Hello and welcome to the lecture introduction to Firewalled when you need to secure your system, firewalls
should be the number one things to be discussed as well.
So let's start with what exactly the firewall is a firewall as what it reads.
It's it's actually like a wall that prevents the spread of fire.
So anything that you put it up, that's not going to let the fire in, that's actually the firewall.
That's how they got there.
This name, when data moves in and out of a server, it's packet information is tested against the firewall
rules.
And that firewall rules is actually something that reside on the firewall.
So when that is tested against the firewall rules to see if it should be allowed or not, in my words,
the way I want to describe it is that a firewall is like a watch man or a bouncer or a shield that has
a set of rules given and based on the rules, they decide who can enter and who could leave.
There are two types of firewalls in it.
The first one is the software firewall, which is actually the firewall that runs on an operating system.
So you have a firewall that runs on Linux, that you probably have a firewall that runs on Windows or
any operating system.
It has a little software that is called firewall.
Another type of firewall is a hardware firewall.
Now, that firewall is is actually a dedicated appliance, like a hardware appliance with, of course,
the firewall software running on it.
Now, that type of appliance more often found on the network side, the network team or the one who
actually maintains that type of firewall.
But anyway, our focus is what our focus is, the software side of the firewall, which actually runs
on operating system.
All right.
So let me put an in a picture so it will be easier to understand.
So we have a server, a set simply wants to go to Sarabi.
Now, when it goes to server B, it sends some kind of protocol or a connection request.
And in this case, let's say the server wants to connect us rahbi with through Secich and pour 22.
But when there is a firewall in the middle, it will check its rule and it will say, hey, let me check
the rule.
If server is allowed to come in on board 22 and that a rule says, yes, this work can come in, then
everybody says, OK, I have made that clear and connection is established.
And another example would be another server wants to go to server B and they want to connect to server
B to FTP and FTP, as we all know, runs on for twenty one.
Now before it goes to an established connection to server B, it goes to the firewall and firewall rules,
stays on server B that A server is not allowed to come in using protocol or service ftp.
Then what happened is services.
Sorry dude, I cannot let you come in because my firewall rules says that you are not allowed to enter
into my operating system through FTP service.
Now you may see this firewall sitting in the middle and you're probably thinking where exactly sitting.
But in reality this firewall is sitting on server A as well as there's another firewall is also sitting
on server B, so both servers A and B do have firewalls as well.
Server A who wants to connect to Server B could also have a rule whether this service is even allowed
to leave the server or not.
And then when it goes to server B, the server B has its own firewall, which would say, hey, even
though it came in.
But let me see if this service is allowed to be accepted to serve to to my server.
So that's how the firewall works.
Hello again and welcome to the lecture of Firewall and more specifically, IP tables, there are two
tools to manage firewall in most of the Linux distributions.
One is the IP tables, and that is mostly use in all the Linux distributions and the other one is firewalled,
which has been introduced not long ago to the newer versions of RedHat Centaurs or Fedora and maybe
some mandolinist distribution as well.
But as I said again, still most of the most of the most of the tool, the firewall tool is IP tables
is used in all of the Linux distributions.
Now, you could run one or the other, so you cannot run both tools at the same time.
So in this lecture, we will work with IP tables to manage the firewall.
It doesn't mean that I will not cover firewall.
The I will cover firewall the in the later lectures before working with IP tables.
Make sure firewall is not running and it is disabled.
To stop the servers, you have to do systems, stop firewall or service command if you're using the
older version of RedHat or or Linux S.O.S.
But of course if you're using the older version, the most likely you don't have liability in it anyway
to disable it.
You run system ctrl disable firewall D and to Mascotte you run system ctl mass firewall d you would
need Maxo.
Other programs cannot run that or you don't start that service by accident.
That's why you mask a service.
Now check if you have IP table service package install.
Nice because you before you start the service, whatever says hey what service you're trying to install.
So you need to make sure you have the service install and to check if that service has that package
installed to you will do R.P.M. Dash keyway and for IP tables, dash services.
And if it's not there you will use the utility to install IP table services.
