[Day 6] 3. iptables LAB

Goal

Set up a Stateful Packet Inspection (SPI) Firewall that:

Allows all outgoing connections.
Blocks all unwanted incoming connections.

Scenario Overview

Two machines:
- VM1: 192.168.80.130
- VM2: 192.168.80.131
Both machines have ports 22 (SSH) and 80 (HTTP) open.
Tasks:
1. Connect to port 22 and port 80 of the same machine.
2. Connect between VM1 and VM2 for both ports.
3. After firewall configuration:
  - VM1 should allow all outgoing traffic.
  - VM2 should be blocked from accessing ports 22 of VM1.

HTTP Setup

Install required packages on both machines:

bash
sudo apt-get install apache2 links

```
links
```
: HTTP client for testing.
```
links
```
is similar to
```
curl
```

Test HTTP connection:

bash
links http://<IP-address>

Displays the
```
index.html
```
file hosted by Apache.
Press
```
Q
```
to exit.

iptables Basics

Check if

iptables

is installed:

bash
sudo which iptables

Install

iptables

if needed:

bash
sudo apt-get install iptables

View current rules:

bash
sudo iptables -L

Change default policies:

bash
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

```
INPUT DROP
```
: Blocks all incoming traffic by default.
```
FORWARD DROP
```
: Blocks packets not originating from or destined for the machine.
```
OUTPUT ACCEPT
```
: Allows all outgoing traffic.

Allowing Loopback Traffic

Enable loopback (local traffic) to avoid self-blocking:

bash
sudo iptables -A INPUT -i lo -j ACCEPT

```
-A
```
: stands for appending the rule.
```
-i lo
```
: Specifies the loopback interface.
```
-j ACCEPT
```
: Allows the traffic.

Stateful Packet Inspection (SPI)

To establish a TCP connection, a 3-way handshake is performed:
Client → SYN → Server → SYN-ACK → Client → ACK → Server

SYN packets: Have a state NEW.
SYN-ACK and ACK packets: Have a state ESTABLISHED.

When trying SSH from Machine 1 to Machine 2, the command

sudo iptables -P INPUT DROP

blocks the SYN-ACK packet (state: ESTABLISHED) from being received, even though the SYN packet is sent. To enable SSH, we need to allow packets with the ESTABLISHED state.

To allow responses to outgoing connections (e.g., SYN-ACK):

bash
sudo iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

```
-m state
```
: Loads the state module.
```
--state ESTABLISHED
```
: Allows incoming packets part of an already established connection.

Allowing SSH Traffic

To allow SSH (port 22) from all machines:

bash
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

```
--dport 22
```
: Specifies destination port 22.

To allow SSH access to a specific machine:

bash
sudo iptables -A INPUT -s <source-IP> -p tcp --dport 22 -j ACCEPT

Example for the base machine (192.168.80.1):

bash
sudo iptables -A INPUT -s 192.168.80.1 -p tcp --dport 22 -j ACCEPT

Automating iptables Rules

Manually writing rules is tedious. Use a script to automate it:

Create a script:
```
bash
vim fw.sh
```

Script content:

bash
#!/bin/bash

# Flush current rules
iptables -F

# Default policies
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

# Allow loopback traffic
iptables -A INPUT -i lo -j ACCEPT

# Allow responses to established connections
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

# Allow SSH traffic only from base machine
iptables -A INPUT -s 192.168.80.1 -p tcp --dport 22 -j ACCEPT

# Display current rules
iptables -L -v

Save and run the script:

bash
sudo chmod u+x fw.sh
sudo ./fw.sh

Persistent Rules

Rules vanish after a reboot unless made persistent.

Save current rules:

bash
sudo mkdir -p /etc/iptables
sudo sh -c "iptables-save > /etc/iptables/rules.v4"

Install

iptables-persistent

bash
sudo apt-get install iptables-persistent

Choose Yes for both IPv4 and IPv6.

!3. iptables-save-configuration.png

Additional Commands

View rules with line numbers:

bash
sudo iptables -L --line-numbers

Delete a specific rule:

bash
sudo iptables -D INPUT <line-number>