13,420
edits
Changes
no edit summary
# Were there already iptables policy rules that already existed by default?
# Issue the following command to reset the iptables policy rules: <b><code><span style="pointer-events: none;cursor: default;color:#3366CC;font-size:1.2em;">iptables -F</span></code></b>.
# Issue a the '''iptables -L''' command to list verify that the existing iptables policy rules to verify they have been reset.
==== Setting Default Policy and Policy Exceptions with iptables ====
Usually when setting policy rules with iptables, a general "overall" policy is set (default policy chain), and then set policy rules in other chains which act as exceptions to the default policy. Usually, a general policy would apply to ALL types of packets (tcp, udp, icmp) and all communication port numbers (80, 22, etc). The option <b><code><span style="pointer-events: none;cursor: default;color:#3366CC;font-size:1.5em;">-P</span></code></b> is used with the iptables command to set a default policy chain.
'''Examples:'''
'''Perform the following steps:'''
# Remain in your '''c7host''' VM for this section.
# Set the default policy for the INPUT chain to DROP by issuing the command:<br><b><code><span style="color:#3366CC;font-size:1.2em;">iptables -P INPUT DROP</span></code></b>
# Now try on your own to change the default policies for the OUTPUT chain to DROP
#In the OUTPUT chain, add the following rule:<br><b><code><span style="color:#3366CC;font-size:1.2em;">iptables -A OUTPUT -j LOG</span></code></b>. The above rule tells '''iptables''' to log packets and relevant information to '''/var/log/messages'''.
#Try to access the Internet again. Because the policies have been set to DROP, you should be unsuccessful. However, every packet of data that your PC attempted to send out was logged.
# Let's have a look at the log file and analyze the data: <b><code><span style="font-family:courier;color:#3366CC;font-size:1.2em;">tail /var/log/messages</span></code></b><br><br>
::This command shows us the last 10 lines of the file. While there are many things being logged to this file, the last thing we did was try to access the Internet so we should be able to see the data we need. Look for a line that looks similar to the following:<br><code>Jun 24 12:41:26 c7host kernel: IN= OUT=lo SRC=127.0.0.1 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=16442 DF PROTO=TCP SPT=57151 DPT=5902 WINDOW=1024 RES=0x00 ACK URGP=0</code><br><br>Your IP, host names and date will be different, but the one thing that should be the same is the DPT=80 value. When your computer tried to send OUT a request to connect to the Internet using the WWW, the computer used a destination port of 80. This is the standard port for the WWW. Because we have set the default policy to DROP it drops these packets. The problem is we are dropping all packets. What if we just want to drop the WWW packets?<br><br>
<ol>
