In this B D U, you learn how to create a simple Lennox firewall.
Our plan is to explore Lennox Firewalls U using IP tables.
You learn about IP table fundamentals. Finally,
you will create a simple host-based firewall for your e c two instance.
Okay, so what is a host based firewall?
It is a firewall that monitors traffic from a single host.
You may be more familiar with the firewall appliance,
which monitors traffic for many hosts and it is a single point of entry and exit
in your network.
We're gonna use IP tables to create our firewall IP tables as a command line
application that can manage the kernel packet filtering framework IP tables is
made up of a few components like net filter,
connection tracking and network translation. But for this video,
you only need to know about using the IP tables command. Let's get started.
Okay,
so IP tables filters packets based on a few concepts called
tables, chains, and rules and targets.
I could basically do three or four videos just on IP tables and net filter,
but just know that there are four default main tables.
There are four default tables used in IP tables.
There are filter nat mangolin raw filter's.
The only one that we're gonna use in this video,
and most of the time what you're gonna use is filter.
The other thing to think about is filter table has three default chain.
So a chain is basically like a string of rules.
When a packet is received,
IP tables finds the appropriate table in this case would be filter and then it
runs it through a chain of rules until it finds a match. If no match is found,
then it goes back to the table's default policy.
If no rule is matched, it then falls back to the default chain policy.
The filter table has to ult chains. They are input output and forward.
They do exactly what they sound,
they control the input output and forwarding packets are on your host.
For our simple host based firewall, we're gonna work with the input chain only.
We're gonna open ports for S S H and H E T P and then we'll drop everything
else. And how we drop everything else is when a rule is matched.
We basically can use a target to tell what to do with that rule.
This can either be accept, drop or reject and as you see, we'll,
we'll do a little mixture of both of accept and drop. Okay,
so I wanna show you what opt tables looks like now on our host and then we'll go
ahead and look at the,
I provided two scripts to enable and disable the firewall and then we,
we'll look at it through after we apply both of them. But before we do that,
I want to go ahead and get a little disclaimer outta the way.
Anytime that you start filtering network traffic on a host,
you run the risk of dropping your SSH connection since you're remote.
I've taken a lot of care to make sure that these scripts,
and this shouldn't happen to you, but if it does, um,
you can go ahead and go into the AWS console, go to EC two,
find the instance that we created and then you can select it and then click
up in the top actions and you could reboot your host.
Once you reboot these IP table rules will be all gone and you should be able to
SSH back into your host again.
I just wanted to say that to get that out of the way. Okay,
so to view what we have for an IP tables right now,
I'm gonna use the IP tables command.
You need pseudo when using any of the IP tables command because it requires
alphabet privileges. We're gonna do a dash l.
There's list all of our chains and rules
dash n so it doesn't try to, um,
so it doesn't try to do any resolution of addresses and ports.
And then we're gonna use the dash dash line numbers flag.
So it's easier just to follow.
Each chain will have a specific set of line numbers. Okay,
so there, there are three main chains like we talked about,
which was input output and forward.
But you can see here we have these docker chains as well.
This was created when we installed and started Docker.
And Docker handles the controlling of those.
It is safe to ignore anything in this command output that has the word docker in
it.
It is not going to affect us in the least bit when we're creating our firewall.
What we will look at right now is the first chain, which is the input chain.
You could see the default policy is except,
which means right now there's no rules. So because there's no rules,
there's nothing to match.
A packet will just automatically go to whatever the default policy of the chain
is in this case, except,
which is what we'd expect because we can SSH in it would allow any packet to
come in if, if we had something running, we're not limiting anything.
The forward chain has a, uh, default policy of drop.
And you can see here it has a whole bunch of docker commands and Ford is used
for routing packets usually internally on your host.
And so it makes sense for Docker. And if you remember,
if you viewed this back when we,
we made our connection to the Docker container running,
a lot of this has to do with the IP tables forwarding those packets to and from
Docker host and then inside the Docker network back out to our host.
Our final chain is the output chain and its default policy is accept meaning
any packets going out through our firewall, um,
throughout through IP tables and net filter. Just go ahead and let it accept it.
