NetFilter. Training Division National Informatics Centre New Delhi

Transcription

1 NetFilter Training Division National Informatics Centre New Delhi

2 CONTENTS Firewall Types of Firewall Packet Filtering How Packet Filtering Helps? IPTABLES IPTABLES Vs IPCHAINS Configuring IPTABLES Implementing Security SQUID PROXY

3 FIREWALL Firewall is a device that implements your security policy by shielding the network from external threats. It determines which all services on your computer can be accessed by remote users. A properly configured firewall increases the security of the system.

4 Types of Firewall 1. Filtering Firewalls - that block selected network packets. 2. Proxy Servers (sometimes called firewalls) - that make network connections for you.

5 1. Filtering Firewalls A filtering firewall works at the network level. Data is only allowed to leave the system if the firewall rules allow it. As packets arrive they are filtered by their type, source address, destination address, and port information contained in each packet. Because very little data is analyzed and logged, filtering firewalls take less CPU and create less latency in your network. Filtering firewalls do not provide for password controls. User can not identify themselves. The user does not have to setup rules in their applications to use the Internet. (With most proxy servers this is not true.)

6 2.Proxy Servers Proxies are mostly used to control, or monitor, outbound traffic. Some application proxies cache the requested data. This lowers bandwidth requirements and decreases the access the same data for the next user. There are two types of proxy servers. 1. Application Proxies - that do the work for you. 2. SOCKS Proxies - that cross wire ports.

7 BASIC FIREWALL ARCHITECTURE

8 Packet Filtering Traffic moves across Internet as packets,which is a collection of data in specific size and format. 1. Packet filtering blocks unwanted traffic or probes from outside. 2. Redirects specific inbound requests to selected internal hosts. 3. Network Address Translation or NAT allows sharing of a single Internet Address with multiple hosts in an internal LAN.

9 How Packet Filtering helps 1. Limiting access to Internet from certain hosts BY IP Address By Destination port (allowing only specific services such as HTTP to run)

10 How Packet Filtering helps 2. Inbound Port redirection Allows specific connection to internal LAN from outside. A single open port can allow intruders to access the entire LAN (Extreme caution to be exercised)

11 How Packet Filtering helps 3. Network Address Translation With single real IP alloted,nat helps cater to multiple hosts NAT helps to make LAN hosts harder to access from outside

12 IPTABLES The netfilter/iptables project is the Linux 2.4.x / 2.5.x firewalling subsystem. Functionality of packet filtering, all different kinds of NAT (Network Address Translation) and packet mangling. IPTABLES replaces IPCHAINS as the filtering firewall software. Both are available although only one can be active at a time. This means that to use iptables, the ipchains must be disabled.

13 IPTABLES Firewall Command Linux Kernel Version Red Hat Version iptables 2.4.x ipchains 2.2.x 6.x, 7.0 ipfwadm 2.0.x 5.x

14 IPTABLES Vs IPCHAINS Red Hat and the default Linux 2.4 kernel may use ipchains or iptables but not both. Ipchain rules take precedence over iptables rules. During system boot, the kernel attempts to activate ipchains, then attempts to activate iptables. If ipchain rules have been activated, the kernel will not start iptables. When performing an upgrade instead of a new install, the upgrade software will not install iptables as did not exist on the system previously. It will perform an upgrade to a newer version of ipchains. If you wish to use iptables, you must manually install the iptables RPM. i.e.: rpm -ivh iptables-xxx.i386.rpm

15 To Switch a System from IPCHAINS TO IPTABLES Seq Command Description chkconfig --del ipchains chkconfig --add iptables ipchains -F service ipchains stop rmmod ipchains service iptables start Remove ipchains from system boot/initialization process Add iptables to system boot/initialization process Flush ipchains rules Stop ipchains Unload ipchains kernel module. Iptables kernel module can not be loaded if the ipchains module is loaded Load iptables module

16 BASIC COMMAND of IPTABLES iptables [-t table) command [match] [target/jump]

17 Table The [-t table] option allows you to use any table other than the standard table. A table is a packet filtering table that contains rules and chains dealing with specific kinds of packets only. There are three table options available: filter, nat and mangle. This option is not necessary and, if not specified, the filter is the default table to be used. Each table has built-in chains that corresponds to the actions performed on the packet by the netfilter.

18 The filter table is used for general packet filtering and consists of INPUT, OUTPUT, and FORWARD chains. The nat table is used for packets to be forwarded and consists of PREROUTING, OUTPUT, and POSTROUTING chains. The mangle table is used if there are any changes to be made in packets and their headers. This table contains rules to mark packets for advanced routing and it consists of PREROUTING and OUTPUT chains.

19 Built-in chains for filter table: INPUT-Chain applies to packets received via a network interface. OUTPUT-Chain applies to packets sent out via the same network interface which received the packets. FORWARD- Chain applies to packets received on one network interface and sent out on another.

20 Built-in chains for nat table: PREROUTING Chain alters packets received via a network interface when they arrive. OUTPUT-Chain alters locally-generated packets before they are routed via a network interface. POSTROUTING- Chain alters packets before they are sent out via a network interface. Targets are : DNAT,SNAT, MASQUERADE

21 Built-in chains for mangle table: PREROUTING Chain alters packets received via a network interface before they are routed. OUTPUT-Chain alters locally-generated packets before they are routed via a network interface. TARGETS VALID ARE : TOS,TTL and MARK

22 POINTS TO NOTE: Every network packet received by or sent out is subject to atleast one table. Every chain has a default policy to ACCEPT,DROP,REJECT or QUEUE the packet to be passed to user-space. When a packet match a particular rule on one of the tables,the corresponding action is applied on them. If none of the rules apply to the packet, then the default rule applies. ****IPTABLES allow you to configure these rule lists as well as set up new tables to be set up.*****

23

24 TRAVERSING OF TABLES AND CHAINS

25 Forwarded Packets Step Table Chain Comment 1 On the wire(ie Internet) 2 Comes in on the interface(ie etho) 3 mangle PREROUTING Normally used for mangling packets 4 nat Used for DNAT. SNAT is taken later on.avoid filtering here. 5 Routing Decision is taken here 6 filter FORWARD Packet gets routed to FORWARD chain. 7 nat POSTROUTING Chain should first and foremost be usd for SNAT.Masquerading is also done here.avoid filtering 8 Goes out on the outgoing interface (ie eth1) 9 Out on the wire again 10

26 Destination Local Host Step Table Chain Comment 1 On the wire(ie Internet) 2 Comes in on the interface(ie etho) 3 mangle PREROUTING Normally used for mangling packets 4 nat PREROUTING Used for DNAT. Avoid filtering here. 5 Routing Decision is taken here 6 filter INPUT This is where all filtering is done. 7 Local Process/application (ie client/server program)

27 Step 1 Table Source Local Host Chain Comment Local Process/application 2 mangle OUTPUT Normally used for mangling packets 3 nat OUTPUT 4 Filter OUTPUT Filter packets going from local host 5 Routing decision taken. 6 nat POSTROU TING SNAT is to be done here. 7 Goes out on some interface (ie eth0) 8 Out on the wire again

28 STATE MACHINE (CONNECTION TRACKING)

29 Connection tracking is done to let the netfilter framework know the state of the connection. Stateful firewall is more secure that non-stateful firewall.

30 Within IPTABLES there are basic states New Established Related Invalid (--state match is used to specify which states we want to allow in or not)

31 NEW The NEW state tells that the packet is new in connection.this means that the first packet that the conntrack module sees will be matched. ESTABLISHED The ESTABLISHED state has seen traffic in both the directions and will then match those packets. One host sends the packet and gets a reply from the other host.the NEW state then changes into ESTABLISHED state.

32 RELATED The INVALID state is when the connection is to an already ESTABLISHED connection. Eg: ICMP error messages and redirects. FTP data connections. INVALID The INVALID state indicates that the packet cannot be identified or that it does not have any state.

33 Configuring IPTABLES The GUI configuration tool /usr/bin/redhat-config-securitylevel can be used to choose a preconfigured firewall (High, Medium or no firewall) or it can be used to manually configure rules based on the network services your server will offer. The init script /etc/rc.d/init.d/iptables will use rules stored in /etc/sysconfig/iptables.

