OPS335 Firewall Lab

IPTABLES and Firewalld

In this lab you will learn how to use iptables to build and test a simple Linux firewall on your first Virtual Machine. You will also get an introduction to firewalld, a new service that manages some firewall configuration for you.

Instructions

Prior to beginning this lab verifying network connectivity between your host and your VM 1.

• Boot up your host.
• Login with your LearnID.
• Find out the MAC address of the virtual network device virbr0 and the IP address assigned to it. Record this information on your lab log book.
• Start your 1st VM.
• On the VM
  • Login with your LearnID to your VM and use "su -" to become root.
  • Find out the MAC address of the NIC (eth0) and the IP address assigned to it. Record this information on your lab log book.
  • Disable your current firewall (firewalld), and enable the iptables firewall.

systemctl disable firewalld
systemctl enable iptables

• • Reboot the VM, and check to make sure that iptables is running and firewalld is not.
  • Flushing all rules in all chains in all tables and set up default policy for the INPUT, FORWARD, and OUTPUT chains to ACCEPT.

• On your Fedora Host
  • Open a terminal window and perform the following connectivity tests:
    • ping -c 2 [ip-of-vm1]
    • ssh [LearnID]@[ip-of-vm1]

• On both system (Fedora Host and VM1)
  • Run the command "ip neighbour show", extract relevant information from the outputs and record them on your lab log book. Indicate clearly the system on which the information was obtained.
  • For a brief summary of the output format view the online documentation

Building a Simple Firewall on VM1

On your VM1 build a custom firewall by performing the following steps:

1. Add appropriate rule(s) to allow all traffic to/from the loopback 'lo' interface.
2. Add a rule to the INPUT chain of the filter table to allow all UDP traffic coming from port 53. i.e. source port is 53.
3. Add a rule to the INPUT chain of the filter table to allow all ESTABLISHED and RELATED incoming connections.
4. Create a new chain named MYSSH in the filter table.
5. Add a rule to the INPUT chain of your filter table that sends all tcp packets with destination port 22 to your MYSSH chain.
6. Add a rule to your MYSSH chain to deny all traffic from 192.168.X.1 (i.e. your host). Also log these denied packets with log level 'info' and log prefix "DENIED BY MYSSH".
7. Add a rule to the end of the INPUT chain of the filter table that allows all new tcp ssh connections.
8. Make a new chain named MYICMP in the filter table.
9. Add a rule to the INPUT chain of the filter table to send ICMP ping packets to your MYICMP chain.
10. Add a rule to your MYICMP chain that denies ICMP pings from 192.168.X.1 (your host).
11. Add a rule to your MYICMP chain that denies ICMP pings originating with MAC address of the host's virbr0.
12. Add a rule to the end of your INPUT chain that allows ICMP pings from anywhere.
13. Change the default policy on the INPUT and FORWARD chains in the filter table to DROP.

Testing your custom firewall

1. On your host use nmap to scan your firewall on your VM. If you don't have nmap on your host then install it. Save the output of the nmap scan to a text file.
2. Use ping and ssh from your host (192.168.x.1) to verify your firewall is working properly. Be sure to check the log file on the VM for your unsuccessful ssh attempts.
3. Save your firewall rules.

Building a Firewall With Firewalld on VM3

On your VM 3 we will build a firewall using the newer standard firewalld.

• Move your eth0 interface into the zone 'work'.
• Remove all services except ssh from the work zone (effectively blocking all incoming traffic except ssh).
• Use the firewallcmd rich rules to make the following changes (very similar to what you did on VM 1):
  • Log and block all ssh attempts from your host.
  • Block all pings from the host.
• Unlike iptables where you save your current state in bulk, firewalld requires you to save each change independently. Make sure your changes are permanent.

Building a Simple Firewall on your VM 2

1. Repeat the steps from 'Building a Simple Firewall on VM1' and 'Testing your custom firewall' on your VM 2.
2. Double check that the all VMs can still ping and SSH each other.

Completing the Lab

Upon completion of this lab each of your VMs has a firewall protecting them from unexpected traffic. Reboot your machines and ensure that this protection remains in place after they are shut down. You will be building on these rules for the rest of the course. You should now have a basic understanding of the commands necessary to modify firewalls using iptables and firewalld.

Scan each of your machines with nmap. Observe how the results are different depending on which machine you scanned from.

Answer the following questions

1. View your firewall rules using the output of the 'iptables -L -n -v' command. Also save the output to a text file.
2. How could you display the log records generated by your invalid ssh attempts without including any unrelated entries.
3. What iptables rule would you need to add to your firewall to allow a maximum of 3 concurrent ssh connections from your host to your VM1?
4. Which rule in the MYICMP chain is actually responsible for denying icmp packets from your Fedora host? Why?