Nasohi Ciptandani

As we may know that iptables is temporary command, it will be lost when rebooting so to manage the firewall rules on iptables we can use netfilter-persistent,  it can be used to add, edit and remove rules on files,  save,  and flush. This is the example video about managing the iptables rules, you can try by yourself with any rules you want on server, client or router.

Iptables Firewall Stateless vs Statefull on Router Task: Create the firewall rule for IP 1.1.1.1 can access ssh server on 2.2.2.2 2 ways: 1. Stateless #iptables -P FORWARD DROP #iptables -A FORWARD -p tcp --dport 22 -s 1.1.1.1 -d 2.2.2.2 -j ACCEPT #iptables -A FORWARD -p tcp --sport 22 -s 2.2.2.2 -d 1.1.1.1 -j ACCEPT or 2. Statefull (recommended) #iptables -P FORWARD DROP #iptables -A FORWARD -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT #iptables -A FORWARD -p tcp --dport 22 -s 1.1.1.1 -d 2.2.2.2 -j ACCEPT

set the default policy to DROP #iptables -P INPUT DROP #iptables -P OUTPUT ACCEPT #iptables -P FORWARD DROP  accept anything on localhost #iptables -A INPUT -i lo -j ACCEPT #iptables -A OUTPUT -o lo -j ACCEPT  allow traffic once a connection has been made #iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT  accept anything on ssh port #iptables -A INPUT -p tcp --dport 22 -j ACCEPT  accept anything on http and https port #iptables -A INPUT -p tcp --dport 80 -j ACCEPT #iptables -A INPUT -p tcp --dport 443 -j ACCEPT  to save #apt-get install iptables-persistent

Work task: Make sure that firewall operates in stateful mode using iptables Workaround: iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT Letakkan rule dibagian paling atas, karena iptables akan membaca rule secara berurutan, setelah rule-rule iptables diatas, selanjutnya tinggal allow service-service yang ingin digunakan, misalnya: # Allow remote ssh and http access iptables -A INPUT -p tcp --dport 22 -j ACCEPT # ssh iptables -A INPUT -p tcp --dport 80 -j ACCEPT # http # Allow DNS lookups to be initiated from this server iptables -A OUTPUT -p udp --dport 53 -j ACCEPT # dns iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT # dns

Contoh konfigurasi iptables untuk DMZ # set the default policy to DROP iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # to configure the system as a router, enable ip forwarding by sysctl -w net.ipv4.ip_forward=1 # allow traffic from internal (eth0) to DMZ (eth2) iptables -t filter -A FORWARD -i eth0 -o eth2 -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -t filter -A FORWARD -i eth2 -o eth0 -m state –state ESTABLISHED,RELATED -j ACCEPT # allow traffic from internet (eth1) to DMZ (eth2) iptables -t filter -A FORWARD -i eth1 -o eth2 -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -t filter -A FORWARD -i eth2 -o eth1 -m state –state ESTABLISHED,RELATED -j ACCEPT #redirect incoming web requests at eth1 (200.0.0.1) of FIREWALL to web server at 192.168.20.2 iptables -t nat -A PREROUTING -p tcp -i eth1 -d 200.0.0.1 –dport 80 -j DNAT –to-dest 192.168.20.2  iptables -t nat -A PREROUTING -p tcp -i eth1 -d 200.0.0.1 –dport 44...

Dengan ini tidak perlu menghapus semua rule yang sudah dibuat, cukup lihat baris keberapa dan hapus. Cara memeriksa ada rule iptables dengan option --line-numbers gunakan perintah berikut: iptables -L -n --line-numbers   iptables -t nat -L -n --line-numbers Jika perlu menghapus salah satu rule iptables, perlu mengetahui 2 hal. Nama chain ditetapkan, dan nomor baris nya. Selanjutnya tinggal dilihat nomor rule yang ingin dihapus. Untuk menghapus jalankan perintah ini iptables -D INPUT 1 Contoh diatas akan menghapus rule 1 dari chain INPUT.

Konfigurasi Linux agar berfungsi sebagai router. sysctl -w net.ipv4.ip_foraward = 1 Mengkonfigurasi IPTables iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 80 -m state --state NEW -m statistic --mode nth --every 2 --packet 0 -j DNAT --to-destination 192.168.2.2:80 iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 80 -m state --state NEW -m statistic --mode nth --every 2 --packet 1 -j DNAT --to-destination 192.168.2.3:80 Jangan lupa konfigurasi di chain FORWARD jika default chain FORWARD nya drop. Referensi: https://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO-3.html