The Best Damn Firewall Book Period

Iptables derives its name from the three default tables it uses, which are listed in Table 5.2. Each interface on your system can have its packets managed and modified by the chains contained in each of these tables.

Iptables is an extension of Ipchains, because Iptables adds the nat and mangle tables. Ipchains uses only the three chains listed in the filter table in Table 5.1. Thus, with Ipchains, you have access to only the INPUT, FORWARD, and OUTPUT options. If you want to masquerade using Ipchains, you will use the —masquerading option for the FORWARD chain. In Iptables, if you want to filter out packets using, you will use the filter table, and if you want to masquerade packets, you will use the nat table. In Iptables, if you do not specify a table, it will default to the filter table. Now that you understand tables, it is important to understand the specific chains.

A chain is a series of actions to take on a packet. Whenever you use Ipchains or Iptables to configure a firewall, the proper perspective to adopt is to view all packets from the firewall itself. Even more specifically, you should consider all packets from the perspective of the network interface, the table used, and the specific chains. For example, if you are using the filter table, each interface on your network has three different default chains:

• INPUT Contains rules that determine what will be done with all packets that enter this specific interface (for example, eth0).

• FORWARD For the purposes of this chapter, contains rules that determine if a packet will be masqueraded.

• OUTPUT Contains rules that determine filtering for packets leaving the interface.

The nat and mangle tables contain two additional chain types. The PREROUTING chain alters packets when they enter the interface. The POSTROUTING chain is used for altering packets when they are ready to leave the host. The POSTROUTING chain is essential to masquerading connections.

Built-In Targets and User-Defined Chains

Ipchains and Iptables use built-in targets to specify the destination of a packet. By far, the most common built-in targets are DROP and ACCEPT. Table 5.2 describes each of these in detail. (Additional targets exist. You can read about them by consulting the Ipchains or Iptables man page.)

User-defined chains are often useful if you want to create a large number of rule entries, but do not want a chain to become too long. Chains that become too long can slow down the packet, and are difficult to read and organize. The following is a sequence where a user defined chain is created, modified, and then invoked:

ipchains -N custom ipchains -A custom -s 0/0 -d 0/0 -p icmp -j REJECT ipchains -A input -s 0/0 -d 0/0 -j custom

This is a trivial example, of course. The –A option "appends" a rule, meaning that it is placed at the beginning of a chain. The –I option adds the rule to the end of a chain. The user-defined rule of james is created, and then a rule dropping all ICMP packets is added to this custom chain. Then, a rule is added to the default input chain that all packets are processed by the custom chain. As a result, any and all ICMP packets will be dropped. If you were to make the mistake of forgetting to have the input chain refer to the chain named custom, then the custom chain would never be read.

In Iptables, the equivalent of the preceding command sequence would be very similar (it is possible, of course, to create user-defined chains that are much more ambitious).

ipchains -N custom ipchains -A custom -s 0/0 -d 0/0 -p icmp -j DROP ipchains -A input -s 0/0 -d 0/0 -j custom

Iptables would look like this:

iptables -N custom iptables -A custom -s 0/0/ -d 0/0 -protocol icmp -j DROP iptables -A input -s 0/0 -d 0/0/ -j custom

Specifying Interfaces

If no interface is specified, the first interface (usually eth0) is assumed. If you have multiple interfaces, you must specify the interface you want to be added to the chain. Thus, in a multiple-NIC system, when you use the INPUT chain to deny all ICMP traffic, you must specify the interface. If, for example, you have a system with two interfaces that allowed all traffic, you would have to issue the following commands:

ipchains -A input -i eth0 -s 0/0 -d 0/0 –p icmp –j REJECT ipchains -A input -i eth1 -s 0/0 -d 0/0 –p icmp –j REJECT

Now, this system will not forward ICMP packets on either the eth0 or the eth1 interface. For Iptables, the commands would be as follows:

iptables -A INPUT -i eth0 -s 0/0 -d 0/0 --protocl icmp --icmp-type echo-reply –j REJECT iptables -A INPUT -i eth1 -s 0/0 -d 0/0 --protocl icmp --icmp-type echo-reply –j REJECT

In both Iptables and Ipchains, the FORWARD chain allows you to specify a source and destination interface. This is because the FORWARD chain is used to masquerade connections. Thus, the -i and -o options allow you mark packets passing between interfaces.