Okay, I'm gonna clear the screen.
Like I said earlier, I provided two files. One to enable the firewall,
one to disable the firewall and they are in our repo
section six.
And let's look at the enable firewall first.
So go ahead and open that up in your editor. Okay,
so basically it's just a bash script. There's nothing fancy, um,
going on here.
The first line of our firewall really starts at line five here and
basically this dash capital P means policy and we're saying
set the input chains default policy to drop.
So if you just ran line five all by itself right now on your host,
don't do it. But if you did, it would accidentally would drop um,
your s SSH connection because there's no rules to match in that chain.
You'd by setting the default policy to drop,
that means all these SSH packets that are,
that are going right now live as I'm connected to this host would automatically
drop because they didn't match a rule.
So thankfully what we have here is line six,
which if you notice here we're using the dash capital A for input chain
and dash capital A for IP tables command. It means appended. And remember
rules are read from top down.
So it starts at the first rule in the chain and works its way down.
And so when you append, you're just putting them in order if you will.
So we want this order. Um, and it'll make more sense when we get to line 10.
So we're appending this rule, which is using the contract module,
which is the dash M here.
Contract module is a way for IP tables to be able to track connections,
keep some state about 'em so it knows like, okay,
you initiated this connection or you accepted this connection.
So I'm going to leave that alone because obviously I assume you know what you're
doing. Uh,
CT state is basically the connection state and we want anything that's already
established or related and that's how it'll keep our connection live.
And then dash J here, this is when I talked about the targets,
that once the rule matches, what do we do with it?
Well this is that J means jump to a target and then there's the accept dropped
and reject targets. And in our case those are default ones.
In our case we're gonna use accept meaning Hey,
just go ahead and accept this packet.
No need to keep looking any further in the rules. We're all set.
We've matched Line seven is our first rule in the
chain that has to do with a device.
And you see we're doing the dash capital A for input again dash I here for
interface and we're gonna use the loopback interface. And if you recall,
the loopback interface is the local to your host.
It's the 1 27 0.0 0.1.
And we want any traffic that is coming into that.
So it's like a few videos back when we tested connecting to our
MyQ client on if you used local host, if this rule,
if the firewall was enabled and this rule was in here,
we wouldn't have been able to connect cause it would've dropped, it wouldn't,
wouldn't have matched any packets destined for that interface.
We jumped the accept target cuz we want to be able to communicate with anything
listing on our loopback address locally. Okay, so lines eight,
nine here.
These are our pinholes and this is us opening up two ports
in our firewall to allow them to come in. And you can see both a line eight,
nine, we're both a pending, doesn't matter this order on eight or nine,
you could have done 81st or 2022, it doesn't matter.
We're appending to our input chain.
The dash lowercase P is protocol and that's,
we're using the TCP protocol cause that's what s ssh and H E T P use.
And the dash dash D port is just destination port.
Where is this packet destined for? If it is destined for port 22,
go ahead and jump to the accept target.
We're okay to let that in exact case here on line nine,
the destination port is 80. Go ahead and accept it. Let it come on in.
Now here we are to line 10 and this is the catchall rule.
And basically we're saying if nothing is matched up until this point on the
input chain, so this is the last rule in our input chain, jump to the drop.
And we're just saying if we don't match a rule,
then I don't want that traffic in our host or connecting to our host or uh,
attempting to connect to our host. And so we use the drop, drop and reject.
The two differences between drop will silently just drop the packet,
the calling, whatever's sending the packet will never know.
It just drops or it'll, it'll hang Sometimes depending on the client,
the reject will actually return a response back to whatever's sending the
packet. And so on. Host based firewalls,
I like the drop as the default because I don't wanna give anybody any
inclination if people are running port mappers and stuff like that. Port scans.
So, uh, just drop. I don't wanna give them any indication that I'm,
I'm listening on ports there. Okay, so that is the enable firewall.
So I'm gonna close shift colon Q and Vim.
And then this case we are going to use the disabled firewall.
And here as you can see we're using the dash capital P again,
which sets the default policies for our chains.