Once you have it installed, you'll start the service by the start IP tables command and then you enable
it to check IP table rules.
You'll do IP tables, dash Stachel and to flush the IP tables, you do IP tables, dash f meaning if
you wanted to start from clean from scratch, you don't want a predefined rules in the IP table.
You do IP tables that you have to flush it.
Now let me go into my Linux machine right here and we'll try all the things that we have coord right
here.
So first thing first is we need to start IP tables but do we really have IP tables.
First check our RPM has keyway IP tables, dash services.
No, we don't, but of course, before we install it or download it, let me first stop the firewall.
So to check if firewall is running because our focus is on the IP tables.
You do status firewall D?
Yes.
You see, it is active and it is running.
So let me go ahead and stop that service first before I even work on IP tables.
It is stop.
Now, go ahead and disable it so it won't start at reboot.
OK, now go ahead and mask it so you don't start it by accident.
Now go ahead and check the status and you will see right here loaded mask and current status inactive
and is dead.
Beautiful.
OK, we're following are our instructions along and now we our next step is to install the IP table.
Remember, we checked it is not installed.
So the comment is yum.
Install IP tables, dash services.
Now make sure if you want to install it, your machine can go out on the Internet and go to the repos
that needs or that has the IP table service package.
It found it and it tells you the size not go ahead.
And yes, I'm sure you're familiar with the young utility and now you could go ahead and install it
again.
Once it is installed, you will see a complete message installed message.
It is there.
Now, go ahead and start the service.
System CTL start IP tables, it has started and I'll go ahead and nable it.
It is enabled now go ahead and check the status if it is up without any error messages.
Yes, you see, it is stays active status with the process ID awesome.
Now, the next step is that you want to check what inside of the IP tables that come out of the box.
Which is IP tables, dash uppercase L and by default, it has few rules already in place to allow a
except and also ICMP to the host that is prohibited and some of the rules in there, we wanted to start
from scratch.
So I want you to flush everything out by typing IP tables.
If it is flush, let's verify everything is gone.
And if you run it, you can see actually these three different chains.
One chain says input.
The other sees change away and that their chances output now, what is a change or what is this whole
thing and what is each column means?
Don't worry, I am going to cover that next.
The function of i.p table tool is packet filtering, the packet filtering mechanisms organized into
three different kind of structure and the structure is table, which I just showed you.
It has changed and it has targets.
Now, what are those?
Let's get into the details.
Tables table is something that allows you to process packets in specific ways.
There are four different types of tables.
Filter, mangle that and raw.
Now I have bolded the filter and then the line that one, because our primary focus here is filter and
that's the one that is mostly used in the Linux operating system.
So each table has chains attached to it.
These chains allow you to inspect traffic at various points.
There are three main chains using IP tables.
One is input that is a rule associated to it that says income for incoming traffic forward going to
a router and then from one device to another, which is rarely used again.
And the third one output is outgoing traffic.
So focus on these two input and output, meaning incoming traffic and outgoing traffic.
Now, all these three chains that you see has a rules associated with it.
Change allow you to filter traffic by adding rules to them.
And the rule example is if a traffic is coming from this IP, then go ahead and define the target now.
OK, I have a table, I have a chain, and these three chains are there and chain have a rules.
Define now what happens when the rule is met that I did find that IP address coming in.
Now what do you want me to do with that IP address?
Then you come in and define the target and there are three different type of targets.
One is except of course to accept the connection if the rule matches.
Second is reject meaning, don't accept it.
But do send a response that, hey, I'm rejecting it, I'm not accepting your request.
Maybe some of the responses, some meaningful information.
But anyway, the third one is drop, which is meaning like a harsh drop.
I don't want to tell you why I'm not accepting it.
Just you are not allowed at all.
These three are the simple targets.
So, again, to recap, IP tables has tables.
It has changed.
Each chain has input forward in an output and then based on those rules, define into those chains.
They are targets.
And those three targets are accept, reject and draw.
If you still having a problem understanding it, let me draw it out for you.
That table looks like this, but of course it's not exactly look like this.
But I'm just I just put in a graphical way.
