Linux/ Networking / Security Nipunulu Itu Randi

[ICANWIN]

nenu oka java/j2ee dev ni ..linux nipunulu dayachesi iptables use chesi firewall ala install cheyalo kasta cheppandi..asalu avento kuda idea ledu but google cheyaga iptables anedi oka tool ani danito firewall install cheyachani linux systems mida ardham ayyindi kasta alano cheppi punyam kattukondi.EOD kalla adi chesi customer issue test chesi close cheyali andi..dayachesi help....thanks in advance

version of linux to installation procedure marutunda

also iptables mana system lo already install ayyindo ledo ala telustundi

iptables -L cheste ivi vachayi ante emanattu?

Chain Input (Policy Accept)
target prot opt source destination

Chain Forward (Policy Accept)
target prot opt source destination

Chain Output (Policy Accept)
target prot opt source destination

[bokuboy]

I hurt on u

[ICANWIN]

[quote name='ChoclateBoy' timestamp='1370879900' post='1303841879']
I hurt on u
[/quote]


Why chocolate ? What I did Rey ?

[bokuboy]

[quote name='ICANWIN' timestamp='1370881184' post='1303841959']
Why chocolate ? What I did Rey ?
[/quote]

nenu quote chesina reflies iyyadam ledhu nuvvu...i hurt

[ICANWIN]

[quote name='ChoclateBoy' timestamp='1370881765' post='1303841999']


nenu quote chesina reflies iyyadam ledhu nuvvu...i hurt
[/quote]


I might have not seen tht Theead again ... Enduku ivanu Chuste dude ...

[maverick23]

@Thread starter

Baisc ga you dont install Firewall............Firewall ports open cheyadaniki network team ne contact cheyali......Once they open the ports......Mana linux system lo firewall rule add cheyali....If you do to .
/etc/sysconfig/iptables lo......for example...port 19443 ee vidangaa update cheyali

A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 19443 -j ACCEPT

But as you are java devloper....Sys admin and network folks should able to do it.....

[k2s]

[quote name='maverick23' timestamp='1370884262' post='1303842213']
@Thread starter

Baisc ga you dont install Firewall............Firewall ports open cheyadaniki network team ne contact cheyali......Once they open the ports......Mana linux system lo firewall rule add cheyali....If you do to .
/etc/sysconfig/iptables lo......for example...port 19443 ee vidangaa update cheyali

A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 19443 -j ACCEPT

But as you are java devloper....Sys admin and network folks should able to do it.....
[/quote]

[maverick23]

[quote name='Scrooge' timestamp='1370885982' post='1303842355']

[/quote]

Daani ardam enti?? Do you have any other suggestions?? Thanks

[k2s]

[quote name='maverick23' timestamp='1370886124' post='1303842381']

Daani ardam enti?? Do you have any other suggestions?? Thanks
[/quote]

[color=#282828][font=helvetica, arial, sans-serif][size=3][background=rgb(247, 247, 247)]A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 19443 -j ACCEPT.[/background][/size][/font][/color]
[color=#282828][font=helvetica, arial, sans-serif][size=3][background=rgb(247, 247, 247)]ikkada source address & destination ekkada pettav ani [/background][/size][/font][/color]

[maverick23]

The top one suggests accept all connections from all the servers to port that port....Only from particular server or particular subnet ayethe -s <ipaddress or subnet > mention cheyali beofre -j ACCEPT.... But thread starter idantha tanu cheyakarledu anukunta......He needs to start his application , so that the applictaion can listen on that port!!!

[k2s]

[quote name='maverick23' timestamp='1370886504' post='1303842425']
The top one suggests accept all connections from all the servers to port that port....Only from particular server or particular subnet ayethe -s <ipaddress or subnet > mention cheyali beofre -j ACCEPT.... But thread starter idantha tanu cheyakarledu anukunta......He needs to start his application , so that the applictaion can listen on that port!!!
[/quote]

[ICANWIN]

maverick thanks for post but system admin ledu tokka ledu nene Anni Cheyali ma architect Linux guru vachi Chala simple cheseyi Ani cheppi vellipoyadu.. Nenu java/j2ee Ani ikkada marchipoyi janalu Chala rojulayindi .. Oka vm ni clone chesukoni idi test chesukoni customer to webex Cheyali .. Social security client of a state client so emanna atu Itu ayite na pani out .. Ikkada install and configure Ani undi exactly ala follow ayite build cheyagalana?
Firewall with netfilter/iptables

netfilter and iptables are building blocks of a framework inside the Linux 2.4.x and 2.6.x kernel. This framework enables packet filtering, network address translation and other packet mangling. It is the re-designed and heavily improved successor of the previous Linux 2.2.x ipchains and Linux 2.0.x ipfwadm systems.

netfilter is a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack.

iptables is a generic table structure for the definition of rulesets. Each rule within an IP table consists of a number of classifiers (iptables matches) and one connected action (iptables target).