And here on line four we're setting the input back to accept meaning la
trafficking, which is what the default was when we spun up our e c two instance
dash P. The output is accept, which is what it already was.
But I want to be explicit here forward.
We set the drop by default it's accept,
but when dockers installed and Docker sets up the IP table rules,
it puts it to drop and only has a certain rules.
So I just went ahead and was explicit there as well.
So line seven is the dash capital F,
which means flush all the rules and all the chains.
So if there's any rules left, they're just gonna flush 'em.
They'll be like they never happened.
This will also remove the docker chain rules that are
in there as well. Not the chains themselves, but the rules inside the chains.
And it's okay because if you restart dock service,
they'll come back and I'll show you when we do that. Okay,
shift colon q we'll close this file. We're done here. So I think,
let me click at the screen.
So I think what we'll do now is we will enable the firewall, like I said before,
it should not drive the connection so I'll just go ahead and run it.
So I ran it as you can see, nothing happened. Um,
that's good and we didn't lose the connection.
Let me go ahead and run the IP tables with the list.
All the rules again with the line numbers.
And so as you can see here, we now have in our input chain,
we have five different rules now.
So lines one and two are basically related to the C state,
which is the related or established. Um, like I was saying before,
if we've created a connection or if we've accepted the connection,
go ahead and go ahead and keep that going.
That's important that that's the number one rule, right?
That way we keep all of our connections live and going.
Rule three basically says,
we'll accept any packet on the TCP protocol destined for port
22 on this host from any source, um, to any IP address on our host.
Same thing for, uh, rule number four. Uh,
number four in the input chain except the certain is for destination port 80 for
a for web server. And then here's our catchall, which just says drop.
So if your packet goes through rule one, rule two, rule three,
rule four, and nothing is matched at that point,
you will match on rule five. Rule five always matches a packet.
It just says drop it at that point. So the Ford chain,
everything is correct, nothing has changed there. The output,
nothing has changed. All the docker stuff is the same.
So if you were to run a port scan or, uh,
from the outside against this,
you would now see that that port 22 and port 80
were open, but the rest of the, uh,
ports were filtered if you were doing a scan for all the most common ports.
And that's what we want.
So I think at this point we can disable the firewall and put it back the way it
was. And I'll show you how to, uh,
and we'll restart Docker to bring back those docker rules.
But there's one more caveat here.
If you wanted to save these rules and survive reboots,
there isn't a command called IP tables
save dash save. And if we look at the man page here,
this basically allows you to save the IP table rules and chains into a file that
can get run on reboots.
And so if you want and you're in a production environment,
you wanna make this permanent, you would use this command. Um,
we're not gonna use it here because we don't want to accidentally lock lock
anybody out or, uh, we still have, you know, some more,
some more videos left in this course. So we'll go ahead and just,
but I wanted you to be aware of that.
So let's go ahead and disable.
So I'll go back up into the section six directory where our disabled script is.
We'll run disabled, we'll run our list rules and commands again.
Now as you see, this looks completely different.
And this is the dash F capital F I was talking to you about that we would flush
all the rules and chains out. But as you can see,
what's more important is the input policy here is accept
the default and output is still, uh, accept the Ford is dropped. That's okay.
But to bring back the docker,
we're gonna use the system CTL command again and we're gonna restart Docker
dot service. And what this will do is once this comes back up,
Docker will go ahead and run its own IP table
rules and it'll bring everything back. So we will go ahead.
Let me clear the screen here. We'll go ahead and run this again.
And as you can see here,
all the forward rules inside the forward chain are back.
Okay, that brings us to an end here in the terminal.
Let's jump back over and let's do a recap of what we did.
Okay, so let's talk about what we did. In this video,
you learned how IP tables can keep your Lennox host secure by restricting packet
access like we did for s SSH port and http.
You were also introduced to concepts like tables change rules and targets.
Finally,
you created a simple host-based firewall that allowed s SSH in http traffic,
but dropped all other inbound traffic.
We used two simple batch scripts that allowed you to enable and disable it,
and you also learned how to save it if you wanted to make it permanent.
In the next video, you'll learn about security logging and auditing.
See you soon.