Setting Policies

Both Ipchains and Iptables default to accepting all connections. The safest option is to set the default policy to first deny all traffic. You can then create rules to explicitly allow certain traffic types. You can change this default stance using the -P option. For example, the following Ipchains command changes the default policy of the input chain to deny:

ipchains –P input DENY

The following command does the same thing in Iptables:

iptables –P input DROP

To reset the policy to accept, you simply use the ACCEPT target.

Listing Tables and Chains

Once you generate Ipchains or Iptables rules, you can then list them. For example, the following Ipchains command would list all chains and rules:

ipchains -L

Iptables uses the same command:

iptables -L

You can, if you want, list specific chains:

ipchains -L output

Because Iptables allows you to modify three different tables, you can also list specific tables. To list all nat chains, you would issue the following command:

iptables -t nat -L

The following command would view only the POSTROUTING chain in the nat table:

iptables -t nat -L POSTROUTING

Consider the following output from the -L option in Iptables:

iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination custom icmp -- anywhere anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain LD (0 references) target prot opt source destination Chain custom (1 references) target prot opt source destination DROP icmp -- anywhere anywhere

This output shows that the INPUT chain of the filter table contains one rule. This rule does not block ICMP traffic. Rather, it specifies that all ICMP traffic will be handled by the custom chain. The custom chain, listed last, does the actual dropping of all ICMP packets sent to this host.

The following commands allow you to list all of the rules by number:

ipchains --line-numbers -L iptables --line-numbers -L

Saving, Flushing, and Restoring Rules

Once you have created rules in Ipchains or Iptables, you can save them using the following commands:

/sbin/ipchains-save /sbin/iptables-save

These commands are helpful for two reasons. First, you can save the tables and rules to a text file in order to study them. Second, backing up your rules is important, as it generally takes considerable time to create the "perfect" firewall for your situation, and you should keep a backup in case your firewall configuration somehow gets lost. To save your Iptables information to a text file, for example, you would issue the following command:

/sbin/iptables-save > iptables.txt

To flush any existing rules, you can use the –F option:

ipchains -F iptables -F

Used without arguments, this command will erase the contents of all rules in Ipchains, and all rules in the filter table of Iptables. To flush a specific chain, you would issue the following command(s):

ipchains -F input iptables -F INPUT

The -F option does not delete rules from either the nat or mangle tables in Ipchains, however. To delete information from a specific table, you have to specify the table as follows:

iptables -t nat -F

The –F function does not change a policy from DROP to ACCEPT, either. You must use the –P option, discussed earlier.

In case you need to restore your backup information, you can use the following commands:

ipchains-restore iptables-restore

For example, to restore the Iptables rules database using the iptables.txt file created earlier, you would issue the following command:

/sbin/iptables-restore iptables.txt

By default, Ipchains-restore will append any restore information to any existing rules. You can use the –f option to flush out any existing rules, if you want.

However, the Iptables-restore command automatically erases any existing Iptables rules whenever it is used. However, you can use the –n option, which appends the contents of the restore file to any existing rules.

Using Ipchains to Masquerade Connections

The Ipchains command has only one table, and three chains (INPUT, FORWARD, and OUTPUT). Using the FORWARD chain and the MASQ target, you can masquerade any IP address you want. Suppose, for example, that you have a router that connects the 192.168.1.0/24 network and the 10.100.100.0/24 network. Suppose further that this firewall's eth0 interface contains the Internet-addressable IP address of 66.1.5.1/8. The following Ipchains command issued on the router would enable both private-IP networks to communicate via the Internet:

ipchains –A forward –I eth0 –s 192.168.1.0/24 –j MASQUERADE ipchains –A forward –I eth0 –s 10.100.100.0/24 –j MASQUERADE

This rule specifies that any connection from the 192.168.1.0/24 and 10.100.100.0/24 networks will be masqueraded as 66.1.5.1/8 on eth0. The –A option adds the rule to the forward chain, and the –I option specifies the eth0 interface. The –s option specifies the networks in question.

