OPS335 Lab 2 draft

PACKET FILTERING USING IPTABLES

OVERVIEW & PREPARATION

In this lab, you will learn how to use iptables to build a simple Linux firewall on your servers.

iptables is a very complex topic. Fortunately, you are not required to become an "iptables expert", but by the end of the course, you should be able to use iptables to properly secure your servers.

You were exposed to iptables in your OPS235 course. You should refer to those notes or find and use documentation to learn how to complete these tasks. You can also ask your professor or lab assistant during the lab for help when using iptables. Some basic iptables commands are provided in this lab for reference, but it is also essential that you know how to obtain help (man pages and online) in order to become self-reliant.

firewalld
In this lab we will be using iptables, not firewalld. Although both can be used at the same time, that would be too advantaged that this point of learning Linux network administration.

In the first labs, Prep for labs, you should have disabled and stopped the firewalld service: Prep for Labs.

You can also check the status of the firewalld service by issuing the systemctl command. You can also check if the firewalld service is running by issuing iptables -L and noting a high volume of unexpected output (i.e. "a strange result").

iptables Resources

Some documentation to get started with (you'll need to find more):

• Week 3 Notes Recommended to review and understand prior to performing this lab.
• Overview A excellent concise overview of iptables (ignore diagram).
• CentOS Wiki Listing of basic commands (not all required to know).

How Firewalls (iptables) Relate to the Labs in this Course

We will use an example of setting up a firewall to secure a web server. You will be installing, configuring, protecting, and maintaining a web-server of one of your VMs in a later lab.

The diagram displayed below shows how iptables can be used with a web-server:

There are some important things to be aware of in terms of this diagram:

• There are two sets of IPtables rules (chains) that apply: OUTPUT/INPUT on the client and INPUT/OUTPUT on the server.
  It is important to think about from the perspective from the client as well as the server.

• Outbound traffic from a server (in our case the web-server) is rarely blocked unless there is a security policy to prevent some kind of traffic.
  Even in that case, that security policy is usually performed on a router (this is a topic which will be discussed later in this course).

• Inbound traffic is of two distinct types. Our diagram shows:

1. New incoming connections (what you normally think of as inbound traffic): the web server receives a new incoming connection.
2. Incoming data that's a response to a request: the web page that the server sent back in the diagram above.

We normally don't want to do anything special for the response. It is safe to assume that a connection that was allowed to be established should be allowed to receive a response. This is accomplished with the following INPUT chain rule that should be there by default on your machines:

ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

• Rules are applied to: chains (e.g. input/output), protocols (e.g. tcp/udp/icmp), and ports (e.g. 22, 80, 443).

1. For the request, the source port (sport) is 40112 and the destination port (dport) is 80
2. For the response, the source port is 80 and the destination port is 40112
3. Since the RELATED,ESTABLISHED rule already exists, we are only concerned about controlling the incoming traffic on the server, which in our example, the chain is: INPUT, the protocol is: tcp, and the destination is: port 80.

• Basically all other services that you learn to install, configure, and maintain will required the same knowledge just discussed.

Critical iptables Elements

This may seem like another task to perform, but it is an essential task! You need to "become one" with basic iptables and focus on these important elements on this section, since you will be troubleshooting MANY connection issues with MANY VMs for labs and assignments! You need to become comfortable when using iptables to not only set policy, but troubleshoot and fix mistakes when you set your firewall policies!

... the more you practice and get comfortable with iptables, the quicker you will be able to isolate and fix connection issues...

We don't expect you to become firewall experts, but there are some basics you need to become familiar for this and future labs:

• What is a chain?
• Which chain applies to which traffic?
• What's the default action for a chain and when that applies?
• What order the rules are executed in?
• Reading and/or creating a rule for a specific service. That includes a basic understanding of:
  • Ports
  • Protocols
  • The best way to learn that is to practice.

Record steps, commands, and your observations from this section in your OPS335 lab log-book

INVESTIGATION 1: PREPARATION & GETTING TO KNOW IPTABLES COMMANDS

Confirming Existing Network Connections

Before proceeding with iptables, we should first verify that your host machine and vms can connect with one another. We can also take the opportunity to record some observations which could be used for future labs.

Perform the Following Steps:

1. Find the MAC address of the virtual network device on the host and the IP address assigned to it. Record this information in your lab log book.
2. Launch all three of your VMs.
3. For each VM:
   • Login as root.
   • Find the MAC address of the virtual NIC and the IP address assigned to it. Record this information on your lab log book.
4. Change to your host machine, open a terminal window, and perform the following connectivity tests for each vm:
   
   

ping -c 1 [ip-of-vm]
ssh [ip-of-vm]

Confirm Default vs Updated Firewall Rules for VMs

You should have learned in OPS235 how to view existing iptables rules with the command: iptables -L. Although you may assume that this listing of rules should be empty, they may not be! There might be default rules that already exist, or that exist when the firewall is reset to default (i.e. iptables -F).

