Inetone: Firewall with iptables

Dies ist Version . Es handelt sich nicht um die aktuelle Version und kann folglich auch nicht geändert werden.

[Zurück zur aktuellen Version][Diese Version wiederherstellen]

Commands#

> ls -la /usr/sbin/ip*  # list all commands, there are many
> iptables*             # for ipv4 (in debian busters = nft)
> ip6tables*            # for ipv6 (in debian busters = nft)
> iptables-legacy       # former ones, not nft
> iptables-nft          # directly use nft

Notes:

all iptables commands (for ipv4 only) have an ip6tables* equivalent for ipv6
see info on nft

> who -u                      # get all sessions with ip and pid
> sudo netstat -pantW         # list network connections, p=programs,a=all,n=IPs,t=tcp,W=wide(not truncate IP address) 
> ip a                        # list all ips

Logging#

> iptables -A INPUT -j LOG --log-level 4 --log-prefix 'IP INPUT '

Syntax#

see docu

> sudo ip6tables -L -v 
> sudo ip6tables -nvL                     # thjis is most compact
> sudo ip6tables -n -v --line-numbers -L  # list all ipv6 rules with numeric IPs and rule number
> sudo service ip6tables start		  # activate firewalling
> sudo chkconfig ip6tables on		  # enable after reboot

ip6tables [-t <table-name>] <command> <chain-name> <parameter-1>  <option-1> <parameter-n> <option-n>

table-name
- like [filter, nat, mangle, raw, security], if omitted we use "filter"
command
- -F : flush current chain or all if omitted
- -X : deletes a user-specified chain or all if omitted
- -Z : zeros the byte and packet counters in all chains
- -A : apppend a rule at the end
- -I : inserts at a specified position (similar to replace -R), wihtout position at the top
- -P : a policy is a fall back and is used after all rules have passede** you can enable certain special addresses earlier
- -L : list all rules
chain-name
- INPUT, FORWARD, OUTPUT (as listed with > iptables -L)
- you may invent new chain names, but this seems not to be common (command -N)
parameter-1 (filter)
- -s : source filter (address[/mask][...])
- -d : destination filter
- -p : protocoll filter like [icmp, tcp, udp, all] or those in /etc/protocols, if omitted ALL protocols are considered
  - with -p tcp you can use --dport for destination port filter, any number
  - with -p udp you can use --dport for destination port and --sport as source port filter
  - ports can be also a range like 3000:3200 (all from 3000 to 3200)
  - with -p icmp you can use --icmp-type
- -i : interface like [eth0, lo, ppp0], without name ALL interfaces are used
- -j : jump to [ACCEPT, DROP, QUEUE, RETURN] (or others added with modules), REJECT= notify other end, DROP= silently ignore
- -m : adds a comment when listing the rules, syntax >-m comment --comment "My comments here"<
option-1 (target)
- [ACCEPT, DROP, QUEUE, RETURN] (or others added with modules)
option-n (listing options)
- -v : verbose output
- -n : displays IP addresses and port numbers in numeric format instead of hostname/network service
notes
- the first three commands are usually used to create a fresh ruleset in a script
- in the chain list and then drop all other later

Examples #

Allow incoming SSH from 2001:0db8:100::1/128 
	ip6tables -A INPUT -i eth0 -p tcp -s 2001:0db8:100::1/128 --sport 512:65535 --dport 22 -j ACCEPT 
Allow response packets (no longer needed if connection tracking is used!) 
	ip6tables -A OUTPUT -o eth0 -p tcp -d 2001:0db8:100::1/128 --dport 512:65535 --sport 22 ! --syn -j ACCEPT 
Block incoming TCP connection requests to this host 
	ip6tables -I INPUT -i eth0 -p tcp --syn -j DROP 
Block incoming TCP connection requests to hosts behind this router 
	ip6tables -I FORWARD -i eth0 -p tcp --syn -j DROP 
Block incoming UDP packets which cannot be responses of outgoing requests of this host 
	ip6tables -I INPUT -i eth0 -p udp ! --dport 32768:60999 -j DROP 
Block incoming UDP packets which cannot be responses of forwarded requests of hosts behind this router
	ip6tables -I FORWARD -i eth0 -p udp ! --dport 32768:60999 -j DROP
Rate-limiting
	ip6tables -A INPUT --protocol icmpv6 --icmpv6-type echo-request -j ACCEPT --match limit --limit 30/minute

-A RH-Firewall-1-INPUT -p icmpv6 -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT 
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited

My RuleSet#

This one is

allowing dhcp, dns and router traffic
not allowing ipv4
allowing ipv6 for 3 distinct ipv6 addresses, these are the first three ipv6 rules, which we replace at Exposing Raspberry to Internet

#!/bin/bash

SOURCE=::

