In the last lecture we've discussed about stateful firewalls and how do they work?
Let's go to the terminal and create a stateful all from scratch, which is very good for a desktop operating
system.
This is the kind of firewall I am using on my personal laptop.
And I can see that I haven't had any problems in years.
I'm going to create a better script that contains all IP tables Hughleys.
At the beginning of the script, I'm flashing the filter table of all James IP tables minus F.
When I allow Lubeck, traffic always allow Lubeck traffic on input and output change IP tables minus
the input minus I, the incoming interface, allow me A.J. accept and the same for the output chain.
Now we have the outgoing interface, which is.
Allow me, A.J., except.
The Lubeck traffic is permitted, the rules until this point could be part of any final.
I'm starting the stateful final part, as I said earlier, it's a good idea to drop invite based on
input and output.
These are the packets that cannot be identified in any state.
IP table is minus a import minus state, minus minus state invalid.
Minus G drop and the same for the output chain.
This kind of firewall is very good for a desktop operating system.
This means that there are no services running or no one connects to them from the outside.
The host communicates to any destination and uses any protocol.
So all outgoing traffic is permitted, but only the return traffic is allowed.
This means that I should accept on the input chain only the packets that are in the established or related
stakes.
This is the return traffic and on the output chain I'll allow packets of attack info established and
related.
It means all traffic, including packets that initialize new connections.
IP table is minus a import minus state, minus minus state established, comp related, minus J accept
always write the state in uppercase letters and the rule for the output chain for outgoing traffic IP
tables minus a output minus some state, minus minus state.
And we have new basics that establish new connections established and related minus J.
Except.
And finally, I set the policy to drop on input and output changes, all traffic that was not primarily
permitted will be dropped.
IP table is minus B input drop and IP table is minus B output drop.
That's all I'm saving the script and then make it executable and run it.
Let's test outgoing traffic being a 2.8, 2.8, 2.8.
And Pink is working.
Let's test HTP or ETOPS.
He is working and I also test is I think I'm going to connect to Linux to.
And SSX is working.
Perfect.
Now let's test new incoming connections from Linux to helping Linux, one being and the IP address of
Linux one.
And Pink is not talking, bigwigs are dropped on the input chain.
Let's test S.H. if this is not working, all packets that initialise new connections are dropped on
the input chain.
No new incoming connections are allowed and this is secure.
Let's list the viral.
And we see packets dropped by the policy on the input chain.
There's also an invalid packet that has been dropped.
This is very good, but however, there are cases when we want to allow new incoming connections from
a specific IP address or protocol, for example, we want to allow incoming SSX connections only from
a management station.
So from a given IP address, how could we do that?
It's very simple.
At the beginning of the script, we add a rule that permits incoming DCP packets which are in the new
state.
If the protocol is SSX in the source IP address the given one.
In the same script somewhere at the beginning, I led a new rule.
In fact, it doesn't matter where I end the rule, but it's better to be at the beginning because I
want to permit the pick it fast.
No, after many other rules have been checked.
So I bet plus minus A import minus BTC, B minus minus deport 22.
And now the new state minus some state minus minus state.
The new minus is the given IP address, the IP address that is allowed.
And it's Linux to minus J accept.
I'm saving the script and then test it again.
I'm writing the script and from Linux, too, I'll try to connect using SSX to Linux one and now SSX
is working.
Let's at least the firewall again.
And Lisa, there is one packet that has been accepted by the new.