iptables for newbies, curious, interested (2nd Part)

When DesdeLinux I was only a few months old and I wrote an extremely simple to understand tutorial about iptables: iptables for newbies, curious, interested (1st part) . Using metaphors such as comparing our computer with our house, our firewall with the door of the house, as well as other examples, I explained in an entertaining way, without so many technicalities or complicated concepts, what is a firewall, what is iptables and how to start using it and configure. This is the continuation, the 2nd part of the previous iptables tutorial 🙂

It happens that a few days ago using a Linksys AP (Access Point) I put a Wifi at my girlfriend's house, although the locality is not the most knowledgeable in terms of technology, that is, it is not that there are many dangers of cracking, it is always A good idea to have excellent security both in the Wifi and in the computers.

I will not comment on the security of the Wifi here, as it is not the objective of the post, I will focus on the iptables configuration that I currently use on my laptop.

In the previous post I had explained that it is necessary in a firewall to first deny all incoming traffic, for this:

sudo iptables -P INPUT DROP

Then we must allow our own computer to have permission to enter data:

sudo iptables -A INPUT -i lo -j ACCEPT

As well as accepting packets of requests that originate from our computer:

sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

So far our computer can navigate the internet without problems, but no one from any other environment (LAN, internet, Wifi, etc.) will be able to access our computer in any way. We are going to start configuring iptables according to our needs.

Using ulogd to output the iptables logs to another file:

By default the iptables logs go in the kernel log, the system log, or something like that ... in Arch by default, right now I don't even remember where they go, that's why I use ulogd so that the iptables logs are in another file.

sudo iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j ULOG

Giving access to my private server:

I don't use VirtualBox or anything similar to virtualize, I have my private server virtualized with Qemu + KVM which must be able to connect to my laptop as such, with the iptables rules that I just specified above it will not be able to, that is why I have to give permission to the IP of my virtual server so that it can access my laptop:

sudo iptables -A INPUT -i virbr0 -p tcp -s 192.168.122.88 -j ACCEPT

We are going to detail this line, it is important that you understand what each parameter means, because they will be repeated a lot from now on:

-A INPUT : I'm saying I'm going to declare a rule for inbound traffic

-i virbr0 : I declare that the interface through which I will accept the traffic is not etho (LAN) or wlan0 (Wifi), I specifically say that it is my virbr0 interface, that is, the virtual network interface (internal) through which my laptop communicates with my virtual server (and vice versa)

-p tcp : I specify the protocol, the most used are UDP and TCP, here it was really enough not to put this but ... it is customary to specify the type of protocol to accept

-s 192.168.122.88 : The source, source of the packages. In other words, the rule refers to packets that come specifically from the IP 192.168.122.88

-j ACCEPT : Already here I say what I want to do with the packages that match the above, in this case accept.

In other words, as a summary, I will accept packets that come from the IP 192.168.122.88, but in case you want to enter packets that come from that IP BUT! They enter from an interface that is not virbr0, that is, let's say that they try to enter packets from the IP 192.168.122.88 but they are from a computer in our Wifi network, if that is the case, the packets will be rejected. why? Because we clearly specify that yes, we accept packets from 192.168.122.88 yes, but and only but, they also have to enter from the virbr0 interface (internal, virtual network interface), if the packets come from another interface (LAN, RAS, Wifi, etc) then they will not be accepted. By specifying the interface as you can see we can restrict it even more, we can have a better control over what enters (or does not enter) our computer.

Accepting ping from any IP of the home Wifi:

From some other computer that connects to the Wifi, if you try to ping my laptop I want to allow it. reason? The idea is also that in the next few weeks to link the PC of the house next door to the network, so sharing information would be less complex, more fluid, when I start to do tests to link the desktop to the Wifi, I will need to ping my laptop to check connectivity, if my laptop does not ping me back, I can think that the AP is failing, or that there was an error when accessing the Wifi, that is why I want to allow the ping.

sudo iptables -A INPUT -i wlo1 -p icmp -s 192.168.1.0/24 -d 192.168.1.51 -j ACCEPT

-A INPUT : Same as before, I refer to incoming traffic

-i wlo1 : Similar to before. In the previous case I specified the virtual interface, in this case I specify another interface, that of my wifi: wlo1

-p icmp : Icmp protocol, icmp = ping. That is, I am not allowing SSH or anything similar, I only allow ping (icmp)

-s 192.168.1.0/24 : The source of the packets, that is, as long as the packets come from an IP 192.168.1.? will be accepted

-d 192.168.1.51 : Destination IP, that is, my IP.

-j ACCEPT : I indicate what to do with the packages that match the above, accept.

That is, and to explain this in a running way, I accept that they ping me (icmp protocol) whose destination is specifically my IP, as long as they come from an IP such as 192.168.1 .__ but also, they cannot come from any network interface , they have to enter specifically from my Wifi network interface (wlo1)

Accept SSH only for one IP:

Sometimes I need to connect by SSH from my smartphone to control the laptop, that is why I must allow SSH access to my laptop from the IPs of my Wifi, for this:

sudo iptables -A INPUT -i wlo1 -p tcp -s 192.168.1.0/24 -d 192.168.1.51 --dport 22 -j ACCEPT

From this line the only thing that is different or that deserves to be highlighted is: –Dport 22 (SSH port I use)

In other words, I accept attempts to connect to my laptop through port 22, as long as they come from an IP of my wifi, they also have to have my IP as a specific destination and also come through the wlo1 interface, that is, that of my wifi (not the lan, etc)

Allowing them to view your website:

It is not my case, but if any of you have a hosted website and do not want to deny access to anyone, that is, that everyone from anywhere can access that website, it is much simpler than you may think:

sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

In other words, here they are allowing all incoming traffic (tcp) through port 80. As you can see, I do not specify from which IPs or network I allow access, by not specifying an IP range to allow, iptables assumes that I want to allow access to all existing IP ranges, that is, to the whole world 🙂

Other combinations:

I have many other rules such as, for example, accept ping for IPs from my home LAN (for this it is basically the same line as above, changing the IP ranges), which is more of the same that I just explained above ... in my laptop as such I do not use really complex things, that of limiting connections, anti DDoS, I leave that for the servers, on my laptop I don't need it 🙂

Anyway, so far the article.

As you can see, working with iptables is not that complex by any means, once you build a script in which you write your rules it is very simple then modify it, add or remove rules to your firewall.

I do not consider myself an expert on the subject far from it, despite any questions you may have, they comment here, I will try to help you as much as I can.

regards