# ipv4 ------------------------------------
# Flush all rules and delete all chains for a clean startup
iptables -F
iptables -X
iptables -Z             # Zero out all counters

# enable dns nameserver
iptables -A INPUT  -s 1.1.1.1 -j ACCEPT    # cloudflare
iptables -A OUTPUT -d 1.1.1.1 -j ACCEPT
iptables -A INPUT  -s 8.8.8.8 -j ACCEPT    # google
iptables -A OUTPUT -d 8.8.8.8 -j ACCEPT

# connection
iptables -A INPUT  -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT

# enable router for dhcp
iptables -A INPUT  -s 192.168.188.1/24 -j ACCEPT
iptables -A OUTPUT -d 192.168.188.1/24 -j ACCEPT

# enable dns
iptables -A INPUT  -p udp -m multiport --sport 53,67,68,90,135,853,5353,8245 -j ACCEPT
iptables -A OUTPUT -p udp -m multiport --dport 53,67,68,90,135,853,5353,8245 -j ACCEPT

#iptables -A INPUT  -i eth0 -p udp --dport 67:68 --sport 67:68 -j ACCEPT
#iptables -A INPUT  -i eth0 -p udp -m udp -m multiport --dports 67:68 -j ACCEPT
#iptables -A OUTPUT -o eth0 -p udp -m udp -m multiport --dports 67:68 -j ACCEPT

# enable dhcp
iptables -A INPUT  -i eth0 -p icmp -j ACCEPT
iptables -A OUTPUT -o eth0 -p icmp -j ACCEPT
iptables -A INPUT -i eth0 -p icmp -m icmp --icmp-type 134 -m comment --comment router-advertisement -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type 135 -m comment --comment neighbor-solicitation -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type 136 -m comment --comment neighbor-advertisement -j ACCEPT

# allow local loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# drop everything else
iptables -A INPUT   DROP
iptables -P FORWARD -j DROP
iptables -A OUTPUT  -j DROP

# ipv6 ------------------------------------
# Flush all rules and delete all chains for a clean startup
ip6tables -F
ip6tables -X
ip6tables -Z

# drop all ipv6 traffic, except special ipv6, see below
# do not limit to --dport 22, because the source has random ports (?)
# add first to enabel replacing 1. rule later

# placeholder for first device
ip6tables -A INPUT  -s $SOURCE -j ACCEPT
ip6tables -A OUTPUT -d $SOURCE -j ACCEPT

# placeholder for second device
ip6tables -A INPUT  -s $SOURCE -j ACCEPT
ip6tables -A OUTPUT -d $SOURCE -j ACCEPT

# placeholder for third device
ip6tables -A INPUT  -s $SOURCE -j ACCEPT
ip6tables -A OUTPUT -d $SOURCE -j ACCEPT


# dns nameserver
ip6tables -A INPUT  -s 2606:4700:4700::1111 -j ACCEPT    # cloudflare
ip6tables -A OUTPUT -d 2606:4700:4700::1111 -j ACCEPT
ip6tables -A INPUT  -s 2001:4860:4860::8888 -j ACCEPT    # google
ip6tables -A OUTPUT -d 2001:4860:4860::8888 -j ACCEPT

# connection
ip6tables -A INPUT  -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
ip6tables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT

# enable dhcp
ip6tables -A INPUT  -s fd94::/16 -j ACCEPT
ip6tables -A OUTPUT -d fd94::/16 -j ACCEPT
ip6tables -A INPUT  -s fe80::/16 -j ACCEPT
ip6tables -A OUTPUT -d fe80::/16 -j ACCEPT

# enable dns
ip6tables -A INPUT  -p udp -m multiport --sport 53,67,68,90,135,853,5353,8245 -j ACCEPT
ip6tables -A OUTPUT -p udp -m multiport --dport 53,67,68,90,135,853,5353,8245 -j ACCEPT

# enable dhcp
ip6tables -A INPUT -p  ipv6-icmp -j ACCEPT
ip6tables -A OUTPUT -p ipv6-icmp -j ACCEPT

#ip6tables -A INPUT -i eth0 -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m comment --comment router-advertisement -j ACCEPT
#ip6tables -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m comment --comment neighbor-solicitation -j ACCEPT
#ip6tables -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m comment --comment neighbor-advertisement -j ACCEPT


# allow ipv6 local loopback
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT

# drop everthing else
ip6tables -P FORWARD DROP               # as policy generally
ip6tables -A INPUT   -j DROP
ip6tables -A OUTPUT  -j DROP

# update first ip6tables rules and enable my computers
/home/markus/update_ip6tables.py

echo "---- iptables ----"
iptables -vnL
echo 
echo "---- ip6tables ----"
ip6tables -vnL

Commands#

Logging#

Syntax#

Examples#

My RuleSet#

Examples #