Skip to main content

IPTables - Firewalled 🧱

Image
By on

> IP Tables

Learning about IP Tables enables us to control data that flows into and out of our computer.

Essentially a firewall functions as a filter blocking restricted content and allowing trustworthy communications.

(img by freepik - iconsea)

We can establish firewall rules with the help of IP Tables. This is exactly what will be covered by the following.

Viewing IP Tables

Navigate to the terminal in your Linux distribution by typing “iptables -L”. You can view the rules and regulations in place. (Note that you will require root privileges to run this)

If you see results as such, this is the default view hence there are no rules set on your computer

Chains

From the above picture, you could see 3 different chains.

  1. INPUT → All incoming traffic to your computer
  2. FORWARD → This happens in routers, mostly functional when setting up firewall policies in routers.
  3. OUTPUT → All outgoing traffic from your computer

Blocking Traffic


This shows that all incoming traffic is allowed as the policy is set to ACCEPT.

Suppose we need to block an IP address that is from a malicious or suspicious user.

We can do this by :

  • -A → Specifies to append or add a rule to the chain
  • -s → source of the device IP
  • INPUT chain is selected
  • DROP → All traffic from this device is blocked
  • -j → Specifies what action should be taken, in this case, it is DROP traffic from the said IP address

Blocking a service


By using this code we can block anyone in the network who tries to communicate using port 25 (SMTP / email service)

We can now check how the IP tables look

Allowing traffic to a network


The following command enables us to allow traffic from this IP address

However, this person will not be able to communicate with our device, this is because the earlier command we specified blocked all traffic from the network. If we now check the IP Table using “iptables -L”.

We can see the rules applied, the first rule precedes the lower hence the list follows a chronological order in filtering networks to enable “192.168.0.66” to communicate with us we need to put it at the top to do this we use replace the -A with -I. Both these append and add rules to the table however -I add the rule to the top of the list.


Note that this image is after deleting the last row in the list (covered in the next section)

Deleting a rule

If we want to delete the 3rd rule from the INPUT list we should specify as such, the -d, connotes for deletion.

Comments

Post a Comment

Popular posts from this blog

Bricks Heist CTF Write-Up 🧱

By on
  > TryHack3M: Bricks Heist ( TryHackMe) Before beginning we need to edit our /etc/hosts file which makes it easier to use the target machine during scanning and exploitation phases.  The /etc/hosts file serves as the first source of hostname-to-IP address mappings before accessing the DNS servers. sudo vim /etc/hosts Thereby if we include our attackbox IP as bricks.thm whenever we access https://bricks.thm in our we browser the atttackbox IP is mapped accordingly. Reconnaissance Nmap We will begin the box by setting up an nmap scan to identify the vulnerable services running on the ports. nmap -sC -sN -oN initialNmap <TARGET-IP> -sC → Default script scanning -sN → This flag specifies a TCP NULL scan. This technique is used to determine whether the ports are open, closed, or filtered by observing the response behavior of the target system. -oN → Instructs Nmap to save the output by this file name The output of this scan does not help us much. When we access the sit...
Post a Comment
Read more

Sub-Netted 🪐

By on
> Subnetting Explained Introduction Simplified Subnetting , Let’s untangle the knots and dive into the world of networks. Isn't it strange to see the IPv4 address of your laptop and IPv4 address you see on google are actually different ? (img by freepik - vectorsclub) Identification used in the interconnected network. A school identifies their students from admission numbers. Each person has different telephone numbers. Houses have addresses. “Ah Ha, this all revolves around a primary key”. That’s the identification. Likewise the internet has IPv4 addresses. Although they are running out. Incredibly fast… The bearer of IP addresses Routers as we all know are middlemen. These devices are configured by ISP’s in your houses or office, to provide a connection, which enable devices to communicate with the internet, and browse various sources such as Netflix, or eBay. So where’s your IP address ? When you connect to a network such as your home Wi-Fi, each device is provided an IP a...
Post a Comment
Read more

Everything about DNS servers 🌍

By on
 > DNS (Domain Name System) Introduction Computers as we know communicate and work through binaries, these binaries can be represented in more ways than one such as hexadecimal or denary to mention a few. In a networking context, we have IP addresses that are given to nodes (PCs, smartphones, etc) allowing them to be individually identified within a network. Purpose of a DNS The majority of websites are hosted within a server or the cloud, when accessing their websites our web browser requires the IP address of that server to initiate communication with the target website. Since we know that IP addresses are nothing less than a group of 4 octets separated by a full stop 157.240.22.35, it's difficult for us to type http://157.240.22.35 in the web browser every time we need to access a website such as Facebook. It is this convenience that DNS provides. With the help of DNS, we can enter https://www.facebook.com/ without the need to remember the IP address of Facebook’s server. im...
Post a Comment
Read more