This document discusses Linux firewalls and IPtables. It explains that firewalls use a set of security rules to filter packets and restrict access. These rules are stored in IPtables. Each rule contains information like the protocol, source/destination addresses, and a target action of ACCEPT, DROP, etc. Examples are given of rules to accept packets from only one IP, from the local network, and to prevent new connections on port 22. The document also covers Network Address Translation (NAT) operations in IPtables, including SNAT to change the source address and DNAT to change the destination address when packets pass through the PREROUTING and POSTROUTING chains.

1. Gaurav Mishra
<gmishx@gmail.com>
Linux - 3
Firewall and IPtables
Unrestricted
2/24/2018

2. Gaurav Mishra <gmishx@gmail.com>
Firewalls
• Firewall is a program used to filter
packets.
• It uses set of preset security rules to
filter packets.
• It is used to restrict access from
unknown or non-trusted sources.
• Firewalls can perform NAT
translations as well.
• Linux systems have firewalls installed
for them.
• Any Linux system can act as a firewall
for a network.
2/24/2018

3. Gaurav Mishra <gmishx@gmail.com>
IPtables
• The security rules and NAT
translations used by firewall are stored
in IPtables.
• Netfilter is a modular firewall.
• It stores packet filtering and NAT
translations separately.
• Each set of rules to be checked for
packet filtering is called as Chain.
• Modules used are Netfilter are located
at:
▫ /usr/lib/<kernel-
version>/kernel/net/ipv<4/6>/net
filter
2/24/2018

4. Gaurav Mishra <gmishx@gmail.com>
Packet filtering
• Each rule in a chain contains following
parts:
▫ Protocol (-p)
 TCP, UDP, ICMP or ALL
▫ Source address (-s)
 ip address[/mask][port[:port]]
▫ Destination address (-d)
 ip address[/mask][port[:port]]
▫ Network interface (-i)
 name[+]
▫ Target (-j)
 ACCEPT, DROP, REJECT, QUEUE,
RETURN
▫ State (-m)
 NEW, ESTABLISHED, RELATED,
INVALID, RELATED+REPLY
2/24/2018

5. Gaurav Mishra <gmishx@gmail.com>
Packet filtering
• Accepting packets only from 192.168.56.102
▫ iptables -A INPUT -j REJECT ! -s 192.168.56.102
• Accepting packets only on port 80, 8080, 22 and 24
▫ sudo iptables -A INPUT -p all -s 0/0 -d 0/0 --dport 80 -j ACCEPT
▫ sudo iptables -A INPUT -p all -s 0/0 -d 0/0 --dport 8080 -j ACCEPT
▫ sudo iptables -A INPUT -p all -s 0/0 -d 0/0 --dport 22 -j ACCEPT
▫ sudo iptables -A INPUT -p all -s 0/0 -d 0/0 --dport 24 -j ACCEPT
▫ sudo iptables -A INPUT -j REJECT
• Accepting packets only on local network
▫ sudo iptables -A INPUT -p all -j REJECT ! -s 192.168.56.1/16
• Preventing new connections on port 22
▫ sudo iptables -A INPUT -p all -m --state NEW -s 0/0 –d 0/0 --dport 22 –j
REJECT
2/24/2018

6. Gaurav Mishra <gmishx@gmail.com>
NAT operations
• Network Address Translation allows
one system to change the
source/destination address of a packet
and forward it.
• NAT enabled machine remembers the
changes made so it can reverse them
on a reply packet.
• NAT is specially used in networks with
a single IP address exposed.
• NAT enabled routers allows many
machines on a single network to share
the same IP address provided by ISP.
2/24/2018

7. Gaurav Mishra <gmishx@gmail.com>
NAT translation
2/24/2018

8. Gaurav Mishra <gmishx@gmail.com>
NAT targets
• SNAT
▫ Modify source address, use --to-source
• DNAT
▫ Modify destination address, use --to-destination
• REDIRECT
▫ Redirect a packet to other destination/port
• MASQUERADE
▫ IP masquerading
• MIRROR
▫ Swap source and destination address
• MARK
▫ Modify Mark field to control message routing
2/24/2018

9. Gaurav Mishra <gmishx@gmail.com>
NAT chains
• NAT can be divided into two types: Destination NAT and Source NAT
• NAT have following chains:
▫ PREROUTING
 Corresponds to DNAT, arriving packets
▫ POSTROUTING
 Corresponds to SNAT, leaving packets
▫ OUTPUT
 Locally generated packets
• Changing source of packets leaving the system
▫ sudo iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source
192.168.56.101
• Changing destination of packets entering the system
▫ sudo iptables -t nat -A PREROUTING -i eth0 -j DNAT --to-destination
192.168.56.103
2/24/2018