This is a table.
The table has what chains and those three chains are and put forward an output.
And all these chains have rules associated with it.
Meaning if the IP addresses this or is this and so on, then what do you want to do then?
I want you to accept it.
No, drop it.
No, I reject it.
Whatever the target is, you will define at the target level.
Now you will run EPEAT Table Zakhele to actually see the table and to run that and you see the table
which is like this, as I have seen showed you a few minutes ago.
As you see this, there are three channels yet you could see chain input change forward and chain output.
This whole thing is called a chain.
Now each chain has and put forward an output, then it has a target.
We all know up until now, I'm sure you are you have explored in this, you know, all these strengths.
Now, let's get into a little more detail, which is on the rule level.
This field that you see see here, it means the protocol such as TCP, UDP, ICMP or all any type of
protocol that you want to define, it will be defined right under it then optional.
This is rarely used as Clallam indicates IP options source meaning which IP is it coming from and then
destination.
Where is it going to?
So when you see a rule right underneath of this, you could easily translate it.
Oh, OK.
This is the meaning of this rule, meaning this protocol coming from this source and going to this destination.
And the target is.
Drop it, and that is for incoming a chain or incoming traffic, because it is associated with chain
input.
So anyway, guys, this is all about this whole lecture I covered is so explain to you how you could
download, install the IP tables, how you could run it, and what does IP table dash output looks like.
So you need to understand before you even do the administration on the IP tables, which we will cover
in the next lecture, to do certain practice, to run certain commands.
So stay tuned.
OK, so now it's time to work on firewalled specifically the tool firewall, the firewall, the works
the same way as IP tableware.
Of course, it has its own commands and the command that it starts with its firewall dash ACMD.
Make sure the command firewall, the first part of the first word does not have D in it.
So it's just Firewall Dash ACMD.
It has a few predefined servers rules that are very easy to turn on and off.
And those services such as Nafez and DPD, they are already there in an XML format.
All you have to do is add those services into the firewall D table and the rules will cover that in
the later lecture, of course, and I'll show you how exactly the exemplified works then.
The firewall also has the following table.
Chains, rules and targets.
Set table change rules, targets.
You guys already know Table is the one that has all the information about change rules and target chains,
or the ones that has outgoing, incoming or forward traffic information.
And the rules are associated to those chains.
Like if incoming traffic is matches or does match this rule, then what to do?
Then comes the target.
That target would be either drop, reject or accept the traffic.
So again, as I said, it works similarly as IP tables.
And if you need to refresh all these different table change rules and target information, you could
go back to IP tables to find more information about them.
OK, so you can run one or the other, meaning either IP tables or firewalled.
It is not recommended to run a both.
At the same time, make sure IP tables is stop, disable and mask before you start firewalled.
And of course to stop it, you would use system ctrl stop IP tables, then a system set to disable it
so it won't start at Bhoot and to mask it.
So you won't start it accidentally or any other programs on started then after it is stopped.
Now you need to check whether firewall servers that you're trying to start has the package or requite
package installed in your system.
But as I said, if you're using Centaurus seven, RedHat seven or four, fedora seven and above, by
default it would have a firewall D installed.
By the way, I just checked in the third line you see a file, Waldy.
It's just a mistake instead of l I should have or anyway, it's just a little honest mistake then to
check if the package is installed.
You run R.P.M. Dash keyway and for firewalled.
If you don't find it then you will run Jum Command to install firewall D and once it is installed you
will start the firewall D by using the command system ctrl start.
And then firewalled, the next comment would be system enabled, firewalled, you cannot run all that
in one comment, I just put it in one to save some space, then to check the rule of firewalled what's
inside and what is defined.
You will run firewall, dash, cmd, dash, dash, list, a dash all.
It will tell you what services are enabled, what rules are in place, what type of chains in place
getting the list of all the services firewalled is aware of.
That's the services I talk to you about in the previous slide, that there are services predefined by
Firewall D and they are written in XML format and you could simply add those services and remove it
in one single command and to get the listing of all the services you run the firewall command.
