Network Security

IPtables

IPtables work on kernel layers. It is use to filter the network. Also use for NAT. it is configure on port and protocols, IP address and on the interface.

Kernel layer= transport( port protocol)+ network(IP address)+ Data link(interface)

IP Tables Type

                 1) Filter

                 2) NAT

                 3) Mangle.

Filter

Filter is use for allow and deny the packet.

NAT

Redirect and changing the IP address.

NAT havr two type

Prerouting

To redirect the packet before come is called prerouting.

Post routing

To redirect the packet after packet come and use packet or provide the other PC IP or hide the own IP address is called post routing.

Mangle

Change the Packet type.

Syntex:-

#iptables  -t filter (NAT mangle)  –I INPUT (OUTPUT FORWARD PREROUTING             POSTROUTING)  –p tcp (UDP)  –s (Source IP) –d (Destination IP)  –sport (Source Port) –d                ( Destination Port) –I (Interface) –to-source ( IP Address) –to-dest (IP Address) –o (Output Interface) –j ACCEPT ( REJECT DROP SNAT DNAT )

Implement of IPtables

                                 #service iptables restart 

                                 #iptables –F (flush the defaults rule)

                                 #service iptables save ( to save the rule)

                                 #iptables –L –n –v (to check the rules enable (list))

                                 #iptables –L –v –n –line-number

                                 #iptables –L output –v –n (list bye chain type)

                                 #iptables –nvL

                                 #system-config-securitylevel (graphical setting)

                                 #iptables –d OUTPUT ( to delete rules)

Configuration file

                                 #/etc/sysconfig/iptables

Some example of IPtables

 1)      Our sshd server is access by only our network

#iptables –t filter –I INPUT –p tcp –s ! 172.17.1.0/255.255.0.0 –d 172.17.1.1 –dport 22 –j REJECT

2)      We can connect only orkut.com at HTTP request

#iptables –t filter –I OUTPUT –p tcp –s 172.17.1.1 –d! orkut.com –dport 80 –j REJECT

3)      Our network connect to only jabong.com  from our getway server

#iptables –t filter –I FORWARD –s! 172.17.1.0/255.255.0.0 –j REJECT

#iptables –t filter –I FORWARD –s 172.17.1.0/255.255.0.0 –d! jabong.com –j REJECT

4)      If any client/packet come from redhat.com its redirect to jabong.com

#iptables –t NAT –I PREROUTING –p tcp –s redhat.com d 172.17.1.1 –j DNAT –to-dst jabong.com

5)      If anyone connect to our jabong.com server IP shown different 172.17.1.1

 #iptables –t NAT –I POSTROUTING –p tcp –s 172.17.1.10 –d jabong.com –j SNAT –to-source 172.17.1.1

6)      To block all service

# iptables –I INPUT –p tcp –j REJECT

7)      To block all output

#iptables –I OUTPUT –p tcp –j REJECT

8)      To block perticular service to all machine.

#iptables –I INPUT –p tcp –dport 22 –j REJECT

9)      To block service for a machine or network

#iptables –I INPUT –p tcp –dport 22 –s 172.17.1.1 (172.17.1.0/255.255.0.0) –j REJECT

10)  To reject multiple port

#iptables –I INPUT –p tcp –m multiport –dport 22,23,80 –s 172.17.1.0/255.255.0.0 –j REJECT

11)  Apply security according to MAC address

#iptables –I INPUT –m –mac-source (give here MAC) –j reject

12)  To stop ICMP request

#iptables –I INPUT –p icmp –s 172.17.1.1 –j DROP

To create manuly chain

                       #iptables –N rhce

Insert rule in chain

                       #iptables –I INPUT 1 –j rhce

                       1 is here chain number

                       #iptables –A rhce –p tcp –dport 23 –s 172.17.1.1 –j ACCEPT

                       #iptables –x chain name ( to remove chain)

Backup of iptables

                       #iptables-save >  /root/Desktop/kausahal

                       #iptables-restore < /root/Desktop/kaushal