[Day 6] 2. iptables

Overview

• iptables is the built-in Linux Firewall.
• It operates in two spaces:
  1. iptables: User-space module.
  2. netfilter: Kernel-space module.

---

Structure of iptables

• iptables is a collection of tables.
• Each table contains chains, and each chain holds a set of rules.
• Rules define actions to take, and these actions are referred to as targets (e.g., allow, drop).

---

Tables in iptables

There are five tables in iptables:

1. Filter Table (Default Table)

   • Used to implement firewall features.
   • Primarily used for writing traffic filtering rules.

2. RAW Table

   • Used for configuring packets before connection tracking.

3. NAT Table

   • Handles Network Address Translation (NAT) for packets.

4. Mangle Table

   • Used for packet alteration, such as changing the headers.

5. Security Table

   • Adds security policies using SELinux or similar frameworks.

---

Chains in the Filter Table

The Filter Table (default) has three pre-defined chains:

1. Input Chain

   • Rules for incoming traffic (packets destined for your machine).

2. Output Chain

   • Rules for outgoing traffic (packets originating from your machine).

3. Forward Chain

   • Rules for traffic passing through your machine.
   • This applies when your machine acts as a router.

---

Rules and Targets

• Rules define conditions for packet filtering (e.g., protocol, port number).
• Each rule specifies a target:
  • A (Allow): Accept the packet.
  • D (Drop): Block the packet.

!2. iptables.png

---

How Rules Work in iptables

1. Sequential Processing:

   • Rules are checked sequentially from top to bottom.
   • Once a rule matches, no further rules are evaluated.
   • Therefore, the order of rules is critical.

2. Default Policy:

   • Each chain has a default policy (either Accept or Drop).
   • If no rules match, the default policy decides the packet’s fate.

---

Scenarios

Scenario 1: Sequential Rule Matching

• Example Rules:

  1. A TCP 80 (Allow HTTP traffic).
  2. D TCP 22 (Drop SSH traffic).
  3. A UDP 53 (Allow DNS traffic).
  4. A TCP 21 (Allow FTP traffic).

• Incoming packet: UDP 53

  • The packet is checked against each rule in sequence.
  • It matches the 3rd rule (A UDP 53) and is allowed.
  • Subsequent rules (e.g., rule 4) are ignored.

---

Scenario 2: Importance of Rule Positioning

• Incorrect Rule Order:

  • D TCP
  • A HTTP 80

• Incoming packet: HTTP 80

  • The packet is dropped by the first rule (D TCP) without checking subsequent rules.

• Correct Rule Order:

  • A HTTP 80
  • D TCP
  • The packet is allowed as the first rule matches.

---

Scenario 3: Default Policy Behavior

• If no rules are matched or no rules are written in a chain:
  • The chain’s default policy (Accept or Drop) is applied.

---