Iptables Firewall: Comprehensive Guide to Enhancing Network Security with Linux

An apartment building

Apartments within

Furniture in apartments

Organization of furniture items

Filter

The default table, responsible for firewall data filtering.

INPUT

For packets designated to the local socket, i.e., data packets arriving at the local firewall server.

FORWARD

Packets routed through, i.e., passing through the local firewall server.

OUTPUT

Locally created data packets

NAT

Referred to when a new packet connection is established

PREROUTING

Immediately alters packets as they come in

OUTPUT

Alters locally created packets before routing

POSTROUTING

Changes packet information as packets are about to leave

Mangle

Specifically for manipulating packet attributes

INPUT

Packets entering the device itself

FORWARD

Modifies routing information of packets

PREROUTING

Changes incoming packets before routing

OUTPUT

Alters locally created packets before routing them

POSTROUTING

Changes packet information before they leave

Raw

Used mainly for configuring exemptions from connection tracking with the NOTRACK target.

PREROUTING

For packets arriving via any network interface

OUTPUT

For packets generated by local processes

Display Related Parameters

-n/–numeric

Display address or port information in numeric form

-L/ –list

List rules in a chain or all chains

–list-rules/-S

Print the rules in a chain or all chains

–line-number

Print rule line number when listing rule information

-v

Display detailed information, can be cumulative

-h

Display help information

Initialization Related Parameters

iptables -F

Clear all rules, but doesn’t handle default rules

iptables -X

Delete user-defined chains

iptables -Z

Reset chain counters (packet counters and byte counters)

Common Configuration Parameters

-t Table Name

Specify which table to configure, and specify the table name.

–append/-A Chain Name

Append or add corresponding rule policies to the specified chain (chain name must be uppercase), default insertion at the end.

–check/-C

Check for the existence of a rule

–insert/-I Chain Name

Insert corresponding rules to the specified chain, with default insertion at the beginning (can insert at a specific position by rule number)—used for sealing IP addresses.

–delete/-D Chain Name

Delete specified rule (can be deleted by rule number)

–replace/-R

Replace rule rulenum (1 = first) in chain

-P (uppercase) Chain Name

Alter the final default rule policy on the chain

–new/-N

Create a new user-defined chain

-p Protocol Name
[!] –proto

Specify the protocol name in the rule: all, tcp, udp, icmp

–dport

Specify the matching destination port information

–sport

Specify the matching source port information

-j Action

Action to be taken after matching a packet

ACCEPT

Allow

DROP

Discard (no response)

REJECT

Refuse (send explicit rejection to requester)

MASQUERADE

Used for masquerading on the internet

SNAT

Shared address internet access

DNAT

Destination address rewriting

-i
[!] –in-interface

Specifies incoming traffic interface in INPUT chain rules (only applicable to INPUT chain)

-o
[!] –out-interface

Specifies outgoing traffic interface in OUTPUT chain rules (only applicable to OUTPUT chain)

-s
 [!] –source

Specifies source IP address or source network information

x

3

9

Destination network administratively prohibited——The destination network has been administratively prohibited

x

3

10

Destination host administratively prohibited——The destination host has been administratively prohibited

x

3

11

Network unreachable for TOS——Network unreachable due to Type of Service (TOS)

x

3

12

Host unreachable for TOS——Host unreachable due to Type of Service (TOS)

x

3

13

Communication administratively prohibited by filtering——Communication administratively prohibited by filtering

x

3

14

Host precedence violation——Host precedence violation

x

3

15

Precedence cutoff in effect——Precedence cutoff in effect

x

4

0

Source quench——Source quench (basic flow control)