Main Features

stateless packet filtering (IPv4 and IPv6)
stateful packet filtering (IPv4)
all kinds of network address and port translation (NAT/NAPT)
flexible and extensible infrastructure
multiple layers of API's for 3rd party extensions
large number of plugins/modules kept in 'patch-o-matic' repository
What can I do with netfilter/iptables?

build internet firewalls based on stateless and stateful packet filtering
use NAT and masquerading for sharing internet access if you don't have enough public IP addresses
use NAT to implement transparent proxies
aid the tc and iproute2 systems used to build sophisticated QoS and policy routers
do further packet manipulation (mangling) like altering the TOS/DSCP/ECN bits of the IP header
An iptable tutortial can be found here.

Stateful Inspection and Connection Tracking

Stateful packet inspection uses the same fundamental packet screening technique that packet filtering does. In addition, it examines the packet header information from the network layer of the OSI model to the application layer to verify that the packet is part of a legitimate connection and the protocols are behaving as expected.



The stateful packet inspection process is accomplished in the following manner. As packets pass through the firewall, packet header information is examined and fed into a dynamic state table where it is stored. The packets are compared to pre-configured rules or filters and allow or deny decisions are made based on the results of the comparison. The data in the state table is then used to evaluate subsequent packets to verify that they are part of the same connection. In short, stateful packet inspection uses a two step process to determine whether or not packets will be allowed or denied. This method can make decisions based on one or more of the following:

Source IP address
Destination IP address
Protocol type (TCP/UDP)
Source port
Destination port
Connection state
The connection state is derived from information gathered in previous packets. It is an essential factor in making the decision for new communication attempts. Stateful packet inspection compares the packets against the rules or filters and then checks the dynamic state table to verify that the packets are part of a valid, established connection. By having the ability to "remember" the status of a connection, this method of packet screening is better equipped to guard against attacks than standard packet filtering.



Stateful packet inspection solutions offer sophisticated decision-making capabilities, yet they operate faster than other packet screening methods because they require little processing overhead. Allow and deny decisions are made at the lower levels of the OSI model.

Some newer stateful packet inspection firewalls maintain more advanced connection state information. Some are able to reassemble the packets as they pass through the firewall and perform additional processing such as content filtering.

Connection States

NEW

This packet is trying to create a new connection. Unless you're running a server you shouldn't allow these on the input side.

RELATED

This packet is related to the existing connection, and is passing in the original direction.

INVALID

his packet doesn't match any connection

ESTABLISHED

This packet is part of an existing connection
As a simple example, to forward across the firewall interfaces packets that are part of a pre-existing connection might look like this:

iptables -A FORWARD -m state -state ESTABLISHED,RELATED -j ACCEPT

Installation and Configuration

Download iptables from netfilter.org, on GENTOO use

emerge iptables


Prepare the Kernel

cd /usr/src/linux
make menuconfig
(Enable Network packet filtering in Networking options)

Download Firewall Builder from fwbuilder.org

With this tool, you can build the basic iptables rules. Here are our basic rules.

#!/bin/sh

# Akadia AG, Fichtenweg 10, 3672 Oberdiessbach
# --------------------------------------------------------------------------
# File: firewall.fw
#
# Autor: Martin Zahn, 28.07.2005
#
# Purpose: Configuration file IPTABLES Firewall
#
# Location: /home/zahn/iptables
#
# Load Rules: ./firewall.fw
# Save Rules: /etc/init.d/iptables save
#
# --------------------------------------------------------------------------
#
PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"
export PATH

log() {
echo "$1"
test -x "$LOGGER" && $LOGGER -p info "$1"
}

va_num=1
add_addr() {
addr=$1
nm=$2
dev=$3

type=""
aadd=""

