Building a Firewall with IP Chains
Today, one of the most important topics in the computation world is security. How to improve security in a single or interconnected machine is sometimes hard to understand and difficult to implement. In this article, I will discuss how to implement a simple firewall on a Linux machine using IP chains.
IP chains could be new to users who upgraded their 2.0.36 kernels to the 2.2.x series, but old to those who worked in the 2.1.x series. ipchains is a rewrite of the well-known ipfwadm, which was a rewrite of BSD's ipfw, and was used to build firewalls in 2.0.x kernels. The are many reasons for this rewrite but perhaps the most important is ipfwadm couldn't allow protocols other than TCP, UDP or ICMP and it didn't handle fragments.
Linux IP firewall chaining software is a program that uses the kernel IP packet filtering capability. A packet filter looks at the header of a packet and decides the fate of the entire packet. It can decide to DENY the packet (discard the packet as if it had never received it), ACCEPT (let the packet pass through), or REJECT (like deny, but notify the source of the packet).
When you build your firewall you are looking for control and security of your network, and good firewall scripts are the key to this objective's success. If you are constantly receiving a ping flood from a specific IP address, you can deny all packets received from that IP, by creating a chain with this policy. ipchains is able to read the policies of the scripts and give instructions to the IP packet filtering as to how to handle the incoming/outcoming packets.
First, your kernel must be able to use IP chains. Look for the file /proc/net/ip_fwchains, if it exists, everything is okay. If not, you need to recompile your kernel and set these options:
Next you need to know the syntax of ipchains necessary to create functional scripts. Let's imagine a hypothetical file called scriptf with some rules :
ipchains -N ippolicy ipchains -I input -j ippolicy ipchains -A ippolicy -p icmp -s 188.8.131.52 -j\ DENY ipchains -A ippolicy -p TCP -t 184.108.40.206 -j\ DENYThis script will DENY every packet with the ICMP protocol from the specific source addresses (in our example: 192.168.1.2) and also DENY every packet with the TCP protocol where the target is the choosen address (again in our example: 220.127.116.11). Here's a step-by-step explanation:
ipchains -N ippolicy: this line creates a new chain with the name ippolicy.
ipchains -I input -j ippolicy: this line says all packets will be verified by ippolicy rules.
ipchains -A ippolicy -p icmp -s 18.104.22.168 -j DENY: this line appends the rule ippolicy to the ICMP protocol packets, with a source address of 22.214.171.124 and denies them. Options are:
-A: append one or more rules to the selected chain.
-p: specify the protocol.
-s: specify the source address (0/0 means all addresses).
-j: specify the target of the rule, i.e., what to do if the packet matches it.
ipchains -A ippolicy -p TCP -t 126.96.36.199 -j DENY: This line will append the rule ippolicy to the TCP protocol packets with a target address of 188.8.131.52 and denies them.
/etc/rc.d/init.d/scritpfin the file /etc/rc.d/rc.sysinit to start it. An important option that could help you in the future is the -F flag, which is used when you want to create new rules and override all previous rules, that is:
ipchains -F ippolicy
|Happy Birthday Linux||Aug 25, 2016|
|ContainerCon Vendors Offer Flexible Solutions for Managing All Your New Micro-VMs||Aug 24, 2016|
|Updates from LinuxCon and ContainerCon, Toronto, August 2016||Aug 23, 2016|
|NVMe over Fabrics Support Coming to the Linux 4.8 Kernel||Aug 22, 2016|
|What I Wish I’d Known When I Was an Embedded Linux Newbie||Aug 18, 2016|
|Pandas||Aug 17, 2016|
- Download "Linux Management with Red Hat Satellite: Measuring Business Impact and ROI"
- Happy Birthday Linux
- The Great Software Schism
- Updates from LinuxCon and ContainerCon, Toronto, August 2016
- New Version of GParted
- ContainerCon Vendors Offer Flexible Solutions for Managing All Your New Micro-VMs
- NVMe over Fabrics Support Coming to the Linux 4.8 Kernel
- What I Wish I’d Known When I Was an Embedded Linux Newbie
- Blender for Visual Effects
- Tor 0.2.8.6 Is Released
With all the industry talk about the benefits of Linux on Power and all the performance advantages offered by its open architecture, you may be considering a move in that direction. If you are thinking about analytics, big data and cloud computing, you would be right to evaluate Power. The idea of using commodity x86 hardware and replacing it every three years is an outdated cost model. It doesn’t consider the total cost of ownership, and it doesn’t consider the advantage of real processing power, high-availability and multithreading like a demon.
This ebook takes a look at some of the practical applications of the Linux on Power platform and ways you might bring all the performance power of this open architecture to bear for your organization. There are no smoke and mirrors here—just hard, cold, empirical evidence provided by independent sources. I also consider some innovative ways Linux on Power will be used in the future.Get the Guide