34 IPTABLES commands -A, --append -D, -- delete -R, -- replace I, --insert -L,--list -F,--flush -N,--new chain -X,--delete chain -P,--policy -M,-- masquerading -S, --set -h Append a new rule Delete a rule Replace a rule with a new one Insert a new rule into a specific position List all rules Flushes all the rules Create a new chain with a specified name Delete chain with specified name. Sets the policy for the chain to the specified target Allows viewing of masqueraded connections. Sets the time outs for TCP,UDP Prints a help message describing the parameters

35 IPTABLES options -p,--protocol[!] protocol -s, -- source[!] address -- source-port[!] port -d,--destination [!] address --destinationport [!] port --icmp-type[!] type name -j,--jump target -I,--interface [!]name -P,--policy Specify the protocol that the rule should match against Specify the source address to match against Source posrt as specified in /etc/services Specify the destination address to match against. Destination port as in the /etc/services Set the type of ICMP packet to use Name of target to execute when the rule matches. Name of the interface the rule applies to. Sets the policy for the chain to the specified target

36 IPTABLES options (contd..) [!] f,--fragment -b,--bidirectional -n,--numeric -l,--log -t,--tos andmask xormask -x,--exact --line numbers --no-warnings Rule will apply only to fragmented packets. Rule should apply to both incoming and outgoing packets Use IP address instead of host names when printing output to screen. Turn on kernel logging of matching packets. Examines the TOS field of the packet using the supplied bit masks. Display the exact value of the packet counters rather than numbers rounded to the kilobyte. Show line numbers when listing rules Disable all warning messages.

37 IPTABLES TARGETS ACCEPT DENY REJECT Accept the packet and deliver it the normal way. Drop the packet completely DROP the packet and send an ICMP packet with an explanation to the sending host. MASQ REDIRECT RETURN Use IP Masquerading for this packet type. Redirect the packet to a new location. Return from this chain to the chain that called it.continue to examine rules in the calling chain where you left off.

38 Syntax for IPTABLES iptables -A CHAIN <expression> <judgement> Chain: INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING Judgement: ACCEPT, DROP, REJECT, LOG, MASQUERADE Expressions: -s Source_IP -d Destination_IP --source-port Source_port --destination-port Destination_port -i incoming network_interface -o outgoing network_interface! expression = NOT logic gate --syn =SYN flag set IPTables Extensions: --tcp-flags used to check active flags -m state --state STATE1, STATE2 where STATEx = NEW, ESTABLISHED, RELATED, INVALID --icmp-type type/code -m mac --mac-source i.e. 00:60:08:91:CC:B7

39 TCP Matches Some Sample Match options iptables A INPUT p tcp sport 22 iptables A INPUT p tcp dport 22 ICMP Matches iptables A input p icmp icmp-type 8 MAC Match iptables A INPUT m mac mac-source 00:00:00:00:00:01

40 Some Sample Match options (contd..) MARK Matches iptables t mangle A INPUT m mark --mark 1 Owner Matches iptables A output m owner uid-owner 500 iptables A OUTPUT m owner -gid-owner 0 State Match iptables A INPUT m satte state RELATED ESTABLISHED

41 Some Sample Match options (contd..) TOS Matches iptables A INPUT p tcp m tos tos 0x16 TTL Matches iptables A output m ttl ttl 60

42 PACKET FLOW THROUGH FILTERS (Table filter) Incoming Need Routing Yes FORWARD chain Outgoing INPUT chain No OUTPUT chain Processes running locally in firewall host

43 IPFORWARDING The following command will allow the Linux kernel to forward IP packets: echo 1 > /proc/sys/net/ipv4/ip_forward Another method is to alter the Linux kernel config file: /etc/sysctl.conf Set the following value: net.ipv4.ip_forward = 1 An alternate method is to alter the network script: /etc/sysconfig/network FORWARD_IPV4=true Change the default "false" to "true". All the above three methods will result in a proc file value of "1". To Test: cat /proc/sys/net/ipv4/ip_forward

44 NAT Run the appropriate script on the linux computer where eth0 is connected to the internet and eth1 is connected to a private LAN: iptables: # Delete and flush. Default table is "filter". Others like "nat" must be explicitly stated. iptables --flush - Flush all the rules in filter and nat tables iptables --table nat --flush iptables --delete-chain - Delete all chains that are not in default filter and nat table iptables --table nat --delete-chain # Set up IP FORWARDing and Masquerading iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE iptables --append FORWARD --in-interface eth1 -j ACCEPT echo 1 > /proc/sys/net/ipv4/ip_forward - Enables packet forwarding by kernel

45 To configure PCs IP Address: Use ifconfig or netcfg commands to set the IP address and netmask. Gateway: The gateway is set with the route command. This can also be set by the GUI tool /usr/bin/netcfg or console tool /usr/sbin/netconfig. It is also stored by the system in the /etc/sysconfig/network file. DNS: Configure file /etc/resolv.conf to set the DNS and default domain. All PC's on the private office network should set their "gateway" to be the local private network IP address of the Linux gateway computer. The DNS should be set to that of the ISP on the internet.

