Revision as of 12:44, 19 April 2017

iptables is a packet filtering, NAT/PAT and packet mangling tool for Linux. Used by a variety of Linux distributions including Ubuntu, Redhat and CentOS. Iptables is highly configurable and are used in many firewall solutions.

• See also NAT Linux

Using IPTABLES

Iptables is a commandline command with numerous options, and need some training to master. There are three tables you can use filter(default) nat and mangle. Only filter and nat shown below.

iptables flowchart showing chains

The filter chains

Basically iptables has three filters/chains

• INPUT  : Packets from a Interface to a local process on the machine. A packet from outside to the machine.
• FORWARD: Packets traversing from one Interface to another Interface
• OUTPUT : Packets from a local process - the machine itself - to the outside world.

See the tables with the command

[root@bkshost sysconfig]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

The nat chains

When you use the nat table or mangle tables

• PREROUTING : Incoming packets before Routing decision. Used fx. for Destination nat
• POSTROUTING: Incoming packets after Routing decision. Used fx. for Source nat
• OUTPUT  : Packets from a local process - the machine itself - to the outside world.

See the tables with the command

[root@bkshost sysconfig]# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

IPTABLES firewall solutions

• Shorewall firewall [http://www.shorewall.net/ Shorewall.net 9

iptables syntax

very basic Firewall

Accepts only ping from inside to the outside. The machine is open to the Internet. Could be started in /etc/rc.local.

#!/bin/bash
#
# Start firewall
# Diverse erklæringer
FW=iptables
INT_NET="192.168.54.0/24"
EXT_NET="172.16.0.0/16"
EXT_IP="172.16.4.4"
EXT_IF="eth0"

# Fjern alle tidligere regler
$FW –F
$FW -F -t nat

# Sæt default politik til afvisning
$FW –P FORWARD DROP

# Tillad ping indefra
$FW –A FORWARD –s $INT_NET –p icmp --icmp-type echo-request –j ACCEPT

# Tillad pong udefra
$FW –A FORWARD –d $INT_NET –p icmp --icmp-type echo-reply –j ACCEPT

# Source NAT på udgående pakker
$FW -t nat –A POSTROUTING –o $EXT_IF –s $INT_NET –j SNAT --to-source $EXT_IP

#Accept forwarding. Start routing
echo "1" > /proc/sys/net/ipv4/ip_forward

basic firewall

iptables-save udskriver en liste over regler. Kommandoen

iptables-save > /etc/sysconfig/iptables

Gør nuværende opsætning af iptables permanent dvs. den loades under opstart af iptables scriptet /etc/init.d/iptables.

Her er et eksempel på et simpelt firewall script, hvor der åbnet for ping fra det interne net og ud. Samtidig ændres alle interne IP til ekstern IP 172.16.4.4:

#!/bin/bash
#
# Start firewall
#
# Tillader ping indefra og ud.
# Lukker for al anden trafik.
#
# OBS! Denne firewall rører udelukkende ved FORWARD
#

# Diverse erklæringer
FW=iptables
INT_NET="192.168.54.0/24"
EXT_NET="172.16.0.0/16"
EXT_IP="172.16.4.4"
EXT_IF="eth0"

# Fjern alle tidligere regler
$FW –F

# Sæt default politik til afvisning
$FW –P FORWARD DROP

# Tillad ping indefra
$FW –A FORWARD –s $INT_NET –p icmp --icmp-type echo-request –j ACCEPT

# Tillad pong udefra
$FW –A FORWARD –d $INT_NET –p icmp --icmp-type echo-reply –j ACCEPT

# Source NAT på udgående pakker
$FW -t nat –A POSTROUTING –o $EXT_IF –s $INT_NET –j SNAT --to-source $EXT_IP

TCP

established

iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

Port forwarding

#!/bin/bash
#
# Start firewall
#
# Tillader ping indefra og ud.
# Port forwarder port 8080 til intern server port 80
# Lukker for al anden trafik.
#
# OBS! Denne firewall rører udelukkende ved FORWARD
#

# Diverse erklæringer
FW=iptables
INT_NET="192.168.1.0/24"           # Internal network behind firewall
EXT_NET="192.168.138.0/24"         # External public network
EXT_IP="192.168.138.250"           # External public IP address
EXT_IF="ens160"                    # External interface
INT_IF="ens192"                    # Internal interface

# Fjern alle tidligere regler
$FW -F
$FW -F -t nat

# Sæt default politik til afvisning
$FW -P FORWARD DROP

# Tillad ping indefra
$FW -A FORWARD -s $INT_NET -p icmp --icmp-type echo-request -j ACCEPT

# Tillad pong udefra
$FW -A FORWARD -d $INT_NET -p icmp --icmp-type echo-reply -j ACCEPT

# Source NAT på udgående pakker
$FW -t nat -A POSTROUTING -o $EXT_IF -s $INT_NET -j SNAT --to-source $EXT_IP
#Accept forwarding. Start routing
echo "1" > /proc/sys/net/ipv4/ip_forward


#Forward port 8080 on $EXT_IP to internal webserver at 192.168.1.2 port 80

#Port forward i PREROUTING kæde
$FW -t nat -A PREROUTING -p tcp -i $EXT_IF  -d $EXT_IP --dport 8080 \
        -j DNAT --to 192.168.1.2:80
#Tillad trafik fra $EXT_IF til intern server til port 80
$FW -A FORWARD -p tcp -i $EXT_IF -d 192.168.1.2 --dport 80 -j ACCEPT
#Tillad returtrafik fra intern server fra port 80
$FW -A FORWARD -p tcp -i $INT_IF -d 0.0.0.0/0 -s 192.168.1.2 --sport 80 -j ACCEPT

Links

• Dokumentation

Software

• CentOS
• squid
• Webmin