So firewall that command, get services to make firewalled, reload the configuration, add edit meaning
if you added a rule in firewalled you will always have to run the command firewall ACMD, dash, dash,
reload.
So your firewalled process would know about the new rule or new information that you added into the
table.
All right.
So now I'm going to go into the Linux machine and we'll try all of that.
So first thing first is first make sure the IP table is not running system CTL status, IP tables and
you see it as running.
It is active right now, so you will have to stop it up.
Hit up Arrow Key and.
Replace status with stop.
It has stopped now disable it.
So it does not start at budget time and then mask it so you don't or any other program started by mistake,
you could check the status again.
And you'll see right now it is masked and it is inactive.
Perfect.
Now it's time to check if we have firewalled package installed so R.P.M. Desh Kuai and Great for Firewall.
OK, so it does have this is a package we're concerned about, make sure this package is there and if
there are more firewalled the system system level, you could also install that.
But most likely it will get installed with it if you just type JUM install firewall.
OK, so now it is installed.
Now the next step is to start that firewall.
System CTL Start.
Firewall.
It says the unit is Mascotte, which means it is not allowed to start by mistake or by any other program,
so we have to unmask it.
So unmask.
All right.
It is unmasked now.
You could go ahead and started it.
It started perfect.
Now go ahead and able it.
So it starts at boot time.
OK, now go ahead and check the status now.
OK, it is running, it is the current status is active.
Nice, clear the screen and now I am going to check what's inside of my firewall rules, what comes
out of the box.
And for that I will do Dashty List, dash all and you will see this is the table.
It's a public table.
It's active and it has the service by default, S.H., DCPI, the six Clide.
These two services are already enabled that firewall the services every time I start up and by default
SSA is allowed to come in.
And if you see, you could define Boadicea.
Any specific rules that you have, you could you could put them in their rituals, which will cover
in the later lecture.
If you add something, you could run the command firewall dash ACMD, followed by the correct syntax
to add a service support to get the listing of all the services that Firewall D is aware of.
You will type firewall cmd get.
Services.
OK, so these are the list of services I was talking to you guys earlier.
These are the predefine services and all of them are separated by space and they are written in alphabetical
order.
So A, B, C, and if you are looking for, let's say, S.H., you'll see in essence an S section.
And I see a cessations here, some type services here.
If you're looking for FTP, you go into F Section F as this is F and you see FTP.
So all these services are actually predefined in there.
Doesn't mean that it is already part of the firewall rules that it will allow all these services by
default to be enabled.
It's not that it's it's telling firewalled, hey, you had the service.
All you have to do is run a command.
Tell me this is a service you want to enable and I'll go to its configuration file.
I'll find out what port it runs on and I'll enable it for you.
So I'll cover that XML file in the later lectures.
So for now, just make sure you start your family.
It's up and running and it has the services listed as right here to predefine two of the services.
Let's get into some practical examples on firewalled the firewall, these had multiple zones to get
a list of all zones, you have to run the command firewall, dash, cmd, dash, dash, get zone.
So let's go into the Linux machine and we'll run it here and we'll see how many zones and the listing
of zones that we could get to type firewall.
Kamdesh Desh.
Zones and you will see it will give you the list of zones, Block DMC, drop external home and internal
public trusted work, you could use any zone that is required by your company or your policies.
Most of the time that I've seen is the public is disowned.
That is used most of the time.
So our focus on this lecture will remain on public.
So that's how you get the listing of zones to get a list of active zone now to see we have all those
zones in which one is the active one and for that will run the Command Firewall ACMD and get Dasch active
dash zones.
This is listing that zone that is active and that is active in terms of in firewall where firewall is
getting all its rules.
Configuration is public and the interface that is attached to that zone is our default interface.
You might have a different one if you're using a different type of Linux where the physical virtual
the next one we will talk about is how to get firewall rules for public zone.
So now you know that we we are the public is the zone that is active.
Now how to get a list of that zone.
You can run a command firewall that seemed to zone equal public dash that list zone.
But if you notice when you ran the command get active zones, it only gave us the public zone.
So when you only have one zone active, then you really don't have to specify the zone name.
