Difference between revisions of "Firewall"

From Linuxintro
imported>ThorstenStaerk
imported>ThorstenStaerk
 
(3 intermediate revisions by 2 users not shown)
Line 1: Line 1:
In a typical [[network]], all traffic to the outside world has to pass one router/computer/cluster. On this router, you can prevent access to specific [[network ports]]. It is called the firewall.
+
In a typical [[network]], all traffic to the outside world has to pass one router/computer/cluster. On this router, you can prevent access to specific [[network ports]]. It is called the firewall.  
  
 
Now every Linux kernel can play firewall by deciding which network traffic to forward and which not. Starting with Linux 2.4 the respective command is iptables.
 
Now every Linux kernel can play firewall by deciding which network traffic to forward and which not. Starting with Linux 2.4 the respective command is iptables.
Line 19: Line 19:
 
To stop your firewall issue
 
To stop your firewall issue
 
  iptables --flush
 
  iptables --flush
 +
 +
= Configure your firewall =
 +
 +
== Allow port 5901 only from localhost ==
 +
root@cloud-server-01:~# iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 5901 -d 127.0.0.1 -j ACCEPT
 +
root@cloud-server-01:~# iptables -A INPUT -p tcp --dport 5901 -j DROP
 +
 +
== Delete rules ==
 +
To delete a rule, issue the same command as you did with -A with -D:
 +
* create the rule:
 +
root@cloud-server-01:~# iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 5901 -d 127.0.0.1 -j ACCEPT
 +
* delete the rule:
 +
root@cloud-server-01:~# iptables -D INPUT -m state --state NEW -m tcp -p tcp --dport 5901 -d 127.0.0.1 -j ACCEPT
 +
 +
== drop some chains ==
 +
<pre>
 +
root@cloud-server-01:~# iptables --list
 +
Chain INPUT (policy ACCEPT)
 +
target    prot opt source              destination       
 +
 +
[...]   
 +
 +
Chain ufw-before-forward (0 references)
 +
target    prot opt source              destination   
 +
</pre>
 +
 +
root@cloud-server-01:~# iptables --delete-chain ufw-before-forward
  
 
= See also =
 
= See also =
 
* [[security]]
 
* [[security]]

Latest revision as of 13:10, 5 June 2015

In a typical network, all traffic to the outside world has to pass one router/computer/cluster. On this router, you can prevent access to specific network ports. It is called the firewall.

Now every Linux kernel can play firewall by deciding which network traffic to forward and which not. Starting with Linux 2.4 the respective command is iptables.

Check if your firewall is running

To check if your firewall is running, use the command iptables --list. Here's an output that means your firewall is turned off:

iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

If you look at it, you will find that for all incoming packets ("Chain INPUT" entry above), the policy is set to ACCEPT with no exceptions. The same is true for FORWARD and OUTPUT.

Stop your firewall

To stop your firewall issue

iptables --flush

Configure your firewall

Allow port 5901 only from localhost

root@cloud-server-01:~# iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 5901 -d 127.0.0.1 -j ACCEPT
root@cloud-server-01:~# iptables -A INPUT -p tcp --dport 5901 -j DROP

Delete rules

To delete a rule, issue the same command as you did with -A with -D:

  • create the rule:
root@cloud-server-01:~# iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 5901 -d 127.0.0.1 -j ACCEPT
  • delete the rule:
root@cloud-server-01:~# iptables -D INPUT -m state --state NEW -m tcp -p tcp --dport 5901 -d 127.0.0.1 -j ACCEPT

drop some chains

root@cloud-server-01:~# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

[...]     

Chain ufw-before-forward (0 references)
target     prot opt source               destination     
root@cloud-server-01:~# iptables --delete-chain ufw-before-forward

See also