L=`$IP -4 link ls $dev | head -n1`
if test -n "$L"; then
OIFS=$IFS
IFS=" /:,<"
set $L
type=$4
IFS=$OIFS

L=`$IP -4 addr ls $dev to $addr | grep inet | grep -v :`
if test -n "$L"; then
OIFS=$IFS
IFS=" /"
set $L
aadd=$2
IFS=$OIFS
fi
fi
if test -z "$aadd"; then
if test "$type" = "POINTOPOINT"; then
$IP -4 addr add $addr dev $dev scope global label $dev:FWB${va_num}
va_num=`expr $va_num + 1`
fi
if test "$type" = "BROADCAST"; then
$IP -4 addr add $addr/$nm dev $dev brd + scope global label $dev:FWB${va_num}
va_num=`expr $va_num + 1`
fi
fi
}

getInterfaceVarName() {
echo $1 | sed 's/\./_/'
}

getaddr() {
dev=$1
name=$2
L=`$IP -4 addr show dev $dev | grep inet | grep -v :`
test -z "$L" && {
eval "$name=''"
return
}
OIFS=$IFS
IFS=" /"
set $L
eval "$name=$2"
IFS=$OIFS
}

getinterfaces() {
NAME=$1
$IP link show | grep ": $NAME" | while read L; do
OIFS=$IFS
IFS=" :"
set $L
IFS=$OIFS
echo $2
done
}

LSMOD="lsmod"
MODPROBE="modprobe"
IPTABLES="iptables"
IPTABLES_RESTORE="iptables-restore"
IP="ip"
LOGGER="logger"

getaddr ppp0 i_ppp0

log 'Activating firewall script'

echo "Cleanup iptables Rules"
$IPTABLES -P OUTPUT DROP
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
# $IPTABLES -F
# $IPTABLES -X

cat /proc/net/ip_tables_names | while read table; do
test "X$table" = "Xmangle" && continue
$IPTABLES -t $table -L -n | while read c chain rest; do
if test "X$c" = "XChain" ; then
$IPTABLES -t $table -F $chain
fi
done
$IPTABLES -t $table -X
done

# echo "Mainly for PPPoE, VPN and DSL (MTU Fix, activate it if you have)"
# echo "Problems with large Downloads over PPPoE"
# $IPTABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
# $IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
#
echo "Connection Tracking Rules"
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# echo "NAT: Masquerade our Traffic"
# $IPTABLES -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

echo "Static NAT to IP: 213.3.5.17"
$IPTABLES -t nat -A POSTROUTING -o ppp0 -j SNAT --to 213.3.5.17

# echo "Portforwarding: 25 --> 192.168.138.28:25"
$IPTABLES -t nat -A PREROUTING -p tcp -i ppp0 --dport 25 -j DNAT --to 192.168.138.28:25

# echo "Portforwarding: 53 --> 192.168.138.28:25"
$IPTABLES -t nat -A PREROUTING -p tcp -i ppp0 --dport 53 -j DNAT --to 192.168.138.28:53
$IPTABLES -t nat -A PREROUTING -p udp -i ppp0 --dport 53 -j DNAT --to 192.168.138.28:53

# echo "Portforwarding: 80,8080,8081 --> 192.168.138.28:80,8080,8081"
$IPTABLES -t nat -A PREROUTING -p tcp -i ppp0 --dport 80 -j DNAT --to 192.168.138.28:80
$IPTABLES -t nat -A PREROUTING -p tcp -i ppp0 --dport 8080 -j DNAT --to 192.168.138.28:8080
$IPTABLES -t nat -A PREROUTING -p tcp -i ppp0 --dport 8081 -j DNAT --to 192.168.138.28:8081

