In this section will start a series of lectures about IP tables, basic matches, which are also the
most used ones, is I've already told you each IP table has a mixing component and an action component.
IP tables can be constructed to make traffic by protocol type destination or source address, destination
or source network destination or source Searsport input or output interface header feelings or connections
state, among other criteria.
And these can be combined to create very complex rules.
In this lecture, we'll take a look at how to filter traffic based on source or destination IP or network
address.
We can make Bishkek's by source IP address or by source network address using minus S or minus minus
source makes option.
Address can be either a single IP address like 192 dot 168 dot zero, dot one, a network IP address
with a message specification like 10 that zero that the zero zero eight or a domain name like W w w
that Linux dot com.
Please note that specifying any name will be resolved with a DNS query, and this is not always a good
idea.
Let's take a look at some examples.
I want to drop all incoming traffic from Lenox to which has the IP address of 192 168 dot zero, dot
20.
OK, from this Linux machine to Linux one to the firewall.
And I typed Fabolous minus a input, I am using the input chain because it's incoming traffic minus
s.
This means the source IP address and the IP address of Linux.
Two of the other machine, 192, 168 dot zero, that twenty minus G and the action drop.
Before hitting enter, I'll ping Linux one from Linux to.
Bing is working and I am hitting the enter key.
And being stopped.
If I listed the firewall, I see that there are eight mixed and dropped packets.
If we want to drop by destination IP address, we use minus D or minus minus the destination instead
of minus S when writing the IP table soon.
In the next example, I'll write the rule letter drops outgoing traffic to an entire network like eight
dot zero zero zero eight.
To this network.
At this moment, I can communicate with that network is working and IP table is minus a output x outgoing
traffic, so I am using the output chain minus D and the destination network address hate data zero.
Data zero.
Data zero eight.
Minus G drop.
Now, being is not working, and if I leased the Firehole, I see a lot of mixed packages.
There are two dropkicks.
So this whole drops any packages destined to an IP address that starts with eight or its first bite
is eight.
Perfect.
Let's continue on and see another example.
I want to completely deny access from this Linux machine to a website like, say, www.youtube.com.
For this task, there are more possibilities.
The first one is to find the IP address or the IP addresses if there are more of www.youtube.com and
then drop all the packets that are going to those addresses, you can find that the IP address of a
website using either DNS lookup or Digg and as Look-Up www.Youtube.com.
And we see the IP addresses of www.youtube.com.
And the big w w w that Ubuntu dot com.
These are the IP addresses of that website, keep in mind that NSW cap works both on Windows and Linux,
but Deek is a Linux only comment and has more options available.
We noticed that there are six IP addresses for this domain.
If we want to deny access to the website, we must write six IP table rules and each rule will drop
one IP address.
I write just an IP table is an example IP table minus a output.
This is outgoing traffic minus D, and I'll take an IP address from this list.
Let's say the first one.
Minus Jay drop.
Of course, at this moment, the access to the website is not denied because there are still five IP
addresses that are permitted.
The second possibility is to use the domain name in the IP tablespoonful, it will automatically query
the system DNS server for the IP addresses and ID for each IP address IP tables minus a output minus
the www.youtube.com Minhas J Drop.
And IP table is minus V and L, I am listing the fireboat.
And we notice that there are six rules, one rule for each IP address that drop the outgoing traffic
to those IPIS.
If I open up a browser window and try to connect to www.Youtube.com, it won't work.
The website is not loading.
Notice that when dropping traffic based on source or destination IP address and you use a domain name
instead of an IP address at the end, IP table still uses IP addresses in the not the domain name.
I've used a domain name, but IAPT Bullis uses IP addresses.
This requires access to a DNS server and that means other IP table rules that allow DNS traffic pay
attention, especially when using the drug policy.
It may be the case when you cannot permit or deny traffic to or from an IP address because you have
specified the domain name.
But the DNS traffic that resolves the domain name is not permitted.
Also note that it's not a good idea to accept or drop traffic to a very big website like Google dot
com or Facebook dot com, this way domains like Google dot com have tens or hundreds of IP addresses
and the DNS response will contain only a few of them.
You should use an application firewall like SQUIT instead of IP tables.
At the end of this lecture, I just want to tell you that if you see the address zero zero, it means
any IP address with any network.
Mesic.
For example, I accept all outgoing traffic and I write IAPT Bullis minus a output minus BTP minus minus
the port four hundred forty three.
This is a traffic minus D and now the destination IP address and I write zero zero.
It means any IP address with any mask minus G except.
OK, this is all about mixing by source or destination IP address.
Thank you.