iptables

Used to configure the IP packet filter rules of the Linux kernel firewall.

iptables -> IPv4 ip6tables -> IPv6 arptables -> ARP ebtables -> Ethernet frames

iptables allows the system administrator to define tables containing chains of rules for the treatment of packets. A chain does not exist by itself; it belongs to a table. There are three tables: nat, filter, and mangle.

Commands to check the iptable rules : 

iptables -L -v -n
// -L for the list, -v for packet & byte info, -n list numerically
iptables -t filter -L -v -n
iptables -t nat -L -v -n

Commands to accept/block certain type of connections : 

// Block all connections from the IP address 10.10.10.10
iptables -A INPUT -s 10.10.10.10 -j DROP

// Block all connections from IP addresses in 10.10.10.0/24 network range
iptables -A INPUT -s 10.10.10.0/24 -j DROP
OR
iptables -A INPUT -s 10.10.10.0/255.255.255.0 -j DROP

// Block SSH connections from 10.10.10.10
iptables -A INPUT -p tcp --dport ssh -s 10.10.10.10 -j DROP

// In case, we are blocking some connection which uses UDP protocol, we can give -p udp in place of -p tcp

// block ssh connections from any IP address
iptables -A INPUT -p tcp --dport ssh -j DROP

// Allowing internal (eth1) network to access external network (eth0)
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

// dropping invalid packets
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

// Allow incoming rsync connections from a specific IP address or subnet
// if you want to allow the entire 203.0.113.0/24 subnet to be able to rsync to your server
// rsync runs on 873
iptables -A INPUT -p tcp -s 203.0.113.0/24 --dport 873 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 873 -m conntrack --ctstate ESTABLISHED -j ACCEPT
// the above command allows outgoing traffic of rsync connections


// Allowing all incoming HTTP & HTTPS
iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Three different types of chains :

-> Input : used to control behavior of incoming connections. -> Forward : used for incoming connections that aren't actually being delivered locally. Think of a router - data is always being sent to it but rarely actually destined for the router itself; the data is just forwarded to its target. -> Output : used for outgoing connections.

Caveat :

Even though pinging an external host seems like something that would only need to traverse the output chain, keep in mind that to return the data, the input chain will be used as well. When using iptables to lock down your system, remember that a lot of protocols will require two-way communication, so both the input and output chains will need to be configured properly. SSH is a common protocol that people forget to allow on both chains. (Port 22)

Connection-specific responses :

-> Accept : allow the connection. -> Drop : drop the connection, act like it never happened. best if we don't want the source to realize that our system exists. -> Reject : don't allow the connection, send back an error. This is best if you don't want a particular source to connect to your system, but you want them to know that your firewall blocked them.

Connection States :

As we mentioned earlier, a lot of protocols are going to require two-way communication. For example, if you want to allow SSH connections to your system, the input and output chains are going to need a rule added to them. But, what if you only want SSH coming into your system to be allowed? Won't adding a rule to the output chain also allow outgoing SSH attempts?

That's where connection states come in, which give you the capability you'd need to allow two way communication but only allow one way connections to be established. Take a look at this example, where SSH connections FROM 10.10.10.10 are permitted, but SSH connections TO 10.10.10.10 are not. However, the system is permitted to send back information over SSH as long as the session has already been established, which makes SSH communication possible between these two hosts.

iptables -A INPUT -p tcp --dport ssh -s 10.10.10.10 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -p tcp --sport 22 -d 10.10.10.10 -m state --state ESTABLISHED -j ACCEPT

References :

  1. https://en.wikipedia.org/wiki/Iptables

  2. https://www.howtogeek.com/177621/the-beginners-guide-to-iptables-the-linux-firewall/

  3. https://www.digitalocean.com/community/tutorials/iptables-essentials-common-firewall-rules-and-commands

Last updated