But just to to practice, if let's suppose you had multiple zone, then you would have to specify zone.
You go public.
So let's see.
In that case we'll do.
Why are welcomed Dashty Zone equal?
Public and list all.
This is the zone which has by default out of the box, if you are running your firewalled for the first
time, this is what you're going to see and you will see the main thing that you're going to see is
this zone is public and it's active.
And the services that as default service that you get is S.H., DCPI six and Kline.
These are the services that are enabled by default.
Again, what I meant was if you're public zone is already active and it's the only one that you don't
have to specify, you could just simply run the command without specifying the zone and get the same
result.
Now, you could also, as I said, you could do without Zone as well.
So all services are predefined by a firewall.
As explained previously, you have a list of all the services.
Now, the question is, I do have the list of all the services I could go in and enable and disabled
and turn it on.
But what if I want to add a third party service in this case?
We'll take an example.
Let's say if you want if you install SFP application in your Linux server and you want to allow that
application to be on and off, then you have to go into usr lib firewall disservices and all those services
that are predefined are in that directory.
And all you have to do is simply copy any dot XML file and change the service and its port number.
Now when you open that file, that XML file, this is how it's going to look like.
By the way, this is a smaller version.
There are many files, XML files in that directory that have a longer description.
So the shorter descriptions are test.
I am showing you is when you katab file any of the fall in that directory that ends with XML, you'll
see its version on the first and the second.
You'll see that service and type information about the service and you'll see that the service, what
type of service it's that you'll see is S.H. and what description that you want to put it, what exactly
this service will do.
And of course, the port information and the service and name, which is in this one as TCP and the
port number is 22.
This is how it looks like.
But in the next slide, we are going to make a customized service, which I just mentioned, SJP, that
XML and I will show you how you could make it firewall the Awaya.
So let's go into the next slide and let's see if you wanted to add a service.
Let's say HTP in your firewall.
For that you have to run the command firewall ACMD dash dash add dash service equal HTP.
So right now when you run this command you'll see there is no HTP service in services.
So if you have Firefox and you could open it up and you could try to access your HTTP service, you
will see that it will not be accessible.
But of course, in order to check that first, you need to make sure your DPD service is running.
So let's see system CTL status HTP.
OK, it says this mask is inactive, so we have to activate it in order to test our firewall rules when
we add them in.
So we will do is first of all, on Mascotte.
Then I will start a service.
Services started, let's check the status, it is active now, I will go ahead and open my browser to
make sure I could access my party server using EDP protocol or service.
So my.
OK, so now my IP address of my machine, the links that I'm using is one eight one sixty one point
sixty two.
So when I reload, you will see it is saying problem loading page and it is spinning.
It means it will connection will say it has timed out as you see it is taking too long.
This is the message you will get.
So in order to you're in order to get to your server through that HTP service, you have to enable it.
So let's go to.
Our.
Firewalled and let's add that, so let's clear the screen firewall, the ACMD dash dash ad, what service
you want to add HTP?
OK, that service is added, and when you do list again.
You will see in the service section.
There is this last word has been added now let's go ahead and verify it by going into our Firefox's
machine and then refresh the screen and you got the splash page as meaning we could get into our splash
page and it works perfectly fine.
Good.
Now, one more thing is, if you want to remove that, you could simply hit a pearl key or go back to
the same command and type remove and it will remove it.
You could check the status, whether it's gone or not, by looking at your list all and you'll see it
is gone now.
So that's what to remove the service is about then to reload the firewall configuration, meaning let's
say if you added some service and now you just want to clear the entire firewall configuration, whatever
that you added.
And for that you have to type firewalled reload.
So before I do that, I'll show you first when we added.
That HP services added.
Now, if you do list, you'll see it is there, but now when you go in and reload.
Reload and check.
That firewall, you'll see that HTP service, every edit it's guards is kind of like a way of firewall
to flush whatever the temporary rules are in there.
So if you want to add any rule permanently, you have to specify permanent in the end.
So to add or remove a service permanently, you will run the command firewall that seemed to add to
service to equal permanent and that will add it permanently to that zone, which is the public.
