IPTables Tips and Tricks:
More Than Just ACCEPT and
DROP
Gary Smith, Pacific Northwest National Laboratory
A Little Context
The Five Golden Principles of Security
Know your system
Principle of Least Privilege
Defense in Depth
Protection is key but detection is a must.
Know your enemy.
2
Avoiding Locking Yourself Out
Scenario: You are going to make changes to the IPTables
policy rules. You want to avoid locking yourself, and
potentially everybody else out too (this costs time and
money).
Tips #1: Take a backup of your IPTables configuration
before you ever start working on it.
/sbin/iptables-save > /root/iptables-works
Even better, include a timestamp as part of the file name:
/sbin/iptables-save > /root/iptables-works-`date +%F`
You get a file with a name like
/root/IPTablesworks-2014-04-14.
If you do something that prevents your system from
working, you can quickly restore it.
/sbin/iptables-restore <
/root/iptables-works-2014-04-14
3
Avoiding Locking Yourself Out (2)
Tip #2: Every time you create a backup copy of the
IPTables policy, create a link to the file with ‘latest’ as part
of the name.
ln –s /root/iptables-works-`date +%F`
/root/iptables-works-latest
Create a cron script that will reload to your ‘latest’ working
saved policy every 5 minutes during testing.
4
Avoiding Locking Yourself Out (3)
Tip #3: Have an IPMI/KVM console ready and waiting.
If you’re working on a physical server, connect to the IPMI
port on the server and log into the server.
If you’re working on a VM, start up a console session on
the VM and log into the VM.
5
Avoiding Locking Yourself Out (4)
Tip #4: Put specific rules at the top of the policy and
generic rules at the bottom.
The more criteria you specify in the rule, the less chance
you will have of locking yourself out.
iptables -A INPUT -p tcp --dport 22 –s
10.0.0.0/8 –d 192.168.100.101 -j DROP
Avoid generic rules like this at the top of the policy rules:
iptables -A INPUT -p tcp --dport 22 -j DROP
There are plenty of ways that you can be more specific.
For example, using "-i eth0" will limit the processing to a
single NIC in your server.
This way, it will not apply the rule to eth1.
6
Avoiding Locking Yourself Out (5)
Tip #5: Whitelist your IP address at the top of your policy
rules.
This is a very effective method of not getting locked out.
Everybody else, not so much.
iptables -I INPUT -s <your IP> -j ACCEPT
You need to put this as the FIRST rule in order for it to
work properly.
Remember, "-I" inserts it as the first rule; "-A" appends it
to the end of the list.
7
Avoiding Locking Yourself Out (6)
Tip #6: Know and understand all of the rules in your
current policy.
Not making the mistake in the first place is half the battle.
If you understand the inner workings behind your
IPTables policy, it will make your life easier.
Draw a flow chart if you must.
Also remember: What the policy does and what it is
supposed to do can be two different things.
8
Setting Up a Workstation Firewall Policy
Scenario: You want to set up a workstation with a
restrictive firewall policy:
Tip #1: Set the default policy as DROP.
Tip #2: Allow only the minimum amount of services
needed to let the user get work done.
# Set a default policy of DROP
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
9
Setting Up a Workstation Firewall Policy (2)
# Accept any related or established connections
-I INPUT 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-I OUTPUT 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow all traffic on the loopback interface
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
# Allow outbound DHCP request
-A OUTPUT –o eth0 -p udp --dport 67:68 --sport 67:68 -j
ACCEPT
10
Setting Up a Workstation Firewall Policy (3)
# Allow inbound SSH
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state
NEW -j ACCEPT
# Allow outbound email
-A INPUT -i eth0 -p tcp -m tcp --dport 25 -m state --state
NEW -j ACCEPT
# Outbound DNS lookups
-A OUTPUT -o eth0 -p udp -m udp --dport 53 -j ACCEPT
# Outbound PING requests
-A OUTPUT –o eth0 -p icmp -j ACCEPT
# Outbound Network Time Protocol (NTP) request
-A OUTPUT –o eth0 -p udp --dport 123 --sport 123 -j ACCEPT
11
Setting Up a Workstation Firewall Policy (4)
# Outbound HTTP
-A OUTPUT -o eth0 -p tcp -m tcp --dport 80 -m state --state
NEW -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 443 -m state
-state NEW -j ACCEPT
COMMIT
12
Restricting an IP Address Range
Scenario: You’re employees are spending too much time
on Facebook and not getting their work done.
You want to block access to Facebook.
Tip: Use this process to block access to Facebook.
