mandatory Access Control

Built-in Chains of Tables in Iptables

Chains are ordered lists of rules that determine what action should be taken when a packet matches certain conditions. Each table contains predefined chains

• INPUT: A set of rules for packets destined to localhost sockets.
• FORWARD: For packets routed through the device.
• OUTPUT: It is locally generated packets, meant to be transmitted outside.
• PREROUTING: It is used for modifying packets as they arrive.
• POSTROUTING: IIt helps in modifying packets as they are leaving.

Rules

Rules are the conditions applied to packets within chains. A rule matches a packet if it meets certain criteria. Common criteria include:

• Source IP address: Blocks or allows traffic coming from a specific computer or device. Example: Stop all traffic from 192.168.1.100.
• Destination IP address: Blocks or allows traffic going to a specific computer or device. Example: Allow traffic only to 10.0.0.5.
• Protocol type: Filters traffic based on the type of communication, like TCP (web), UDP, or ICMP (ping).
• Port number: Controls access to certain services or programs on a computer. Example: Allow web traffic on port 80 but block SSH on port 22.

Targets (Actions)

Targets specify what happens when a packet matches a rule:

• ACCEPT: Allow the packet to continue its path.
• DROP: Silently discard the packet with no response.
• REJECT: Discard the packet but send an error response to the sender.
• QUEUE: Send the packet to userspace for custom processing.
• RETURN: Stop processing the current chain and resume at the previous chain.

Example:

Imagine you want to block SSH from a specific IP but allow all other traffic:

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.100 -j DROP

• Chain: INPUT
• Protocol: TCP
• Destination Port: 22 (SSH)
• Source IP: 192.168.1.100
• Target: DROP

Output:

This rule drops incoming SSH connections from 192.168.1.100 while letting other traffic pass normally.

Syntax

iptables [options] [chain] [rule specification] [target]

• options: Specifies the action to perform (like adding, deleting, or listing rules)
• chain: Defines where the rule is applied (INPUT, OUTPUT, FORWARD)
• rule specification: Conditions to match packets (protocol, port, IP address, etc.)
• target: Action to take on matched packets (ACCEPT, DROP, REJECT)

Lire la suite…

Iptables against DDoS

Using iptables to fight DDoS attacks.

After a recent conversation on the Ubuntu Forums I wanted to post an example of using iptables.

sudo iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT

sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -m limit --limit 50/second --limit-burst 50 -j ACCEPT

iptables extensions

NAME

iptables-extensions — list of extensions in the standard iptables distribution

SYNOPSIS

ip6tables [-m name [module-options...]] [-j target-name [target-options...]
iptables [-m name [module-options...]] [-j target-name [target-options...]

MATCH EXTENSIONS

iptables can use extended packet matching modules with the -m or --match options, followed by the matching module name; after these, various extra command line options become available, depending on the specific module. You can specify multiple extended match modules in one line, and you can use the -h or --help options after the module has been specified to receive help specific to that module. The extended match modules are evaluated in the order they are specified in the rule.

If the -p or --protocol was specified and if and only if an unknown option is encountered, iptables will try load a match module of the same name as the protocol, to try making the option available.

addrtype

This module matches packets based on their address type. Address types are used within the kernel networking stack and categorize addresses into various groups. The exact definition of that group depends on the specific layer three protocol.

The following address types are possible:

UNSPEC

an unspecified address (i.e. 0.0.0.0)

UNICAST

an unicast address

LOCAL

a local address

BROADCAST

a broadcast address

ANYCAST

an anycast packet

MULTICAST

a multicast address

BLACKHOLE

a blackhole address

UNREACHABLE

an unreachable address

PROHIBIT

a prohibited address

THROW

FIXME

NAT

FIXME

XRESOLVE

[!] --src-type type

Matches if the source address is of given type

[!] --dst-type type

Matches if the destination address is of given type

--limit-iface-in

The address type checking can be limited to the interface the packet is coming in. This option is only valid in the PREROUTING, INPUT and FORWARD chains. It cannot be specified with the –limit-iface-out option.

--limit-iface-out

The address type checking can be limited to the interface the packet is going out. This option is only valid in the POSTROUTING, OUTPUT and FORWARD chains. It cannot be specified with the –limit-iface-in option.

Lire la suite…

Ce script lit la configuration de votre pare-feu basé sur iptables et affiche vos règles dans l’ordre dans lequel les paquets vont effectivement les traverser. La sortie est intuitive tout en ressemblant étroitement à celle de iptables-save, et indique la table propriété des règles, etc.

Très commode pour débugger vos scripts iptables.

Source: sourceforge.net