This particular configuration actually exposes the network. Any remote host would be able to use your masquerading firewall to access your host. The following additions to the FORWARD chain of the filter table ensures that your masquerading router masquerades only for your internal network:

ipchains –A forward –s 192.168.1.0/24 –j ACCEPT ipchains –A forward –d 192.168.1.0/24 –j ACCEPT ipchains –A forward –s 10.100.100.0/24 –j ACCEPT ipchains –A forward –d 10.100.100.0/24 –j ACCEPT ipchains –A forward –j DROP

Iptables Masquerading Modules

Many of the protocols you want to use on the Internet, such as FTP or RealAudio, require additional support. Iptables provides several modules that allow masqueraded clients to access these resources. Some of these are described in Table 5.3.

Enabling these options requires that you use the /sbin/insmod command. For example, to enable the ip_masq_ftp and ip_masq_raudio modules, you would issue the following command:

/sbin/insmod ip_masq_ftp /sbin/insmod ip_masq_raudio

To automate this process, you can place these entries into a script, or into /etc/rc.local.

Using Iptables to Masquerade Connections

Using the same example of the 192.168.1.0/24 network and the 10.100.100.0/24 network connected by the firewall with the IP address of 66.1.5.1/8, you would use the following command:

iptables –t nat –A POSTROUTING –d ! 192.168.1.0/22 –j MASQUERADE iptables –t nat –A POSTROUTING –d ! 10.100.100.0/24 –j MASQUERADE

This rule is added to the nat table (-t), and is added to the POSTROUTING chain (-a). The ! mark tells netfilter/Iptables to masquerade all packets not destined for the internal networks. Specifically, it stipulates that if the packet is not sent to either the 192.168.1.0/22 or 10.100.100.0/24 network, then the packet needs to be modified so that it masquerades as the 66.1.5.1/8 IP address. Consequently, any packet that leaves the interface will be rewritten with the 66.1.5.1/8 address, but packets that stay on the internal network will not be rewritten. The eth0 interface is assumed by default. If, for some reason, you had to specify a different interface that has the Internet-routable address, you would use the –o option:

iptables –t nat –o eth1 –A POSTROUTING –d ! 192.168.1.0/22 –j MASQUERADE iptables –t nat –o eth1 –A POSTROUTING –d ! 10.100.100.0/24 –j MASQUERADE

As with Ipchains, this particular configuration leaves the network wide open. The following additions to the FORWARD chain of the filter table ensure that your masquerading router masquerades only for your internal network:

iptables –A FORWARD –s 192.168.1.0/24 –j ACCEPT iptables –A FORWARD –d 192.168.1.0/24 –j ACCEPT iptables –A FORWARD –s 10.100.100.0/24 –j ACCEPT iptables –A FORWARD –d 10.100.100.0/24 –j ACCEPT iptables –A FORWARD –j DROP

Notice the order of these entries. Both Ipchains and Iptables consider rules in strict order, which is why the preceding rules first accept certain packets and then drop the rest. If the final entry (iptables –A FORWARD –j DROP) were listed first, then all packets would be denied.

Iptables Modules

Table 5.4 lists some of the most commonly used modules for Iptables.

You can load these modules using insmod. Iptables masquerades the FTP, RealAudio, and IRC protocols by default.

Exercise: Masquerading Connections Using Ipchains or Iptables

1. Configure your Linux system with at least two NICs.

2. Enable IP forwarding using the instructions given earlier in this chapter.

3. Using either Ipchains or Iptables, invoke masquerading for your IP addresses using the instructions given earlier in this chapter.

4. Now, configure the FORWARD chain in the filter table (or just the FORWARD chain in Ipchains) so that it will masquerade only your internal hosts.

5. If necessary, load the modules necessary to support FTP, IRC, and additional protocols.

6. You will likely have to adjust your masquerading settings. Make sure that you save your settings using the /sbin/ipchains-save command.