46 Implementing Security Deny a specific host: iptables -I INPUT -s XXX.XXX.XXX.XXX -j DROP Procedure A -Block ports by adding the following firewall rules: # Allow loopback access. This rule must come before the rules denying port access!! iptables -A INPUT -i lo -p all -j ACCEPT This rule is essential if you want your own computer to be able to access itself through the loopback interface iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport j DROP (Block NFS) iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport 6000:6009 -j DROP (Block X-Windows) iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport j DROP (Block X-Windows font server ) iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport 515 -j DROP (Block printer port) iptables -A INPUT -p all -s localhost -i eth0 -j DROP (Deny outside packets from internet which claim to be from your loopback interface )

47 Implementing Security (contd..) Procedure B Alternate procedure by which all all access is dropped and then granted one by one. iptables -F iptables -A INPUT -i lo -p all -j ACCEPT - Allow self access by loopback interface iptables -A OUTPUT -o lo -p all -j ACCEPT iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT - Accept established connections iptables -A INPUT -p tcp --tcp-option! 2 -j REJECT --reject-with tcp-reset iptables -A INPUT -p tcp -i eth0 --dport 21 -j ACCEPT - Open ftp port iptables -A INPUT -p udp -i eth0 --dport 21 -j ACCEPT iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT - Open secure shell port iptables -A INPUT -p udp -i eth0 --dport 22 -j ACCEPT iptables -A INPUT -p tcp -i eth0 --dport 80 -j ACCEPT - Open HTTP port iptables -A INPUT -p udp -i eth0 --dport 80 -j ACCEPT iptables -A INPUT -p tcp --syn -s /24 --destination-port 139 -j ACCEPT - Accept local network Samba connection iptables -A INPUT -p tcp --syn -s trancas --destination-port 139 -j ACCEPT iptables -P INPUT DROP - Drop all other connection attempts. Only connections defined above are allowed.

48 Squid Proxy Server

49 Squid Proxy Server The utility squid is an internet proxy server the network. that can be used within a network to distribute an internet connection to all the computers within the LAN. A central computer connected to the Internet runs squid and thus acts as the firewall to the internet. Because it is a proxy, it has the capabilities to log all user actions such as the URLs visited.

50 Squid Proxy Server Squid is a high-performance proxy caching server for web clients, supporting FTP, gopher, and HTTP data objects. Squid handles all requests in a single, non-blocking, I/O-driven process. Squid keeps meta data, caches DNS lookups, supports nonblocking DNS lookups, and implements negative caching of failed requests. Squid supports SSL, extensive access controls, and full request logging. By using the lightweight Internet Cache Protocol, Squid caches can be arranged in a hierarchy or mesh for additional bandwidth savings.

51 SQUID Configuration Squid uses the configuration file squid.conf. This file is located at /etc/squid directory. Access through the proxy can be given by individual IP addresses or by a subnet of IP addresses. In squid.conf search for the default access control lists(acl) and add the following line below them: acl trgnetwork src / (for subnet) Then add the access control list named trgnetwork" to the http_access list with the following line: http_access allow trgnetwork The default port for the proxy is Uncomment the following line and replace 3128 with the desired port: http_port 3128

52 Starting and Stopping Squid Start Squid Restart Squid /etc/rc.d/init.d/squid start /etc/rc.d/init.d/squid restart Stop Squid /etc/rc.d/init.d/squid stop An alternate would be to issue the following two commands as root: squid -z squid or configure squid to start at boot time using your runlevels.

53 Configuring Squid Clients To configure any application including a web browser to use squid, modify the proxy setting with the IP address of the squid server and the port number (default 3128).

54 Useful Web Sites