Hello, everybody, and welcome back.
In this lecture, I'm going to show you how to filter traffic by Disipio UDP ports.
This is a very common task when developing a firewalled.
You can make out by a single porth using the Mitch option minus minus deport, which comes from destination
port or minus minus eSport, which comes from Searsport.
It's mandatory to specify Tsipi or UDP protocol using minus PMH option.
Otherwise you'll get the error.
Keep in mind that there are reports in the packet, Heather, only if the protocol is DCB or UDP, other
protocols like, for example, ICMP do not use sporks at all.
In this example, we are dropping incoming SSX packets, it's incoming traffic because the chain is
input, the protocol is Tsipi enter the destination port is the standard SSX port.
We assume that there is an SSX server that is listening on Port 20 to.
If we want to make it by multiple ports, we can write the more IP tables one rule for each port, or
we can use another option, which is minus M multi port.
There are two other options, minus minus eSports to match by source sports and the minus minus deportes
to match by destination sports.
After that, the match option are coming.
The sports separated by coma's.
Let's take a look at this example, we are accepting outgoing traffic of the output chain to Port Athie
or 443.
This means traffic destined to HTP or stickups service.
Perfect.
Let's go to a terminal and see some life examples.
From Lennox to I want to see what parks are open on Linux one in order to check what parks are open,
I'll use and map, which is, by the way, a great portal scanner and a map and the VA IP address of
the other Linux machine, one to 168 dot zero that then.
After a few seconds and Map will show us what ports are open on Linux on.
As you can see, there are four ports open, 22 for age, 25 for S&P, 84 HTP and 443 for ETPs.
I flashed all the rules, so at this moment, it's an open firehole and all traffic is accepted.
This is the state where I'm starting from.
In each example, I'll show you there is no rule and the default policy is set to accept.
And I want to drop incoming traffic to port.
Twenty five IP table is minus 18, but incoming traffic minus PTB minus minus the port, 25, minus
J drop.
And I am listing the firewall again, we can see the wall here and there are no Bishkek's mixed.
I'm scanning Linux once again from Linux to using, and I'm executing the same comment again.
And we noticed that Part 25 is now filtered.
By the way, do you know what is the difference between a field target and a closed port, a field that
the port is in fact an open port, but there is a firewall that's dropping traffic to that open port
and we are receiving no traffic back when sending a packet to that port.
In this case, Port 25 is open on Linux one.
So if there is a process of listening on that port, but it appears filtered to Linux, too, because
packets are dropped.
On the other hand, a closed port is a port on which no application is listening.
If we sent a packet to a closed port, we receive a packet back indicating that the port is closed,
there's a DCP packet with the preset flag said.
For example, part 55 is closed.
So is the conclusion of the report is an open port that doesn't respond back because a fireball is dropping
the packets and a closed port is a port where no application is listening and eatery's points back with
ATC preset packet indicating that it's closed.
Now, Linux one, if I lift the firewall, I'll see some of Mixtepec.
They are two Mixtepec.
Let's try other examples I want to block all incoming traffic to Port Authority.
Let's check if Port Authority is open or closed or filtered.
And it's open.
I'm going to create a new federal rule that will block all incoming traffic to Port 80.
In fact, it's the same rule just that instead of bought 25, I have bought 80.
I am listing the firehole there is now Mixtepec it, and if I scan it again, we see that the port is
filtered and there are mixed packages.
There are three Mixtepec.
Let's move on and see another example, which is a very common and useful one, we suppose there is
a Linux server and a management station and we want to allow only the management station to connect
to the Linux server using SSX.
Or in other words, we allow a single source IP address to connect to Linux one using SSX.
In this example, it will be the IP address of the Windows recording machine, all other source IP addresses
will be denied.
Let's check what is the IP address of these Windows machine?
I'm running IP config and we see that the IP address is one hundred ninety two.
One hundred sixty eight.
That is zero.
That one hundred twelve.
OK.
For this task, I'm going to create the best script, write the rules inside of the script and then
execute the script.
It's easier to manage the firewall this way.
The first line of my script is the shebang and indicates that this script will be run by the best shall
by default.
First, I flashed the filter table of all occasions because maybe I'll run the script many times and
I don't want the rules to be appended each time I run the script.
IP table is minus F.
We've already discussed about this in a previous lecture.
And the first depletable rule will permit us to seek traffic from that specific IP address.
IP table is minus A input, minus BTC, B minus minus deport 22 minus S and the IP address of my Windows
machine.
Minus G, accept.
The school is accepting the traffic that is coming from the Windows machine.
Now, you can imagine that we still need something that will drop SSX traffic that is coming from other
source IP addresses.
There are two possibilities.
If the default policy for the input chain is set to drop, it means that the traffic that is not matched
by any role will be dropped by the policy.
In this case, we don't need to write another IP rule, but if the policy is set to accept, then we
mandatory need a second level that drops all incoming SSX traffic that was not accepted till that point.
In this example, I said nothing about the policy, so I'll write that the second rule IP table is minus
A input minus BTC B minus minus deport 22 minus G drop.
I don't specify the source IP address and that means any IP address.
If you want to specify an IP address, you can simply write the minus s zero zero.
It's the same.
Perfect.
That should be enough.
Let's save the script and make it executable.
Before writing the script, I want to check that Part 22 is open, so I'm scanning it using a map from
Linux to.
It's open.
Now I'm writing the script.
Let's scan the path again.
And the port is filtered.
The file is dropping the packages that are not coming from the allowed IP address, Linux, too, doesn't
have the permitted IP address.
If we listed the firewall, we see there are dropped packets.
From Windows, I am opening Puti and trying to connect to Linux one.
I'm writing the IP address of Linux one.
And open.
And we see that the path is open.
Pancakes are permitted through the firewall.
There are 18 techniques accepted by the first toll.
In the last example of this lecture, I'll show you how to make by multiple ports in a single, repeatable
school using minus multipart mix option, I'll try to block the access to Port 80 and 443.
I'll write the VIP table rules inside the same script, IP table minus A input, minus BTC, B minus
M multipart minus minus the pork's add comma for for free minus J drop.
Take care of that the very s at the end, so deports not deport.
And I'm saving the script.
Before running it, I'll check the state of those two ports.
Bought the 80s in four for three, and they are open.
I'm writing the script and then scanning the ports again.
OK, the host is not responding at all, and Intermap thinks that it's not up.
I'll add the minus B on uppercase B and zero to avoid probing the Sarovar using pings.
Now it says that the ports are filtered exactly what we've expected.
There are eight mixed packages by the whole.