In fact, several rules were automatically added to your chains because you are using a virtual network. As an exercise, we will determine which of those rules when running a virtual network were added.

Perform the Following Steps:

1. Run iptables -L but redirect the output to a text file called before.txt (you will be using this file later).
2. Shutdown all of your VMs.
3. Stop the libvirtd service
4. Restart the iptables service
5. Re-issue iptables -L commands making certain to redirect output to a second file (after.txt). This should provide a listing of the new state of your firewall settings.
6. You now should have two text files representing the before and after states of your firewall. Compare differences between these two files using the diff command (You should have used this tool in ULI101).
7. Run diff -u before.txt after.txt and figure out how to read the output.
   
   TIP: You can also install a graphical tool that makes it much easier to see differences: kompare before.txt after.txt
   
   
8. You can use these tools to compare any two text files, they often come in handy. Note in your lab logbook the iptables rules that were added automatically by the libvirtd service.

Simple Rule Changes

We'll run some commands to practice and get a basic understanding of how the rules work.

1. Disable all inbound traffic...
2. Delete the default ssh rule
3. Insert the SSH rule in the beginning, delete it
4. Append the SSH rule to the end, delete it
5. Delete related,established rule, try to do anything
6. Restore defaults

Record steps, commands, and your observations in INVESTIGATION 1 in your OPS335 lab log-book

Your tasks

• Start with the default settings. When you install Iptables in CentOS it already has some rules predefined. You will get the default rules if you restart the iptables service.
• Save your rule in a bash script (.sh file) so you don't lose it and can rerun it easily.

Disconnected from VMs
Some of the traffic between your host and VirtManager goes through IPtables. When you mess with IPtables rules on the host - you may end up losing the console connection to the virtual machines. Don't worry, they're still running and you can still use them.

• If your command didn't work - the easiest thing to do is:
  • Reload the default rules. You can do that by restarting the iptables service (you can also do that at the beginning of your shell script).
  • Then run your script with all the working iptables commands that you already finished.
  • Go back to writing the rule that didn't work.

Perform the following steps:

1. Remove the rules in your INPUT chain that are allowing all icmp and ssh traffic.
2. Change the default policy on the INPUT and FORWARD chains in the filter table to DROP.
3. Remove the rules from the INPUT and FORWARD chains that are rejecting all traffic (we are now better protected by the default policy).
4. Create a new chain named MYSSH in the filter table.
5. Add a rule to the beginning of the INPUT chain of your filter table that sends all ssh traffic (tcp packets with destination port 22) to your MYSSH chain.
   • Use --jump not --goto for that.
6. Add a rule to your MYSSH chain to accpept all traffic on your virtual interface from 192.168.X.0/24 (i.e. your internal network).
7. Add rules to the end of the MYSSH chain to drop all remaining ssh connections, but to log these denied packets with log level 'info' and log prefix "DENIED BY MYSSH" before doing so.
8. Make a new chain named MYICMP.
9. Add a rule to the beginning of the INPUT chain to send ICMP ping packets to your MYICMP chain.
10. Find a partner and get the ipaddress and MAC address of their external facing interface. If you don't have a partner - use a virtual machine.
11. Add a rule to your MYICMP chain that allows ICMP packets coming in on your virtual interface from 192.168.X.0/24 (i.e. your internal network).
12. Add a rule to your MYICMP chain that denies ICMP pings originating with MAC address of your partner's machine.
13. Add a rule to your MYICMP chain that denies ICMP pings originating with IP address of your partner's machine.

Once you're happy with how your firewall works - make a backup of the original default rules:

cp /etc/sysconfig/iptables /etc/sysconfig/iptables.original

And then overwrite the defaults with the current state of the firewall:

/usr/libexec/iptables/iptables.init save

Record steps, commands, and your observations in INVESTIGATION 2 in your OPS335 lab log-book

Completing the Lab

Upon completion of this lab each of your machines has a firewall protecting them from unexpected traffic. You should now have a basic understanding of the commands necessary to modify firewalls using iptables. You will be building on these rules for the rest of the course.

Record the URLs of the websites you've used to figure out how to do the work.

Exploration questions

1. View your firewall rules using the output of the 'iptables -L -n -v' command. Also save the output to a text file.
2. How could you display the log records generated by your invalid ssh attempts without including any unrelated entries.
3. What iptables rule would you need to add to your firewall to allow a maximum of 3 concurrent ssh connections from your host to your VM1?
4. Which rule in the MYICMP chain is actually responsible for denying icmp packets from your partner? Why?
5. Which optional module could be used to work with packets based on whether they are new connections or not?

Time for a new backup!
Once have successfully completed this lab, make a new backup of your virtual machines.