Iptables
quick 'n dirty guide to iptables as a firewall
list rules: iptables --list
save rules: (they will not stay when your interface goes down) iptables-save > /etc/iptalbes.conf
restore rules: iptables-restore < /etc/iptables.conf
auto appy rules: echo "iptables-restore < /etc/iptables" > /etc/network/if-up.d/iptables chmod +x /etc/network/if-up.d/iptables
after you make changes do not forget to save them with iptables-save > /etc/iptalbes.conf
set default policy: iptables -P INPUT DROP iptables -P OUTPUT ACCEPT
accept established connections: (let what goes out come back in) iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A adds a rule to the end of a chain replace with a -I to add a rule at the begenning of a chain
allow communication through loopback or localhost: iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT
the interface will not show in iptables --list so this will look broken. iptables -S will tell the true story
allow ssh in: iptables -A INPUT -p tcp --dport 22 -j ACCEPT
allow ssh from a specific network: iptables -A INPUT -p tcp -s 192.168.100.0/24 --dport 22 -j ACCEPT
allow ping from outside to inside: iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
allow ping from inside to outside: iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
find more filters: man iptables many options starting with a -- require a module to be called ahead of it ex: iptables -I OUTPUT --uid-owner 1000 -j ACCEPT will fail with an unknown option "--uid-owner" if you load the correct moudle first, iptables -I OUTPUT -m owner --uid-owner 1000 -j ACCEPT it will work.
log dropped packets: iptables -A OUTPUT -m conntrack --ctstate NEW -j LOG --log-prefix "OUTPUT_DROP: " --log-level 7 --log-ip-options
the order of rules matters
rules are processed from top down
when an ACCEPT or DROP is hit processing of a packet will stop
misc blocks for common attacks: iptables -I INPUT -p tcp ! --syn -m state --state NEW -j DROP iptables -I INPUT -f -j DROP iptables -I INPUT -p tcp --tcp-flags ALL ALL -j DROP iptables -I INPUT -p tcp --tcp-flags ALL NONE -j DROP
block DoS attacks: iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
other cool stuff:
load balance web traffic: iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 0 -j DNAT --to-destination 192.168.1.101:443 iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 1 -j DNAT --to-destination 192.168.1.102:443 iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 2 -j DNAT --to-destination 192.168.1.103:443
allow a specific user access through a port: iptables -I OUTPUT -p tcp --dport 80 -m owner --uid-owner 1000 -j ACCEPT
allow a specific process access through a port: iptables -I OUTPUT -p tcp --dport 23 -m owner --pid-owner 23945 -j ACCEPT
allow a specific command access through a port: iptables -I OUTPUT -p tcp --dport 110 -m owner --cmd-owner claws-mail -j ACCEPT
sources: http://www.yolinux.com/TUTORIALS/LinuxTutorialIptablesNetworkGateway.html http://www.cyberciti.biz/tips/linux-iptables-10-how-to-block-common-attack.html http://www.thegeekstuff.com/2011/06/iptables-rules-examples/ Linux iptables Pocke Reference - O'Reilly
sources: http://www.yolinux.com/TUTORIALS/LinuxTutorialIptablesNetworkGateway.html http://www.cyberciti.biz/tips/linux-iptables-10-how-to-block-common-attack.html http://www.thegeekstuff.com/2011/06/iptables-rules-examples/ Linux iptables Pocke Reference - O'Reilly