13,420
edits
Changes
no edit summary
# Write the commands you executed in your lab book.
# Can we mix these policies? Try to set the FORWARD chain policy to ACCEPT. Did it work?
=== Testing policies ===
# Execute the command <b><code><span style="color:#3366CC;font-size:1.2em;">iptables -L</span></code></b> and check that the policies on your INPUT and OUTPUT chain are set to DROP
# Open a browser and attempt to access the Internet. Were you successful?
# Using the commands you have learned so far, change the policies on the INPUT and OUTPUT chains to ACCEPT
# Change the policies on all of the chains to DROP
# In the OUTPUT chain, add the following rule:
#* : <b><code><span style="color:#3366CC;font-size:1.2em;">iptables -A OUTPUT -j LOG</span></code></b># The above rule tells <code>'''iptables</code> ''' to log packets and relevant information to <code>'''/var/log/messages</code>'''.
# This entry in the OUTPUT policy will therefore log all packets being sent out of the machine.
# Try to access the Internet again. Because the policies have been set to DROP, you should be unsuccessful. However, every packet of data that your PC attempted to send out was logged. Let's have a look at the log file and analyze the data.
#* : <b><code><span style="color:#3366CC;font-size:1.2em;">tail /var/log/messages</span></code></b>
# This command shows us the last 10 lines of the file. While there are many things being logged to this file, the last thing we did was try to access the Internet so we should be able to see the data we need. Look for a line that looks similar to the following:<br /><br /><blockquote><code>Mar 3 09:21:03 koala-laptop kernel: [90775.407304] IN= OUT=wlan0 SRC=192.168.1.107 DST=66.249.90.104 LEN=1470 TOS=0x00 PREC=0x00 TTL=64 ID=19752 DF PROTO=TCP SPT=45431 DPT=80 WINDOW=108 RES=0x00 ACK PSH URGP=0</code></blockquote>
# Your IP, host names and date will be different, but the one thing that should be the same is the DPT=80 value.