Find out all ip addresses of facebook.com:
host -t a www.facebook.com
www.facebook.com is an alias for
star.c10r.facebook.com.
star.c10r.facebook.com has address 31.13.65.17
whois 31.13.65.17 | grep inetnum
inetnum:
31.13.64.0 - 31.13.127.255
13
Restricting an IP Address Range (2)
Convert that range to CIDR notation
(http://www.ipaddressguide.com/cidr) and you get 31.13.64.0/18.
To prevent outgoing access to www.facebook.com, do
iptables -A OUTPUT -p tcp -i eth0 –o eth1
–d 31.13.64.0/18 -j DROP
14
Regulating by Time
Scenario: The backlash from your employees over
denying access to Facebook is causes you to relent (a
little). You decide to allow access to facebook.com only at
lunch time (1200 to 1300).
Tip: Use the time features of IPTables to open up the
access.
iptables –A OUTPUT -p tcp -m multiport –dport
http,https -i eth0 -o eth1 -m time --timestart 12:00 -timestop 13:00 –d 31.13.64.0/18 -j ACCEPT
This presumes a default policy of DROP.
15
Regulating by Time (2)
Scenario: Drop all TCP/UDP traffic during service hours
(between 02:00 and 03:00), that is, for maintenance’s
tasks which should not be disrupted by incoming traffic.
iptables -A INPUT -p tcp -m time --timestart 02:00
-timestop 03:00 -j DROP
iptables -A INPUT -p udp -m time --timestart 02:00
-timestop 03:00 -j DROP
16
-
Limiting Connections with IPTables
Scenario: You suspect a bad actor is attempting to DoS
your webserver.
Tip #1: You can restrict the number of connections a
single IP address can have to your webserver.
iptables –A INPUT –p tcp –syn -m multiport -–dport
80,443 –m connlimit -–connlimit-above 20 –j REJECT
-–reject-with-tcp-reset
17
Limiting Connections by Time (2)
Tip #2: You can drop incoming connections if the IP
address makes more than 10 connections to port 80/443
in 100 seconds.
iptables –A INPUT –p tcp -m multiport -–dport 80,443 –
m state d–state NEW –m recent -–set
iptables –A INPUT –p tcp -m multiport -–dport 80,443 –
m state -–state NEW –m recent -–update -–seconds 100
–hitcount 10 –j DROP
18
Monitoring IPTables
Scenario: You would like to monitor what’s going on with
IPTables in real time, sort of like with “top”.
Tip #1: Issue this command as root:
watch --interval=5 ’iptables -nvL | grep -v "0
Note: the spacing on the “grep” command is important.
The result looks like this:
19
0"’
Monitoring IPTables (2)
20
Monitoring IPTables (3)
Tip #2: Use this Perl script from perlmonks.org
http://www.perlmonks.org/?node_id=513732. It does a
more comprehensive display.
21
Monitoring IPTables (4)
22
Reporting on IPTables
Scenario: You (Your boss) think(s) this dynamic stuff is
just great, but a daily activity report would also be great.
Tip: Use FWReport (http://fwreport.sourceforge.net/).
FWReport is a log parser and reporting tool for IPTables.
It generates daily and monthly summaries of the log files,
allowing the security administrator to free up substantial
time, maintain better control over security of the network,
and reduce unnoticed attacks.
23
Reporting on IPTables (2)
24
Visualizing IPTables Log Files
Scenario: It’s almost time for the monthly operations
review and you would like to have a really great graphical
representation of the activity on the firewall for the past
month.
Tip: There is an excellent tutorial on how to use psad,
afterglow, and graphviz to visualize the activity in your
IPTables firewall logs (http://lintut.com/use-afterglow-tovisualize-iptables-logs-on-centos-rhel-fedora/)
Here are some examples:
25
Visualizing IPTables Firewall Input
26
Visualizing IPTables Firewall Output
27
In Conclusion…
We’ve covered many facets of IPTables; all the way from
making sure you don’t lock yourself out when working
with IPTables to monitoring IPTables to visualizing the
activity of an IPTables firewall.
These are just some of the tips and tricks that exist for
IPTables.
These will get you started down the path to realizing even
more IPTables tips and tricks.
There REALLY is more to IPTables than just ACCEPT
and DROP.
28
References
Convert an address range to CIDR www.ipaddressguide.com/cidr
Real-time IPTables Monitor www.perlmonks.org/?node_id=513732
FWReport - http://fwreport.sourceforge.net
Using Afterglow to Visualize IPTables Logs http://lintut.com/use-afterglow-to-visualize-IPTables-logson-centos-rhel-fedora/
IPTables - http://www.netfilter.org/
29
Questions?
Gary Smith
Information System Security Officer, Molecular Science
Computing, Pacific Northwest National Laboratory
Richland, WA
gary.smith@pnnl.gov
30