This article is aimed at providing the basics to using iptables as a fire wall for your personal home or production server, we won’t be covering every thing here but what we will be covering will give you enough information to demystify their man pages and get you going.
Firstly, the firewall and how it behaves is base events depending on if packet traffic is incoming, out bounding, or passing through. Basically, any time some one is sending a packet to your server it is incoming, any time your server sends a packet to another computer it is out bounding and in the case where you server is acting as a gateway or proxy to another machine on your network it is forwarding. These events that are triggered in this process are INPUT, OUTPUT, and FORWARD respectively.
Now for each of these chains you may have rules that determine how this traffic will be handled and every time a packet is sent or received it checks the corresponding chain for what is called a rule. A rule can be comprise of many different flag being triggered based on a number of criteria such as the ip the traffic is coming from or going to, the port the connection is coming from/going to, you can even filter traffic based on any text that the packet may contain, known as string blocking.All rules are read by iptables top to bottom, so any rule that is matched will be how the traffic is handled, if no rule is triggered then the handling based on the over all chain will determine how the traffic is handled. Based on any of that criteria you are going to tell iptables what to do with the traffic, this is signified by telling it one of the following modes.
ACCEPT – Accepts the packet and sends it to its destination.
DENY/REJECT - Will stop the packet and send a response back to the machine that initiated contact telling it that it is not accepting connections from them.
DROP – Will drop the packet altogether and send no response to the machine that initiated contact.
RETURN – Accepts the packet and and sends it to the target where there the packet is handled how ever it decides to. Use of this function will not be discussed in this article.
QUEUE – Sends the packet into the system queue in user space where it will be processed, queuing will ultimately be determined by the kernel you are running and what it’s method of queuing is, this is beyond the scope of this article.
Let’s say we just want to block one ip from accessing the server, this can be done simply with the following.
iptables -A INPUT -s 111.222.333.444 -j DROP
In this example the we are telling iptables to append our rule to the INPUT chain, -s is the source address we are wanting to block and DROP is how we would like the packet to be handled. -j is how we pass the action that we would like to taken.
There might be times you only want to block access to a specific port or service on the server, in cases like this you can use the –destination-port flag, you can either use the service name or the port when using destination port, for example FTP or 21. In the following example we will also be providing the protocol that is being used to send the packets. At the base level of communication you will have TCP and UDP, ICMP, etc , since FTP establishes it’s primary connection with TCP we will use -p to set the protocol to TCP, you can leave that portion out which should block all protocol connections on port 21.
iptables -A INPUT -s 111.222.333.444 -p tcp –destination-port 21 -j DROP
If you would like to prevent all access to FTP except for specific IPs you can use the same command with out a source address to block all traffic.
iptables -A INPUT -p tcp –destination-port 21 -j DROP
now to let IPs you want to access FTP you would use the following.
iptables -I INPUT -s 222.333.444.555 -p tcp –destination-port 21 -j ACCEPT
and if you wanted all of your internal network to still be able to reach FTP you would use.
iptables -I INPUT -s 192.168.0.0/24 -p tcp –destination-port 21 -j ACCEPT
Now I know what your thinking to your self, “Whoa, hold on here a minute. Just a second ago we were using -A to append the rules to the end of the chain, where did this -i jazz come from and why are we using it.”. I suppose I should have covered that earlier on, as said earlier -A will append your rules to the end of your chain, -I is used to insert rules into a specific location into your chain. In the last examples we used -I with out any thing which will default to adding the rule to the top of the chain. In this case ipchains needs to know what traffic we will accept to the port first any traffic not matching that will be blocked, you can put the rule some where else by providing w rule number. Such as
iptables -I 3 INPUT -s 111.222.333.444 -j DROP
In addition to appending and inserting you can also replace, delete, and flush rules. Replace and Delete are used in same fashion that insert is, by providing the rule number you would like to replace, delete. Flush will flush all of the rules from a specified chain, if no chain is provided it will effectively flush the rules from all of your chains. Their usage is as follows.
iptables -R 3 INPUT -s 222.333.444 -j REJECT
With the delete flag you can simply provide the rule number you want to delete or you can write out the rule in full. *Note tracking down the rule number and removing it that way is easier then writing out the full rule because it will have to match exactly what is in the fire wall. To determine what rule number you are wanting to remove you can use -L to list all rules in the chain, you will follow it with either INPUT, OUTPUT, FORWARD.
iptable -L INPUT -v –line-numbers
Then use iptables to remove the rule.
iptables -D 4
Maybe for security reasons you would like your server to not communicate with other servers on common ports, one which can be commonly abused the SMTP.
iptables -A OUTPUT –dport 25 -j DROP
You can also keep your server from trying to communicate to a specific address using -d, or –destination
iptables -A OUTPUT -d 111.222.333.444 -j DROP
The following is a recap of the flags that we used and their usage.
-I NUM, inserts a rule into the chain at a provided rule number or at the top of the chain if no number is provided.
-A, appends a rule to the end of a given chain.
-D NUM, will deleted the rule at the given chain number.
-F CHAIN, will flush the given chain (INPUT,OUTPUT,FORWARD)
-s, is the source ip, or the ip that is trying to communicate with the server.
-d, is the destination ip address
–destination-port/–dport NUM, is the destination port which is being communicated to.
I hope this article is useful in some way to you, in the oncoming month we will be writing an article which covers more advanced usage and rules.
