Firewalls

In this tutorial we are going to work on the firewall configuration of your machine. Some care must be taken when doing this, or you will suddenly find you can no longer log in!

In all these cases the easiest way to do the experiment is to CREATE an executable program in /root called "firewall". You should make the contents of this something like:

#!/bin/bash
#
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
#
# Delete redhat default firewall chains
#
iptables -F RH-Firewall-1-INPUT 2> /dev/null
iptables -X RH-Firewall-1-INPUT 2> /dev/null
#
# For your own safety, stop users logging in from other VMs
#
iptables -A INPUT -i eth0 -p tcp --dport ssh -s 10.0.0.0/16 -j DROP
iptables -A INPUT -i eth0 -p tcp --dport telnet -s 10.0.0.0/16 -j DROP
#
# Your changes go after here.
#

To execute this file, remember "chmod +x ./filewall" and then just "./firewall" or "/root/firewall" to run it. Execute it once and they press the check button to make sure everything is set up ok.

After executing this file you can use "iptables -L" to show you what rules have been stored in the kernel. The provided rule uses a default policy of ACCEPT. Later on we look at the default policy of DROP.

Visit the firewall test page, which can be found as a link off the VM Management page, and run a test on 22,23,25, and 80. All will either be "open" (service there and no firewall) or "closed" (no service there and no firewall).

Add to the end of your /root/firewall script a rule which, when an http packet (tcp) comes in from eth0, jumps to DROP. Execute the script to activate this change.

Validate this with the firewall test (which should now say "filtered").

Add to the end of your /root/firewall script, while keeping the port 80 rule you created in the last question, a new rule which when a tcp packet which has a source address of 20.0.0.0/24 comes in from eth0, jumps to DROP. Execute the script to activate this change.

Make the default policy of the FORWARD chain DROP. Leave the other chains as ACCEPT.

Accept PING at a limit of 1 per second from any interface. This is tricky, as your default for the INPUT chain is ACCEPT. Attempt this question in two stages... first accept the PING if the rate is acceptable, and then have a check which jumps to DROP if it is a PING. The drop will always be done if reached and the packet is a PING, but it will not be reached if the first rule accepts it.

Double check that this is working using the ping option of the firewall tests. You should see "limited,1/second" if you have done this correctly.

Continue on from the previous set of rules. Add in one more rule so that if you receive pings faster than 1 per second, those pings will be logged. Note that things getting logged will appear at the end of /var/log/messages. Do not use a new chain to do this, and keep the rule as simple as possible.

Using the firewall tests, run a ping test and then look at the log information created in /var/log/messages. With this information, what is the ip of the source of all these ping requests?

Enter the ping ip source:

In this tutorial we are going to work on a strict firewall configuration of your machine. Extra-special care must be taken when doing this, or you will suddenly find you can no longer log in!

Create the following as a script called firewall2 in /root.

#!/bin/bash
#
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
#
iptables -F RH-Firewall-1-INPUT 2> /dev/null
iptables -X RH-Firewall-1-INPUT 2> /dev/null
#
# Make sure ssh and telnet stay working, and that users on
# other VMs cannot log in.
#
# --- Put a rule here if you want to be inserting at the start of INPUT
#
iptables -A INPUT -i eth0 -p tcp --dport ssh -s ! 10.0.0.0/16 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport telnet -s ! 10.0.0.0/16 -j ACCEPT
#
# Sockets, once connected, continue to work
#
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#

Your ssh and telnet connections are proxied from 10.200.0.1. Thus when you telnet or ssh into linuxzoo, a special program catches this traffic and forwards it on your behalf. This makes ssh and telnet traffic appear to arrive at your virtual machine from a single networked address, the proxy address of 10.200.0.1.

Insert a single rule using this script, inserting at the start of the INPUT chain so that ssh is ONLY supported from 10.200.0.1 arriving on eth0. Leave the other rules shown above unchanged. If ssh connections arrive from anywhere else, they should be directed to REJECT.

Note that if you change one of the other rules, insert more than 1 rule, or do anything other than insert a single rule at the start of the chain, you will always be marked wrong!

Hint: you can put the "!" character in front of an ip address and the rule checks that it is NOT that address.