So of course, to remove it permanently.
You were on the same command with Romo and Dash Dash permanent option.
Now let's talk about the third party application we talked about in the last slide.
What if there are there are services that you wanted to add?
It's not.
Is it it didn't come predefine or as a default service in firewalled.
So what we have to do is first thing is you have to go into this directory whose have been firewalled
services.
You could just simply copy any dot XML file and make the name of that new service file and change the
service import number inside of that file.
Then you have to restart the firewalled and then simply add a firewall up and then simply get the get
the listing of those services to confirm, to verify that service is there.
And if it's there, it's working, then you can run the firewall command to add that service.
So we'll go we will go through that exercise now and let's see.
And as I said, we'll use this as an example.
We use the service SFP, an ISP, I believe, runs on Port 32.
So I'll go into usr lib firewall D services.
And by the way, if you're doing that for the first time, I recommend you do take a snapshot of your
virtual machine in case things go wrong.
OK, now in the services there are a bunch of services.
If you run out as mysel, you'll see all those services that you get when you run, the command will
command, you run firewall dash.
Seemed dash get services, all these services that you see are actually firewalled is pulling them from
these files.
Now, again, we want to address SFP.
I'm going to go ahead and take any fall or in this case, I'm going to do copy S.H. XML file and I'm
going to copy it to SFP, ExxonMobil, OK, verified it's there.
I'm going to do this myself.
TIAR, it's there all the way to the end.
Now I will go ahead and modify that file via Skype XML.
And you see, it has that version service, the short description is Sustagen, I'll remove it to SFP.
OK, now this is a description of everything that is listed for SNH service description, and I will
put that third party description, whatever this service will do.
This is, uh, third party.
Application service.
OK, good.
Now the protocol is TCP or whatever that you want to specify and you could use the port to.
So, of course, you need to know these things, whether it's a TCP, UDP or port, no, it is what's
service.
Now, you could go ahead and save that file.
Father say we could verify ASSP Zemel and you see it is there with all the searching that you have specified.
Now if you want to see that SFP in your listing, meaning when you run this command and you want to
see it there, then you will have to restart the firewall, the whole system.
Ctrl restart firewall.
It is restarted now when you're going to run that get services, you should be able to see your SJP
service.
So, um, the ME what I will do is I will firewalled ACMD get services.
I'll just simply do crêpe.
ASSP.
And there you go, so see it highlighted for us, it's easier for us to know where exactly it ended.
So now this SFP service is in there.
Nice.
Now we could go ahead and add it as a service to the firewall configuration.
So to add it simply firewall.
Akhmed.
Add dash.
Service equal the name of the service you add added, and when you do list.
You will see it added that SFP service.
Now, if you're trying to add any other services that is not in that XML file, it will just simply
fail is not going to work.
So, for example, if I'm trying to add service, call Emraan.
It says Invalid's Service Emran, because it went into that usr lib firewall disservices directory,
it looked for the Emran that XML file, and it did and it doesn't exist.
That's why it's not able to add.
So it's a good feature of firewalled this where you could just simply have to add or remove services
that are defined in that directory.
All right.
So moving on.
By the way, let me remove Multiservice.
So this way I have everything cleaned up, or I could just simply do what, reload if I have not added
it permanently success.
Let's verify it.
It is there.
It's gone.
Good.
Moving on now.
Now, what if you want to add a port to your firewall d configuration simply you are under command,
which is firewall.
The ACMD dash dash ad dash port equal.
I picked this one one zero one one one zero as a random port.
You could pick which airport that you wanted to open and the protocol.
Enter, verify that, and you will see it is going to show up in the ports, TCAP, Tennant's added.
Now, again, if you do not specify dash permanent.
Then it will go away that moment you do firewall, smd, dash, dash, reload.
OK, so that's how you add a port and of course, to remove a port, you would do remove port.
So let's go ahead and remove port.
At port, I will do remove.
Port.
Zero Dash Tsipi.
It is gone, let's verify it, and it's no longer there.
Beautiful.
