Linux Administration - Firewalls

[top]

iptables

Files 

/proc/net/ip_tables_match
/proc/net/ip_tables_names
/proc/net/ip_tables_targets
iptables related files.


Commands
 iptables -L -t filter
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Display the current settings of the "filter" table. The "filter" table is the default, so this specification is not necessary.

 iptables -t filter -F FORWARD
Flush current rules for the FORWARD chain

 iptables -t filter -P FORWARD DROP
Set the default policy for the FORWARD chain to DROP

 iptables [-t table] -A [FORWARD/INPUT/OUTPUT] selection-criteria -j [ACCEPT/REJECT/DROP]
Add a policy for a chain. The selection criteria corresponds as follows:

-p [tcp,udp,icmp,all]				- protocal type
--source-port, -sport [port:port]		- source port range
--destination-port, -dport [port:port]		- destination port range
--source, -s [ip]				- source ip address
--destination, -d [ip]				- destination ip address
--in-interface, I [interface_name]		- interface packets arrive on
--out-interface, o [interface_name]		- interface packets leave on
--state [NEW/ESTABLISHED/RELATED/INVALID]	- block connection attempts to certain ports while also enabling 
						  connections from those same ports. (stateful packet inspection)


[top] TCP Wrappers

Files 
/etc/hosts.allow	- specifies computers allowed to connect to system (man hosts.allow)
/etc/hosts.deny		- specifies computer NOT allowed to connect to system (man hosts.deny)

format: daemon-list : client-list
daemon-list = list of servers whose names appear in /etc/services
client-list = list of computers by name or IP address


[top] xinetd

Files 
/etc/xinetd.conf	- configuration file
/etc/xinetd.d 		- directory of related script files


Directives - /etc/xinetd.d 
bind		- listen on only one network interface for a specified service
only_from	- accept connections only from specified IP addresses, networks or computer names.
no_access	- deny connections from specified IP addresses, networks or computer names.
access_times	- times when users can access the system (10:00-20:00)