# echo "Portforwarding: 143 --> 192.168.138.28:143"
$IPTABLES -t nat -A PREROUTING -p tcp -i ppp0 --dport 143 -j DNAT --to 192.168.138.28:143
#
echo "Anti Spoofing Rule"
$IPTABLES -N ppp0_In_RULE_0
test -n "$i_ppp0" && $IPTABLES -A INPUT -i ppp0 -s $i_ppp0 -j ppp0_In_RULE_0
$IPTABLES -A INPUT -i ppp0 -s 192.168.138.1 -j ppp0_In_RULE_0
$IPTABLES -A INPUT -i ppp0 -s 192.168.138.0/24 -j ppp0_In_RULE_0
test -n "$i_ppp0" && $IPTABLES -A FORWARD -i ppp0 -s $i_ppp0 -j ppp0_In_RULE_0
$IPTABLES -A FORWARD -i ppp0 -s 192.168.138.1 -j ppp0_In_RULE_0
$IPTABLES -A FORWARD -i ppp0 -s 192.168.138.0/24 -j ppp0_In_RULE_0
$IPTABLES -A ppp0_In_RULE_0 -j LOG --log-level info --log-prefix "RULE 0 -- DENY "
$IPTABLES -A ppp0_In_RULE_0 -j DROP
#
echo "Loopback (lo) Rules"
$IPTABLES -A INPUT -i lo -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -o lo -m state --state NEW -j ACCEPT
#
echo "Allow the following TCP Ports from Aynwhere"
$IPTABLES -A OUTPUT -p tcp -m tcp -m multiport --dports 22,80,443,25,143,8080,8081 \
-m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp -m multiport --dports 22,80,443,25,143,8080,8081 \
-m state --state NEW -j ACCEPT
$IPTABLES -A FORWARD -p tcp -m tcp -m multiport --dports 22,80,443,25,143,8080,8081 \
-m state --state NEW -j ACCEPT
#
echo "Allow DNS Zone Transfer only from 62.2.210.211"
$IPTABLES -A OUTPUT -p tcp -m tcp -d 62.2.210.211 --dport 53 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp -d 62.2.210.211 --dport 53 -m state --state NEW -j ACCEPT
$IPTABLES -A FORWARD -p tcp -m tcp -d 62.2.210.211 --dport 53 -m state --state NEW -j ACCEPT
#
echo "Allow DNS Queries"
$IPTABLES -A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
$IPTABLES -A FORWARD -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
#
echo "Allow NTP Time to setup the Date/Time from NTP Server"
$IPTABLES -A OUTPUT -p udp -m udp --dport 123 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p udp -m udp --dport 123 -m state --state NEW -j ACCEPT
$IPTABLES -A FORWARD -p udp -m udp --dport 123 -m state --state NEW -j ACCEPT
#
echo "HSZ Rules"
$IPTABLES -A INPUT -s 192.168.138.0/24 -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -s 192.168.138.0/24 -m state --state NEW -j ACCEPT
$IPTABLES -A FORWARD -s 192.168.138.0/24 -m state --state NEW -j ACCEPT
#
echo "Logging Rules"
$IPTABLES -N RULE_2
$IPTABLES -A OUTPUT -j RULE_2
$IPTABLES -A INPUT -j RULE_2
$IPTABLES -A FORWARD -j RULE_2
$IPTABLES -A RULE_2 -j LOG --log-level info --log-prefix "RULE 2 -- DENY "
$IPTABLES -A RULE_2 -j DROP
#
echo "Activate Routing"
echo 1 > /proc/sys/net/ipv4/ip_forward

Load and Save the Rules

./firewall.fw
/etc/init.d/iptables save

The iptables rules are saved and automatically loaded when the machine is booting the next time. The location of the saved rules are defined in /etc/conf.d/iptables (/var/lib/iptables/rules-save) for GENTOO linux.
Useful iptables Commands

iptables -L (List Rules)
iptables -t nat -L (List NAT Rules)

Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT tcp -- anywhere anywhere tcp dpt:smtp to:192.168.138.28:25
DNAT tcp -- anywhere anywhere tcp dpt:domain to:192.168.138.20:53
DNAT udp -- anywhere anywhere udp dpt:domain to:192.168.138.20:53
DNAT tcp -- anywhere anywhere tcp dpt:www to:192.168.138.21:80

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- anywhere anywhere to:213.3.5.17

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

iptables -F (Delete all rules)
iptables -X (Delete all userdefined chains)

[ICANWIN]

Asalu avi manual ga Anni command prompt Li run cheyala ? Iptables as I now is installed kada -L kodite Edo vachindi kabatti ?

[ICANWIN]

Asalu how to get started koncham pls help

[maverick23]

adekaadhu bhayya.......simple ga nee task ento cheppu.....wat u need to do from point A to point B.......First dantlo full clarity techuko......Linux architect oka java person ee task cheyamanadante, it should not be complicated........Nuvvu em accomplish cheyalo clear ga explain chesthe daani batti suggest chestha!!!