Securing your network with Iptables - Proxy - NAT - IDS: PART 2

@Jlcmux

5 minutes

In the previous post, we saw how to configure IPTables to function as a firewall. Now we can see how to create scripts to automatically run rules when the system starts, and also how to delete or temporarily stop those rules.

Before doing the script and showing you how it looks, let's talk a little about NAT and the concept of what we want to do with this equipment.

NAT and Context of the example.

When we talk about NAT, we can confuse this with routing, since both are in charge of connecting two different networks to each other. The difference really is that the routing is applied to go from one local network to another and this other network can connect to a router and go out to the Internet.

Whereas, when we talk about NAT, we talk about routing packets from a local or private network to a public network or the Internet. It does this by masking the packets by putting the public IP with which it goes to the Internet. In other words, we don't need a router, because the public IP is directly owned by the GNU / Linux computer.

nat

We will work this with the slogan that we are using our Linux as a router / firewall to go out to the Internet from a local network. But here two scenarios can appear.

  • That our Linux is between the router of the service provider and the local network.

In this case, there would be one network between the router and our Linux system, and a different network between the Linux system and the local network. This means our router wouldn't need to perform NAT as such; simple traffic routing, as explained in the previous post, would suffice.

  • That our Linux has an interface connected to the local network and through the other interface it receives directly a public IP with which it navigates.

This means that our Linux must do NAT so that the packets can reach the Internet.

For the purposes of this small laboratory then, we will say that our Linux receives a public IP directly and thus be able to test the effects of NAT.

To do NAT we then use the syntax

 iptables -t nat -A POSTROUTING -O eth1 -j MASQUERADE

Where eth1 is the interface where we receive the public IP, that is, where we go to the Internet.

MASQUERADE is used when the ip is public but it can vary over time (dynamic). Otherwise we can use SNAT –to-source ip

Creating iptables script

Suppose then that: 172.26.0.0 is our local network and 81.2.3.4 is the public IP with which we go to the Internet. (it is a static ip). I have the interfaces eth0 (Local network)

eth1 (Public network).

It basically consists of creating a script that can be called from /etc/init.d/firestop (for example). and from this script we can start, stop or check the status of our configuration, just as we do with any system daemon.

Suppose my IPTABLES rules ARE:

#! / bin / bash # Firewall of my home. # File name / etc / firewall_on # By Jlcmux Twitter: @Jlcmux # # Basic policy. iptables -P INPOUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # #NAT to share Internet from eth0 to eth1 iptables -t nat -A POSTROUTING -O eth1 -j SNAT --to-source 81.2.3.4
# # Allow incoming connections initiated by my iptables -A FORWARD -m state --state ESTABLISHED, RELATED -j ACCEPT # # Authorized outgoing traffic iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 80 -j ACCEPT iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 443 -j ACCEPT iptables -A FORWARD -i eth0 -o eth1 -p udp --dport 53 -j ACCEPT
Let's not forget to give execution permissions

Explanation:

The script basically does the following:

  1. First restrict all navigation, connections and traffic. (Basic Firewall Policies)
  2. Then create the NAT with the destination eth1. indicating that we have a static public ip «81.2.3.4»
  3. It opens the ports necessary to receive the packets of connections initiated by me.
  4. Accepts outgoing HTTP, HTTPS, and DNS traffic.
The rules are destined for FORWARD traffic because we are using our Linux as a Router, so the policies are used for the traffic that PASSES through the Linux, that is, it acts as an intermediary. This means that our Linux can't really navigate or receive any data directly. It only applies to computers connected to it, but not to itself

If we wanted to use our equipment to navigate we should repeat the lines and change FORWARD to INPUT or OUTPUT as appropriate.

Cancel script.

Now we are going to create a script that overrides all the above and leaves the computer clean of all this. (For testing purposes or we just want to turn off the firewall).

#! / bin / bash # Firewall of my home. # File name / etc / firewall_off # By Jlcmux Twitter: @Jlcmux # #Deleting iptables Rules -F # #Applying default policies (all traffic accepted) iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT

Automating.

Now we need to create the script inside /etc/init.d/ so that the service starts automatically and we can manage it more easily.

#! / bin / bash # Firewall of my home. # File name /etc/init.d/ firewall # By Jlcmux Twitter: @Jlcmux case $ 1 in start) / etc / firewall_on ;; stop) / etc / firewall_off ;; status) iptables -L ;; *) echo "Wrong syntax. Valid = /etc/init.d/ firewall start | stop | status ;; esac

Explanation:

We place this last script in /etc/init.d/ with the name "firewall" . Then, if we want to manage the firewall, we can use the command /etc/init.d/firewall start. We can also stop it or check its status in the same way.

Now we're going to edit the /etc/rc.local file and add something like: /etc/init.d/firewall start so that it starts with the system.

As well. This is the second part. I hope it brings something to all of you. In the next we see Proxy and IDS.


Add as preferred source in Google