IP tables and Filtering
Download as PPTX, PDF•9 likes•7,472 views
The document discusses Internet protocols and IPTables filtering. It provides an overview of Internet protocols, IP addressing, firewall utilities, and the different types of IPTables - Filter, NAT, and Mangle tables. The Filter table is used for filtering packets. The NAT table is used for network address translation. The Mangle table is used for specialized packet alterations. IPTables works by defining rules within chains to allow or block network traffic based on packet criteria.
IP tables and Filtering
- 3. OUTLINE • What is Internet Protocols? • What dose these protocols do? • Firewall utilities • Before Iptables • Iptables Definition • Basic Structure of IPTable • IPTables Filtering • Rules in Chains • Targets • Types OfTables 3
- 4. What is Internet Protocol ? Internet Protocol •An Internet Protocol is a set of rules that governs the communications between computers on a network. •A set of guidelines for implementing networking communications between computers. 4
- 5. What Dose these Internet Protocol Do ? • An internet protocol sometimes referred to as an access method, is used to define a method of exchanging data over a computer network, such as local area network, Internet, Intranet, etc • These protocols are formal standards, policies and formulation of rules, procedures and formats that define communication between two or more devices over a network. Internet protocols are used to govern the end-to- end processes of timely, secure and managed data or network communication. 5
- 6. What is IP Addressing ? • An Internet Protocol address (IP address) is a numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication. • An IP address is an address used in order to uniquely identify a device on a network.The address is made up of 32 binary bits, which can be divisible into a network portion and host portion with the help of a subnet mask. • A subnetwork or subnet is a logical subdivision of an network.The practice of dividing a network into two or more networks is called subnetting. For more detail s read the notes given below. 6
- 7. Firewall Utilities • A firewall is a software utility or hardware device that acts as a filter for data entering or leaving a network or computer.You could think of a firewall as a security guard that decides who enters or exits a building. A firewall works by blocking or restricting network ports. Firewalls are commonly used to help prevent unauthorized access to both company and home networks. •A firewall utility is a program or device that acts as a barrier to keep destructive elements out of a network or specific computer. •A firewall controls network traffic to and from a computer, permitting or denying communications based on a security policy. For more details check the link given below 7
- 8. Levels Of implementation SOFTWARE FIREWALLS • Software firewalls are designed to protect a computer by blocking certain programs from sending and receiving information from a local network or the Internet. HARDWARE FIREWALLS • Hardware firewalls are found on most network routers and can be configured through the router setup screen. Firewall hardware or device (ZyXEL Zywall), is a Unified Security Gateway with a firewall and other security features. 8
- 9. IP Tables with FILTERING Mechanism 9
- 10. BEFORE IPTABLES • Before Iptables the most popular firewall / NAT package running on Linux was ipchains. It had a number of limitations, the primary one being that it ran as a separate program and not as part of the kernel. The Netfilter organization decided to create a new product called iptables in order to rectify this shortcoming. As a result of this, iptables is considered a faster and more secure alternative. IPtables has now become the default firewall package installed under RedHat and Fedora Linux. 10
- 11. IPTABLES • The basic firewall software used in Linux is called iptables . • IPtables is a command-line firewall utility that uses policy chains to allow or block traffic.When a connection tries to establish itself on your system, iptables looks for a rule in its list to match it . If it doesn’t find one, it resorts to the default action. • We can call, it’s the basics of Firewall for Linux. Iptables is a rule based firewall system and it is normally pre-installed firewall which is controlling the incoming and outgoing packets. By-default the iptables is running without any rules, we can create, add, edit rules into it. • The Linux kernel has the built-in ability to filter packets, allowing some of them into the system while stopping others. 11
- 12. BASIC STRUCTURE OF IPTABLE • The default structure of iptables is like: “Tables which has Chains and the Chains which contains Rules” • Tables —> Chains —> Rules. • The rules are defined to control the packets for Input/output. 12