OK, now to reject incoming traffic from an IP address.
So again, it is kind of a scenario where you have someone coming in to your machine with an IP address
and you don't like that person or you don't like that machine.
Whatever the reason, you just want to block any traffic coming in from that IP address.
So you will run this as a rule.
It's it's a long rule, but it is added in the rich, a rule space all the way at the bottom.
So let's go into a rule.
You see, when you run firewalls and dash dash all, you see rich rules all the way at the bottom.
This is where you have to add this rule.
So I'm going to do is I'm going to make this smaller so I could grab this up and read the whole command
that I will just make this bigger as well.
So I could be able to type everything in one line.
So firewall.
The ACMD.
Dash, dash, add you adding a rich rule, and that rule says equal, what is the rule about family
within IPV for?
And which I.P. address are you trying to block, it is a source and the address of that source, equal
code.
One 92, one 68 Dodge Dart.
Twenty five.
And then what do you want to do?
Remember the targeting that we talked about?
You want to reject?
And coat close.
It has been successful, let's verify it is there and you will see this rule is added as a rich rule
all the way at the bottom, which will reject all incoming traffic if they match this IP address.
Now to block and unblock ICMP traffic.
What if you do not want people to Penghu so you could run simply this command?
So let me go back in and let me go ahead and remove that ritual that I added.
So instead of just add, I will do remove or I could have just to firewall the ACMD reload.
Anyway, it's gone.
That's where I replied.
Yep, it's gone now.
I want to block all incoming traffic firewall.
The ACMD, I mean, all incoming pink traffic, not all traffic and dash ICMP, as you know, the pain
comes on the protocol ICMP dash block and inversion.
That is added, less verified, and you will see.
ICMP block inversion is set to yes, now if I go into my and other the machine, let's say I go into
my windows machine and I have a DOS prompt open and I try to ping my Linux machine where I have enabled
this rule, went to one one 162.
This is the IP of my machine and you'll see it, says Horst Unbreachable.
Now if I go ahead and remove that rule, meaning instead of add, I'll just to remove.
And now if I try to ping it, I should be able to ping.
That's how you block or unblock and ICMP traffic now is to move now to block outgoing traffic to a specific
Web site slash IP address.
As an example, I'm going to use that example again.
What if you want to block all the traffic that's go that goes outside to Facebook, you just don't want
your kids or whoever you're dealing with.
You just don't want that person to go outside to Facebook page or any page, for that matter.
But for that, you have to find out what is the IP address of that page.
And to find that, you have to run the command post Dashty a then that you are all to find that IP address.
I have already found that IP address and the IP address is 31, 13, 1736.
And to block that outgoing traffic, this is the command you will run.
So let's run that command.
So I have this.
Linux machine right here, and again, to find the name of the host, so to find the IP address.
Of dub, dub, dub dub, Facebook, dotcom, you will see that's the IP address is already there confirmed.
Now I need to block that firewall, but before I block there, let me ping that IP address just for
now.
Just make sure that I could go out.
Yes, I could go out, I could get a response now I'm going to go ahead and block that.
Direct.
Add a rule IPV for filter.
The output, remember, the output is that outgoing traffic is to disable to going to the source three
thirty one, thirteen seventy one and thirty six is the IP.
What do you want to do?
You want to just do the target, which is drop.
It is successful now you could go ahead and ping that IP address and you will see it would tell you
the operation is not permitted because you are not allowed to go outside.
Now, if I go ahead and reload my.
Entire firewall, the.
And now if I it.
I still cannot ping.
Let me see if I, uh, what's inside my list?
Rule it is still there.
It's not there, but I cannot ping that.
I guess I have to restart my service here.
So that would be system ctrl restart.
Firewall.
De.
Restarted the striping it and now am able to pinkert, maybe it was cached, we have to just restart
the entire world, but that's OK.
So now this is how you could block outgoing incoming traffic.
And these are a few commands that we have covered.
And this is pretty much very close to what the commands we ran in IP tables.
Hopefully this entire, uh, firewalled lecture that was split in two actually served its purpose.
And you are able to understand how firewall the works.