5

0

Redirect for network——Redirect for network

5

1

Redirect for host——Redirect for host

5

2

Redirect for TOS and network——Redirect for Type of Service and network

5

3

Redirect for TOS and host——Redirect for Type of Service and host

8

0

Echo request——Echo request (Ping request)

x

9

0

Router advertisement——Router advertisement

10

0

Route solicitation——Route solicitation

11

0

TTL equals 0 during transit——Time to Live (TTL) equals 0 during transit

x

11

1

TTL equals 0 during reassembly——Time to Live (TTL) equals 0 during reassembly

x

12

0

IP header bad (catchall error)——Bad IP header (catchall error)

x

12

1

Required options missing——Required options missing

x

13

0

Timestamp request (obsolete)——Timestamp request (obsolete)

x

14

Timestamp reply (obsolete)——Timestamp reply (obsolete)

x

15

0

Information request (obsolete)——Information request (obsolete)

x

16

0

Information reply (obsolete)——Information reply (obsolete)

x

17

0

Address mask request——Address mask request

x

18

0

Address mask reply——Address mask reply

Data source: http://www.cnitblog.com/yang55xiaoguang/articles/59581.html

1.6.5 Firewall State Mechanism Configuration

Brief description of state sets:

Note: Allow associated state packets to pass (web services should not use FTP services)

When firewall services are configured on an FTP server, the following strategies need to be configured

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Implement discovery of sent_syn state

iptables -A INPUT -m state --state NEW -j DROP # Client connected to the firewall configuration

Implement discovery of sent_rcvd state

iptables -I INPUT -i eth0 -s 10.0.0.201 -m state --state ESTABLISHED -j DROP # Configured on the firewall

1.6.6 Implementing Rate Limiting with iptables

limit is a matching module of iptables, and it can be used with other iptables commands to achieve rate limiting.

Firstly, it must be clear that limit itself is only a “matching” module. As we know, the basic principle of iptables is “match–process”, and limit can only play a matching role in this process. It cannot itself perform any processing on network packets. I’ve seen some examples online claiming that a single iptables statement with a limit match rule can achieve rate limiting, which is incorrect.

In fact, using limit to rate limit requires two steps:

1. Allow packets that conform to the limit match rule

2. Discard/Reject packets not allowed

Example:

iptables -I INPUT -s 10.0.0.7 -p icmp --icmp-type 8 -m limit --limit 6/min --limit-burst 5 -j ACCEPT 
iptables -I INPUT -s 10.0.0.7 -p icmp --icmp-type 8 -j DROP

Statement Meaning: When ping packets from 10.0.0.7 exceed 5, rate limit them to one packet every 10 seconds.

Parameter Explanation:

How does the limit module specifically work?

The limit match is based on the Token Bucket model.

The token bucket is a common buffering principle in network communications, with two important parameters: bucket capacity “n” and token generation rate “s”.

iptables -t nat -I POSTROUTING -s 172.16.1.0/255.255.240.0 -d 10.0.0.81 -j SNAT –to-source 172.16.1.8

 

Verify the configuration:

 
ping 10.0.0.81 -t 
tcpdump | grep -i icmp (monitor on both machines) 
telnet 10.0.0.81 22

1.7.4 Mapping Multiple External IPs for Internet Access

Method 1:

 
iptables -t nat -A POSTROUTING -s 10.0.1.0/255.255.240.0 -o eth0 -j SNAT --to-source 124.42.60.11-124.42.60.16

Divide VLAN on a Layer 3 switch or router.

Method 2:

 
iptables -t nat -A POSTROUTING -s 10.0.1.0/22 -o eth0 -j SNAT --to-source 124.42.60.11 
iptables -t nat -A POSTROUTING -s 10.0.2.0/22 -o eth0 -j SNAT --to-source 124.42.60.12

Expanding the subnet may increase broadcast storms.

1.7.5 System Firewall and Network Kernel Optimization Standard Parameters

Kernel optimization related to iptables

Adjust the kernel parameter file /etc/sysctl.conf

Below is the configuration of a server in my production environment:

Solution to excessive time-wait:

net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_max_tw_buckets = 36000

net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1

In dmesg, the error message ip_conntrack: table full, dropping packet appears, what is the cause?

How to resolve it?