- 13. IPTable Filtering • The kernel will inspect data packets and decide based on these rules what to do with each packet. • IP filtering is simply a mechanism that decides which types of IP datagram will be processed normally and which will be discarded. By discarded we mean that the datagram is deleted and completely ignored, as if it had never been received. • The main difference between packet forwarding and packet filtering is: Packet forwarding uses only a routing table to make decisions, packet filtering uses a list of rules for filtering. • The Linux kernel has the built-in ability to filter packets, allowing some of them to be received by or pass through the system while stopping. 13
- 14. Types of rules in chains There are five types of rules implemented in all types of IP table chains: • Input: The input chain is used for any packet coming into the system. Input Chain is for managing packets input to the server and Used by mangle and filter tables. • Output: The output chain is for any packet leaving the system and it is Used by Mangle, NAT and Filter tables. • Forward: The forward chain is for packets that are forwarded (routed) through the system and used by Mangle and Filter tables. • Prerouting: Prerouting allows altering of packets before they reach the input chain and used by Mangle and NAT tables. • Postrouting: Postrouting allows altering packets after they exit the output chain and used by Mangle and NAT tables. For more detail read notes given below 14
- 15. Targets • Every iptables rules have some "target" which is executed when it is matched against a "criteria". Following are the most common targets: • ACCEPT: Packet is accepted and goes to the application for processing. • DROP: Packet is dropped. No information regarding the drop is sent to the sender. • REJECT: Packet is dropped and information (error) message is sent to the sender. • LOG: Packet details are sent to for logging. • DNAT: Rewrites the destination IP of the packet • SNAT: Rewrites the source IP of the packet 16
- 16. Types of IP tables use in Filtering • The three built-in tables with chains of rules. They are as follows: • Filter :The default table for handling network packets. • NAT : Used to alter packets that create a new connection. • Mangle : Used for specific types of packet alteration. 16
- 17. GraphicalView of IP tables, Chains and Rules 17
- 18. FilterTable • Filter is default table for iptables. So, if we don’t define our own table this table will created by default. • The filter table is mainly used for filtering packets.We can match packets and filter them in whatever way we want.This is the place that we actually take action against packets and look at what they contain and DROP or /ACCEPT them, depending on their content. • The built-in chains for the filter table are as follows: •INPUT — Applies to network packets that are targeted for the server. Input Chain is for managing packets input to the server. •Here we can add rules to control input connections from client to the server. •It means reply of a http request made by your browser will go through INPUT chain. •OUTPUT — Applies to locally-generated network packets. •Outgoing from firewall. For packets generated locally and going out of the local server. •FORWARD — Applies to network packets routed through the host. Packet for another NIC on the local server. For packets routed through the server. 18
- 20. NATTable • Network address translation (NAT) is a methodology of modifying network address information in Internet Protocol (IP) datagram packet headers. So these tables are used for Network AddressTranslation. • A NAT is a technique that change the source and/or target ip-address in packets. It is typically used to connect multiple computers in a private address range with the (public) internet. • This table should only be used for NAT (Network AddressTranslation) on different packets. In simple words, it should only be used to translate the packet's source field or destination field. • The built-in chains for the NAT table are as follows: •PREROUTING — As the name indicates its translate packets before routing.Alters network packets when they arrive. •OUTPUT — Alters network packets before they are sent out. •POSTROUTING — Alters network packets before leave. 20
- 21. NAT table Processing Flow 21
- 22. MangleTable • Mangling refers to modifying the IP Packet.Any sort of modification in the packet can be called Mangling. • Mangle is used for specialized packet alterations and used for packet alternation. • The built-in chains for the mangle table are as follows: •INPUT — Alters network packets targeted for the host. •OUTPUT — Alters locally-generated network packets before they are sent out. •FORWARD — Alters network packets routed through the host. •PREROUTING — Alters incoming network packets before they are routed. •POSTROUTING — Alters network packets before they are sent out. 22
- 23. 23
Editor's Notes
- #4: This era is said to be the era of computers. Computers have significantly changed the way we live. A computing device when connected to other computing device(s) enables us to share data and information at lightning fast speed. There are hundred n thousands of mechanism for connecting a computer to another computer, a network to another network and at the end of the edge it forms a world wide network known as Internet.
