Advanced Firewall Rules (IPTables)

IPTables is Linux's powerful, built-in firewall. While we've seen basics, it offers advanced features for precise control.

This lesson unlocks complex rules, stateful filtering, and Network Address Translation (NAT) to truly secure and manage your server's network.

IPTables organizes rules into tables, each serving a specific purpose. Within tables are chains, which are lists of rules evaluated in order.

• filter table: The default table, used for filtering (blocking/allowing) packets. Contains INPUT, OUTPUT, FORWARD chains.
• nat table: Used for Network Address Translation (NAT). Contains PREROUTING, POSTROUTING, OUTPUT chains.
• Other tables like mangle and raw exist for specialized packet modification.

A stateful firewall tracks the state of network connections. Instead of just checking each packet individually, it remembers if a packet belongs to an existing, established connection.

Key connection states:

• NEW: The first packet of a new connection.
• ESTABLISHED: Packets belonging to an existing, active connection.
• RELATED: Packets starting a new connection that is related to an existing one (e.g., FTP data transfer).

Stateful rules drastically simplify firewall management. You can allow all traffic belonging to established connections, meaning you only need to define rules for initiating NEW connections.

This rule allows all incoming packets that are part of an already established or related connection:

IPTables allows you to combine various match modules and options to create highly specific rules. This helps in fine-tuning access for different services and sources.

Example: Allow SSH (port 22) from a specific subnet (192.168.1.0/24) for new connections only.

Network Address Translation (NAT) modifies network address information in the IP header of packets while they are in transit. It's crucial for:

• Allowing multiple devices on a private network to share a single public IP address (e.g., home routers).
• Port forwarding, directing external requests to internal servers.

There are two main types: Source NAT (SNAT) and Destination NAT (DNAT).

Source NAT (SNAT) changes the source IP address of packets. This is commonly used when internal servers need to access the internet through a gateway server with a public IP.

Masquerading is a specific form of SNAT where the outgoing interface's IP address is automatically used as the source IP, useful for dynamic IP addresses.

Example: Allow internal network 192.168.0.0/24 to access the internet via eth0.

Destination NAT (DNAT) changes the destination IP address of packets. This is perfect for port forwarding, where you expose a service running on an internal server to the internet via your gateway server's public IP.

Example: Forward incoming web requests (port 80) on eth0 to an internal web server at 192.168.1.100.

IPTables can help protect against common attacks like brute-force login attempts (e.g., SSH) by limiting the rate at which new connections are accepted from a source IP.

The limit module allows you to specify a rate and a burst limit. Remember to drop subsequent connections after the limit is reached.

Example: Limit new SSH connections to 3 per minute, with an initial burst of 3 connections, then drop others.

Consider a server acting as a gateway. It has a public interface eth0 and an internal interface eth1 (connected to 192.168.1.0/24).

Which IPTables command would allow an internal web server at 192.168.1.50 to be accessible from the internet on port 80?

Congratulations! You've explored advanced IPTables concepts:

• Stateful firewalling with ESTABLISHED, RELATED, and NEW states.
• Creating complex rules by combining multiple match criteria.
• Implementing Network Address Translation (NAT) for both outgoing (SNAT/Masquerade) and incoming (DNAT/Port Forwarding) traffic.
• Using the limit module for basic attack protection.

These skills are vital for building robust and secure Linux server environments. Remember to save your IPTables rules after making changes, as they are not persistent by default!