#iptables optimization

 
net.nf_conntrack_max = 25000000 
net.netfilter.nf_conntrack_max = 25000000 
net.netfilter.nf_conntrack_tcp_timeout_established = 180 
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120 
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60 
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120

1.8 Custom Chain Configuration

Figure – Principle of Custom Chains

Create a custom chain

 
# Example: Create NOICMP custom chain in the filter table
iptables -t filter -N NOICMP

Reference custom chain

 
# Example: Reference the previously created custom chain in the INPUT chain
iptables -t filter -I INPUT -p icmp  -j NOICMP

Rename custom chain

 
# Example: Rename the IN_WEB custom chain to WEB
iptables -E NOICMP ACCEPTICMP

Delete a custom chain

Deleting a custom chain requires two conditions
1. The custom chain is not referenced
2. The custom chain contains no rules

 
# Example: Delete the ACCEPTICMP chain that has zero references and contains no rules
iptables -X ACCEPTICMP

1.9 Appendix – Firewall State Mechanism

The state mechanism is a rather special part of iptables, and one of the significant differences between iptables and the older ipchains. Firewalls running state mechanisms (connection tracking) are called stateful firewalls, hereinafter referred to as stateful firewalls. Stateful firewalls are more secure than stateless firewalls as they allow us to write more stringent rules.

There are four states in iptables, named NEW, ESTABLISHED, INVALID, and RELATED. These four states are valid for TCP, UDP, and ICMP protocols. Now, let’s explain the characteristics of each state individually.

? NEW

meaning that the packet has started a new connection, or is otherwise associated with a connection which has not seen packets in both directions.

NEW indicates this is the first packet of a connection we observe. In other words, it’s the first packet the conntrack module sees of a connection and can be matched. For example, if we see a SYN packet that is the first packet of a connection we care about, we need to match it.

? ESTABLISHED

meaning that the packet is associated with a connection which has seen packets in both directions.

ESTABLISHED indicates traffic has been observed in both directions and will continue to match packets of this connection. An ESTABLISHED state of a connection is straightforward to understand: as long as packets are sent and acknowledged, the connection is ESTABLISHED. A connection will transition from NEW to ESTABLISHED once the acknowledgment packet is received, regardless of whether it is sent to or forwarded by the firewall. ICMP errors and redirects are also seen as ESTABLISHED if they are replies to our sent messages.

? RELATED

meaning that the packet is starting a new connection but is associated with an existing connection, such as an FTP data transfer, or an ICMP error.

RELATED is a relatively tricky state. When a connection is related to an existing ESTABLISHED connection, it is deemed RELATED. In other words, for a connection to be RELATED, there must first be an ESTABLISHED connection. This ESTABLISHED connection then generates an additional connection outside of the primary one, which is the RELATED connection, but the conntrack module must understand the RELATED nature for this to apply. FTP is an excellent example, where the FTP-data connection is associated with an FTP-control connection. Without configuring the RELATED state in iptables policies, an FTP-data connection cannot be correctly established. Other examples include DCC connections via IRC, where this state allows ICMP replies, FTP transfers, and DCC to operate correctly through the firewall. Note that many UDP protocols also rely on this mechanism due to their complexity, as they embed connection information in the data packets that must be correctly interpreted.

? INVALID

meaning that the packet is associated with no known connection.

INVALID represents packets that cannot be associated with any connection or do not have a state. There are several reasons for this situation, such as memory overflow, or receiving an ICMP error message unrelated to any known connection. Generally, we DROP anything with this status as the firewall considers it unsafe.

1.9.1 iptables Configuration Philosophy

How to prevent being locked out?

01. Go to the server room and reboot the system or log in to remove the newly set blocking rule.
02. Have the server room staff reboot the server or log in using user credentials.
03. Manage via the server’s remote management card (recommended).
04. Set a cron job to stop the firewall every 5 minutes.
05. Test in a controlled environment, write a script, and execute in batches.

Configuration to disable policy on port 22:

 
iptables -I INPUT -p tcp -dport 22 -j DROP 
# Note: Use the -I parameter to force a block of port 22 access, placing the Jffc rule first

Delete the configured rule banning connections on port 22

 
iptables -t filter -D INPUT -p tcp --dport 22 -j DROP 
iptables -F 
/etc/init.d/iptables restart

1.10 References

[1] http://www.aichengxu.com/linux/3122717.htm

[2] http://blog.csdn.net/huguohu2006/article/details/6453522

[3]
http://blog.csdn.net/lin_credible/article/details/8614907
[4]  http://blog.chinaunix.net/uid-27057175-id-5179329.html
[5]  http://blog.51cto.com/oldboy/974194
[6]  http://blog.sina.com.cn/s/blog_773d9b6701018rwo.html
[7]  http://www.zsythink.net/archives/1625

Security