iptables 101

Intro
Netfilter is the system compiled into the kernel which provides hooks into the IP stack which loadable modules can use to perform operations on packets. The actual Netfilter implementation is broken into two parts, the kernel portion known as Netfilter and the userland tool that interfaces with Netfilter and creates the rulesets, iptables.

Concepts
Tables
A table is basically a collection of chains. There are 3 tables of concern: filter, nat and mangle. All tables have the opportunity to handle a packet (via their chains) going through the firewall, each at a different stage. See the 3rd video in the "Mastering IPTables" series below for details about the way a packet traverses the different tables and chains.
  • The nat table performs network address translation. Built-in chains for nat are PREROUTING, POSTROUTING and OUTPUT.
  • The mangle table is used to change packet properties. It has the same 3 built-in chains as the nat table.
  • The filter table is used to filter packets (= accept or drop them) and has the built-in chains INPUT, FORWARD and OUTPUT
Note that iptables commands are always directed at one specific table. If the cmd doesn't contain the [-t table] option, it will default to the filter table.

Chains
A chain is a list of rules, which is evaluated from top to bottom. Users can define chains of their own and add a rule to a default chain that says "branch off to my custom chain and go through its rules, before going any further".

Packets traversing the filter table will pass through only one of its default chains:
* The INPUT chain will only be traversed if the packet's destination is the local system.
* The FORWARD chain will only be traversed if the packet is passing through the local system and bound for another system.
* The OUTPUT chain is traversed only by packets originating on the local system with an external destination.

Rules
A rule is a single instruction that says "if the packet has these specific characteristics, then do the following with it". The second part of the instruction is called the rule's target. Such a target can be terminating (e.g. ACCEPT, DROP, REJECT, REDIRECT) or non-terminating (e.g. LOG). When a packet encounters a terminating rule, all further rules in the same table (and possibly also in the other tables) will be ignored.

Note that Netfilter has four built-in targets: ACCEPT, DROP, QUEUE and RETURN. The REJECT target is an extension to DROP, which will do some logging before dropping the packet.

Each of the default chains also has a policy, which will be applied if the chain (or a branched off chain) doesn't contain a terminating rule that matches. E.g. the default filter tables can have a policy of ACCEPT or DROP; if the packet traverses all rules in the chain without being terminated (accepted or dropped/rejected), the policy will decide its fate.

Resources
To get up to speed with iptables, you can..
  1. Get to know more about packet filtering
  2. Read iptables docs and some of the tutorials: 1, 2, 3, 4 and 5 (pdf).
  3. Take a look at the iptables book
  4. Study the manpage for iptables cmds
  5. Watch the videos below




Transcript: http://dark-code.bulix.org/z5svtd-68680


Transcript: http://dark-code.bulix.org/1hbuwh-68681


Transcript: http://dark-code.bulix.org/fl04jo-68849

Finally, an exercise:

Comments

Post a Comment

Popular posts from this blog

Handling control characters (escaping) in python for json and mysql

JSON loads() and dumps(): how control characters are handled The json lib escapes control characters when you dump(s) a python object into a json string. import json aa = "String with\ttab and\nnewline" print "1. Py string with control chars, unescaped: '%s'" % aa aa = json.dumps(aa, indent = 2, encoding="utf8") # dumping py-obj into json-string will cause control chars to be escaped print "\n2. JSON Encoded String with control chars, escaped: '%s'" % aa aa = json.loads(aa) # loading json-string into py-obj will leave control chars unescaped print "\n3. Py object (= string) with control chars, unescaped: '%s'" % aa Output: 1. Py string with control chars, unescaped: 'String with tab and newline' 2. JSON Encoded String with control chars, escaped: '"String with\ttab and\nnewline"' 3. Py object (= string) with control chars, unescaped: 'String with tab and newline' Note that json.l...
Read more

python port sniffer with pcapy and impacket

The code below will sniff all network traffic (use a filter to limit the sniffer to only certain packets) during 1000 milliseconds and print some info about it. It requires 2 python modules: pcapy for capturing the packets impacket for analyzing the packet content Note that this sample uses pcapy's dispatch() method and relies on its ability to return automatically after a timeout expires. This functionality is not available on all platforms (e.g. not on linux). import os, logging, socket import pcapy, impacket, impacket.ImpactDecoder ETHERNET_MAX_FRAME_SIZE = 1518 PROMISC_MODE = 0 class Packet(object): def __init__(self, bytes, sniffed_bytes, timestamp, proto_id, src_ip, tgt_ip, src_port, tgt_port, msgs): """ @brief Initialize data. """ super(Packet, self).__init__() self.bytes = bytes self.sniffed_bytes = sniffed_bytes self.src_ip = src_ip self.tgt_ip = tgt_ip self.src_port = src_port self.tgt_port = tgt_port ...
Read more

Django field, form and model validation process

Django's form and field validation process can be best understood by looking at the code in django's BaseForm class (in django.forms.forms) - see below. See also this blog post for a graphic overview. The form.full_clean() method is called by django at the start of the validation process (by form.is_valid(), usually immediately after the view receives the posted data). full_clean() performs a 3 phase validation , with each phase corresponding to a call of one of the protected methods below: self._clean_fields() : Field validation This method iterates over the form fields: For each field, it calls the Widget's value_from_datadict() method, passing the complete post data in a QueryDict. The Widget's task is to retrieve its own value from this QueryDict and return it. The returned value is then passed to the Field's own clean() method. This method does the initial validation (e.g. checking if the value is not empty), without touching the db. If the Field's...
Read more