Linux Firewalls Flashcards
Three ways to stop iptables or firewalld
service stop firewalld
systemctl stopfirewalld
chkconfig firewalld off
REMEMBER TO MASK SERVICE
Install iptables
yum install iptableds-services
Check iptables rules and then flush them
iptables -L
iptables -F
What are the 3 different things used for packet filtering in IPtables?
Tables
Chains
Targets
What is a table?
Allows you to process packets in specific ways
types of tables:
filter
mangle
nat
raw
What is a chain
Chains are attached to tables and allow you to inspect traffic at various points
Input - incoming
Output - outgoing
Forward - going to a router from one device to another
What is a target
Rule for what happens to chain
Accept
Reject - drop and notify
Drop - don’t notify
Describe the output of iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source
target - what happens to traffic
prot - protocol (tcp,udp,icmp, or all)
opt - options (rarely used)
source - where’s it coming from
Drop all traffic from 192.168.0.25 - IPTABLES
iptables -A INPUT -s 192.168.0.25 -j DROP
-A - append rule to end of selected chain
-s - source
-j - jump (target)
-d - destination
Drop all traffic from range of ips - IPTABLES
iptables -A INPUT -s 192.168.0.0/24 -j DROP
you have two rules now, delete rule number one - IPTABLES
iptables -D INPUT 1
Block all pings - IPTABLES
iptables -A INPUT -p icmp -j DROP
-p - policy
Block port 80/tcp - IPTABLES
iptables -A INPUT -p tcp –dport 80 -j DROP
Block traffic coming from 192.168.1.12 to NIC ens160 - IPTABLES
iptables -A INPUT -i ens160 -s 192.168.0.25 -j DROP
Block user access to facebook -IPTABLES
nslookup facebook.com
iptables -A OUTPUT -d 157.240.10.35 -j DROP
Block all incoming traffic except for ssh -IPTABLES
Remember: rules are read in order, if the DROP all goes first, it will stop reading
iptables -A INPUT -p tcp –dport 22 -j ACCEPT
iptables -P INPUT DROP
When you look at the policy at the top, it should say (policy DROP)
Flushing will only flush the rule, not the chain policy.
If you want to clear the input drop, either change it or restart iptables
systemctl restart iptables
Save iptables
where is save located?
iptables -save > /etc/sysconfig/iptables
If you want to put rule at beginning instead of at the end (appending), what option would you use? - IPTABLES
iptabes -I INPUT -s 192.168.1.12 -j DROP
What are the four options for firewalld
Tables
Chains
Rules
Targets
What is a rule?
associated to chains
ex:
if incoming traffic matches this rule then do the TARGET
What should you do if you’re using firewalld?
systemctl stop/mask iptables
Show current zone - FIREWALLD
firewall-cmd –get-active-zones
Reject incoming traffic from 192.168.1.114 - FIREWALLD
firewall-cmd –add-rich-rule=’rule family=”ipv4” source address=”192.168.1.114” reject’
Block ICMP traffic then turn it back on - FIREWALLD
firewall-cmd –add-icmp-block-inversion
firewall-cmd –remove-icmp-block-inversion
Block outgoing traffic to facebook - FIREWALLD
firewall-cmd–direct –add-rule ipv4 filter OUTPUT 0 -d 31.31.31.13 -j DROP
Remove telnet, if you have it disable it before hand
rpm -qa | grep telnet
rpm -e telnet-server.xxx
systemctl mask telnet.socket
-e means erase
How do firewall zones work
If you add a source ip to a zone it will use that zone.
Default action is, that if there are no rules for a specific thing it sends it up to the next default zone (if you’re using a source in a different zone, and then goes off that.
The steps rules take is
rich-rule
source -zone
default-zone
Make it to where anyone but your other linux machine can access your http page
Put interface in public zone and make the source for the other linux machine in a drop zone
List all services enabled
List all rules
list all rules for just the public zone
Show all services available
List all zones
List open ports
display default zone
firewall-cmd –list-all –zone=public
firewall-cmd –list-all
firewall-cmd –list-services
firewall-cmd –get-services
firewall-cmd –get-zones
firewall-cmd –list-ports
firewall-cmd –get-default-zone
Disable all network traffic
See if panic mode is on
firewall-cmd –panic-on
firewall-cmd –panic-off
firewall-cmd –query-panic
Make ALL changes permanent
firewall-cmd –runtime-to-permanent
Change default zone to public
firewall-cmd –set-default-zone public
–permanent if you are using:
firewall-cmd –runtime-to-permanent
Assign interface to zone via firewall-cmd and nmcli
firewall-cmd –zone=public –change-interface=ens36
nmcli connection modify ens36 connection.zone public
Check if firewalld configuration works
firewall-cmd –check-config
How would you assign a zone to an interface via the ifcfg file?
ZONE=public
Create a new zone
firewall-cmd –permanent –new-zone=farter
firewall-cmd –permanent –delete-zone=farter
Where are the zone coding files located?
/usr/lib/firewalld/zones
Create a zone and set it’s target as accept
firewall-cmd –permanent –new-zone=farter –set-target=ACCEPT
Set a source port for drop to be 22
firewall-cmd –permanent –zone=drop –add-source-port=22/tcp
Where do you go to modify direct rules?
/etc/firewalld/direct.xml