- #7: Additional Information: If definitions are helpful to you, use these vocabulary terms in order to get you started: Address - The unique number ID assigned to one host or interface in a network. Subnet - A portion of a network that shares a particular subnet address. Subnet mask - A 32-bit combination used to describe which portion of an address refers to the subnet and which part refers to the host. Interface - A network connection. The 32 binary bits are broken into four octets (1 octet = 8 bits). Each octet is converted to decimal and separated by a period (dot). For this reason, an IP address is said to be expressed in dotted decimal format (for example, 172.16.81.100). The value in each octet ranges from 0 to 255 decimal, or 00000000 - 11111111 binary. The right most bit, or least significant bit, of an octet holds a value of 20. The bit just to the left of that holds a value of 21. This continues until the left-most bit, or most significant bit, which holds a value of 27. Subnet: A smaller network created by dividing a larger network into equal parts. Subnet Mask: A 32-bit number used to distinguish the network and host portions of an IP address. It divides the IP address into network address and host address.
- #8: For more detail: http://www.pctools.com/security-news/what-does-a-firewall-do/
- #12: The basic firewall software most commonly used in Linux is called iptables . The iptables firewall works by interacting with the packet filtering hooks in the Linux kernel's networking stack. These kernel hooks are known as the netfilter framework. Netfilter is a utility in Linux 2.4 (and later releases) that facilitates Network Address Translation (NAT), packet filtering, and packet mangling. NAT is the process of converting an Internet protocol (IP) address into another IP address. Netfilter Hooks There are five netfilter hooks that programs can register with. As packets progress through the stack, they will trigger the kernel modules that have registered with these hooks. The hooks that a packet will trigger depends on whether the packet is incoming or outgoing, the packet's destination, and whether the packet was dropped or rejected at a previous point. The following hooks represent various well-defined points in the networking stack: NF_IP_PRE_ROUTING: This hook will be triggered by any incoming traffic very soon after entering the network stack. This hook is processed before any routing decisions have been made regarding where to send the packet. NF_IP_LOCAL_IN: This hook is triggered after an incoming packet has been routed if the packet is destined for the local system. NF_IP_FORWARD: This hook is triggered after an incoming packet has been routed if the packet is to be forwarded to another host. NF_IP_LOCAL_OUT: This hook is triggered by any locally created outbound traffic as soon it hits the network stack. NF_IP_POST_ROUTING: This hook is triggered by any outgoing or forwarded traffic after routing has taken place and just before being put out on the wire. Kernel modules that wish to register at these hooks must provide a priority number to help determine the order in which they will be called when the hook is triggered. This provides the means for multiple modules (or multiple instances of the same module) to be connected to each of the hooks with deterministic ordering. Each module will be called in turn and will return a decision to the netfilter framework after processing that indicates what should be done with the packet.
- #15: Input – This chain is used to control the behaviour for incoming connections. For example, if a user attempts to SSH into your PC/server, iptables will attempt to match the IP address and port to a rule in the input chain. Forward – This chain is used for incoming connections that aren’t actually being delivered locally. Think of a router – data is always being sent to it but rarely actually destined for the router itself; the data is just forwarded to its target. Unless you’re doing some kind of routing, NATing, or something else on your system that requires forwarding, you won’t even use this chain. Output – This chain is used for outgoing connections. For example, if you try to ping howtogeek.com, iptables will check its output chain to see what the rules are regarding ping and howtogeek.com before making a decision to allow or deny the connection attempt. http://blog.adityapatawari.com/2011/12/ip-packet-filtering-iptables-explained.html