This document discusses Linux firewalls and iptables. It provides an overview of firewall basics, packet basics, common Linux firewalls that use iptables, and some basic iptables commands. It then demonstrates examples of iptables rules to block ping requests, reject ping requests, and drop incoming web traffic on port 80 from a specific client IP address. The document is intended as an introduction to iptables and provides demonstrations of common rule types and formats.

1. IPTables
Getting Started
Nishanth Kumar
n|u Bangalore chapter member
n|u / OWASP / G4H / SecurityXploded meet
22 Feb 2014

2. Agenda
• Firewall Basics
• Packet Basics
• Linux Firewalls
• What you can do with IPTables
• What you can’t do with IP Tables
• What you need to know about IP Tables
• Few Examples & Demo
22 Feb 2014

3. Firewalls
 Prevents Unauthorized access TO or FROM network.
 Hardware / Software / both
22 Feb 2014

4. What Firewalls do ?
 Filtering traffic based on POLICY
 Policy determines what is acceptable traffic
 Access control over traffic
 Accept or Deny
 May perform other duties
 Logging ( Forensics , SLA )
 Flagging ( Intrusion Detection )
 QOS ( bandwidth management , inbound &outbound traffic
priority )
22 Feb 2014

5. Typical Packet looks like …
22 Feb 2014

6. Linux Firewalls
 IP Cop
 Shore wall
 UFW – Uncomplicated Firewall
 Open BSD & PF
Most of the above firewall intern uses IPTables .
22 Feb 2014

7. Some basic commands
 service iptables status
 The above command is used to check the status of iptables
 service iptables start
 The above command is used to start the iptables
 service iptables stop
 The above command is used to stop the iptables
 iptables –F or iptables --flush
 The above command is used to clean-up all the default rules
and existing rules.
22 Feb 2014

8. Ping Block - DROP
iptables -A INPUT -p icmp -j DROP
22 Feb 2014

9. Description of rule
iptables -A INPUT -p icmp -j DROP
Service
PROTOCOL
NAME
APPEND
INPUT Chain
JUMP
PROTOCOL
TARGET
22 Feb 2014

10. Ping Block - REJECT
iptables -A INPUT -p icmp -j REJECT
22 Feb 2014

11. Description of rule
iptables -A INPUT -p icmp -j REJECT
Service
PROTOCOL
NAME
APPEND
INPUT Chain
JUMP
PROTOCOL
TARGET
22 Feb 2014

12. Web Server - Client Example
iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP
22 Feb 2014

13. Description of rule
iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP
Service
APPEND
INPUT
INTERFACE
INPUT Chain
PROTOCOL
NAME
Port
Number
PROTOCOL
JUMP
INTERFACE NAME
Destination Port
TARGET
22 Feb 2014

14. Web Server - Client Example - 1
192.168.99.12
192.168.99.11
iptables -A INPUT –s 192.168.99.12 -p tcp --dport 80 -j DROP
22 Feb 2014

15. Description of rule
iptables -A INPUT -s 192.168.99.12 -p tcp --dport 80 -j DROP
Service
APPEND
Source
PROTOCOL
NAME
Port
Number
INPUT Chain
PROTOCOL
JUMP
IP Address of the Source
Destination Port
TARGET
22 Feb 2014

16. Continue in Part 2
Thank you
22 Feb 2014