OPS335 Firewall Lab

IPTABLES and Firewalld

In this lab you will learn how to use iptables and firewalld to build and test a simple Linux firewall on your servers.

You're supposed to find and use documentation to learn how to complete these tasks, and of course you can ask your prof or lab assistant for help. Some introductory commands are provided to help you get started but the important part is that you learn this yourself. Learning how to find relevant documentation and understand it is just as important as the exact commands you'll finally use.

Instructions

Prior to beginning this lab verify network connectivity between your host and your VMs.

• Boot up your host.
• Login with your LearnID.
• Find out the MAC address of the virtual network device virbr0 and the IP address assigned to it. Record this information on your lab log book.
• Start your VMs.
• On the VMs
  • Login with your LearnID to your VM and use "su -" to become root.
  • Find out the MAC address of the NIC (usually eth0 or ens3) and the IP address assigned to it. Record this information on your lab log book.

• On your Host
  • Open a terminal window and perform the following connectivity tests to each vm:
    • ping -c 2 [ip-of-vm]
    • ssh [LearnID]@[ip-of-vm]

• On both systems (Host and VMs)
  • Run the command "ip neighbour show", extract relevant information from the outputs and record them on your lab log book. Indicate clearly the system on which the information was obtained.
  • For a brief summary of the output format view the online documentation

• You will now modify the firewall on your host to be more secure. As several rules are automatically added for you because of the virtual network, the next portion of the lab is will be done with your virtual network shut off.
• Shutdown your VMs
• Stop the libvirtd service on the host
• Restart the iptables service on the host

IPTABLES

Iptables is a relatively simple technology but the syntax is a little verbose and it takes a bit of time to figure out how to create a whole set of rules that works properly. Here's a process you can follow to get this part of the lab done:

• Start with the default settings. When you install Iptables in CentOS it already has some rules predefined. The instructions below assume you have those default rules.
• Add one rule at a time using the appropriate iptables command (which you'll figure out yourself). Then check to make sure your command worked using:
  • iptables -L or iptables -L -n if you'd like to see numeric port numbers.
  • If possible - test it with an application (e.g. if SSH access is disabled/enabled - test with ssh).
• Save your rule in a bash script (.sh file) so you don't lose it and can rerun it easily.
• If your command didn't work - the easiest thing to do is:
  • Reload the default rules. You can do that by restarting the iptables service.
  • Then run your script with all the working iptables commands that you already finished.
  • Go back to writing the rule that didn't work.

Some documentation to get started with (you'll need to find more):

• Overview section on Wikipedia is a good (short) overview of the system. You don't need to understand that diagram though.
• CentOS Wiki has some basic commands, you won't need to use all of them for the work below.

Your tasks

On your Host build a custom firewall by performing the following steps:

1. Remove the rules in your input chain that are allowing all icmp and ssh traffic.
2. Add a rule to the INPUT chain of the filter table to allow all UDP traffic coming from port 53. i.e. source port is 53.
3. Change the default policy on the INPUT and FORWARD chains in the filter table to DROP.
4. Remove the rules from the INPUT and FORWARD chains that are rejecting all traffic (we are now better protected by the default policy).
5. Create a new chain named MYSSH in the filter table.
6. Add a rule to the beginning of the INPUT chain of your filter table that sends all ssh traffic (tcp packets with destination port 22) to your MYSSH chain.
7. Add a rule to your MYSSH chain to accpept all traffic on your virbr0 interface from 192.168.X.0/24 (i.e. your internal network).
8. Add rules to the end of the MYSSH chain to drops all remaining ssh connections, but to log these denied packets with log level 'info' and log prefix "DENIED BY MYSSH" before doing so.
9. Make a new chain named MYICMP in the filter table.
10. Add a rule to the beginning of the INPUT chain of the filter table to send ICMP ping packets to your MYICMP chain.
11. find a partner and get the ipaddress and MAC address of their external facing interface.
12. Add a rule to your MYICMP chain that allows ICMP packets coming in on your virbr0 interface from 192.168.X.0/24 (i.e. your internal network).
13. Add a rule to your MYICMP chain that denies ICMP pings originating with MAC address of your partner's machine.
14. Add a rule to your MYICMP chain that denies ICMP pings originating with ip address of your partner's machine.

• Save your rules and list them.
• start the libvirtd service.
  • Note how this adds a number of rules to your tables. In the future, if you save your iptables rules with these rules in your tables, you will notice them start to duplicate.

Building a Firewall With Firewalld on VMs

On your VMs we will build a firewall using the newer standard firewalld.

• Start VM1, become root, and make the following changes:
• Move your active interface into the zone 'work'.
• Remove all services except ssh from the work zone (effectively blocking all incoming traffic except ssh).
• Use the firewall-cmd rich rules to make the following changes:
  • Block all ssh attempts from your host's ip address, adding a log entry with the message 'DENIED BY MYSSH' every time it attempts to connect.
  • Block all pings expect for those that come from your internal network.
• Make sure your changes are permanent.
• Repeat these changes on your other VMs.

Testing your custom firewall

• On your host use nmap to scan your firewall on your VMs and observe the output.
  • If you don't have nmap on your host then install it. Install it on your VMs as well.
• Use ping and ssh between your host and VMs to verify your firewall is working properly. Be sure to check the log file on the host for your unsuccessful ssh attempts.
• Save your firewall rules.
• Turn the firewall on your VM off, then try scanning again. Note how the output is different.
  • Make sure you turn the firewall back on when you are done.
• Double check that the all VMs can still ping and SSH each other.

Completing the Lab

Upon completion of this lab each of your machines has a firewall protecting them from unexpected traffic. Reboot your machines and ensure that this protection remains in place after they are shut down. You will be building on these rules for the rest of the course.

You should now have a basic understanding of the commands necessary to modify firewalls using iptables and firewalld. Scan each of your machines with nmap. Observe how the results differ depending on which machine you scanned from.

Record the URLs of the websites you've used to figure out how to do the work.

Exploration questions

1. View your firewall rules using the output of the 'iptables -L -n -v' command. Also save the output to a text file.
2. How could you display the log records generated by your invalid ssh attempts without including any unrelated entries.
3. What iptables rule would you need to add to your firewall to allow a maximum of 3 concurrent ssh connections from your host to your VM1?
4. Which rule in the MYICMP chain is actually responsible for denying icmp packets from your partner? Why?
5. Which optional module could be used to work with packets based on whether they are new connections or not?

Time for a new backup!
Once have successfully completed this lab, make a new backup of your virtual machines.