Lab Objective:
Learn about the iptables command and some of its switches.
Lab Purpose:
Most Linux distributions ship with various firewall tools. One such firewall tool is iptables, which can match packets crossing the network interface against a set of rules to decide whether to permit or deny them.
Lab Tool:
Ubuntu VM
Lab Topology:
Please use the following topology to complete this lab exercise. I used a virtual Ubuntu PC running inside VirtualBox. You will need to run all commands as an administrator or prefix them with ‘sudo’.
Lab Walkthrough:
Task 1:
Pull up a terminal by typing ‘terminal’ into the search box.
Task 2:
At the command prompt, issue the sudo iptables –help command. Check your documentation for more information on all the available switches. You will clearly see here that there are a large number of parameters.
Task 3:
We will issue a single configuration command for some hands-on practice. The command is sudo iptables -A INPUT -m conntrack –ctstate ESTABLISHED, RELATED -j ACCEPT.
‘A INPUT’ means that the rule will be added to the end of the chain of the current rules on the INPUT chain. ‘-m conntrack’ refers to a set of modules providing extra capabilities. ‘–ctstate’ refers to matching packets that are associated with an established connection—in this case an ESTABLISHED connection examining RELATED packets. ‘-j ACCEPT’ means the packets will be permitted.
Task 4:
We can check the current iptables configuration with the sudo iptables -L command. You must use an uppercase L for the switch.
Task 5:
Next, we will permit SSH traffic with the sudo iptables -A INPUT -p tcp –dport 22 -j ACCEPT command. ‘-p tcp’ matches TCP packets, and ‘-dport’, I’m sure you will already have worked out, is the destination port.
Task 6:
Check the iptables again.
Task 7:
Finally, we need to clear the iptables with the sudo iptables -F command and then check the tables again.
Notes:
To filter IPv6 packets, use the ip6tables command.
