Iptables
TL;DR base desktop rules
iptables -P INPUT DROP iptables -P FORWARD DROP iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT
quick 'n dirty guide to iptables as a firewall
list rules:
iptables --list
save rules: (they will not stay when your interface goes down)
iptables-save > /etc/iptalbes.conf
restore rules:
iptables-restore < /etc/iptables.conf
auto appy rules:
echo "iptables-restore < /etc/iptables" > /etc/network/if-up.d/iptables chmod +x /etc/network/if-up.d/iptables
after you make changes do not forget to save them with
iptables-save > /etc/iptalbes.conf
set default policy:
iptables -P INPUT DROP iptables -P OUTPUT ACCEPT
accept established connections: (let what goes out come back in)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
- -A adds a rule to the end of a chain
- replace with a -I to add a rule at the begenning of a chain
allow communication through loopback or localhost:
iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT
- the interface will not show in iptables --list so this will look broken.
- iptables -S will tell the true story
allow ssh in:
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
allow ssh from a specific network:
iptables -A INPUT -p tcp -s 192.168.100.0/24 --dport 22 -j ACCEPT
allow ping from outside to inside:
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
allow ping from inside to outside:
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
find more filters:
man iptables
many options starting with a -- require a module to be called ahead of it. Ex:
iptables -I OUTPUT --uid-owner 1000 -j ACCEPT
will fail with an "unknown option --uid-owner". If you load the correct moudle first,
iptables -I OUTPUT -m owner --uid-owner 1000 -j ACCEPT
it will work.
log dropped packets:
iptables -A OUTPUT -m conntrack --ctstate NEW -j LOG --log-prefix "OUTPUT_DROP: " --log-level 7 --log-ip-options
- the order of rules matters
- rules are processed from top down
- when an ACCEPT or DROP is hit processing of a packet will stop
watch logs:
tail -f /var/log/debug | grep DROP
misc blocks for common attacks:
iptables -I INPUT -p tcp ! --syn -m state --state NEW -j DROP iptables -I INPUT -f -j DROP iptables -I INPUT -p tcp --tcp-flags ALL ALL -j DROP iptables -I INPUT -p tcp --tcp-flags ALL NONE -j DROP
block DoS attacks:
iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
other cool stuff:
load balance web traffic:
iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 0 -j DNAT --to-destination 192.168.1.101:443 iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 1 -j DNAT --to-destination 192.168.1.102:443 iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 2 -j DNAT --to-destination 192.168.1.103:443
allow a specific user access through a port:
iptables -I OUTPUT -p tcp --dport 80 -m owner --uid-owner 1000 -j ACCEPT
allow a specific process access through a port:
iptables -I OUTPUT -p tcp --dport 23 -m owner --pid-owner 23945 -j ACCEPT
allow a specific command access through a port:
iptables -I OUTPUT -p tcp --dport 110 -m owner --cmd-owner claws-mail -j ACCEPT
sources:
