Firewalls

Question 1

ip-table chains

Answer 1

Assume we have 2 if-s: eth0, eth1 on the PC
INPUT Chain: from outside to eth0
OUTPUT Chain: from eth0 outside
from eth0 to eth1 and visa versa: FORWARD

Question 2

Add an entry into iptable to allow outgoing ssh traffic

Answer 2

iptables -I/A CHAIN [-i/o ifname] [-s/d ip-address]
-p udp/tcp --dport/sport nn -j LOG/ACCEPT/DROP/REJECT
A-append
i/o -network card (eth0 or eth1)
s-source address
d-destination address
dport/sport -dest port
sport- source port
nn -port number

iptables -A OUTPUT -p tcp –dport 22 -j ACCEPT

Question 3

List iptables entries

Answer 3

iptables -L

Question 4

Add policy into iptables

Answer 4

iptables -P INPUT DROP
iptables -P OUTPUT DROP
-P -policy OUTPUT

Question 5

Add an entry into iptable to allow incoming traffic, when ssh connection was established with remote server

Answer 5

iptables -A INPUT -m state –state established,related -j ACCEPT
-m match

Question 6

UFW, check status and enable ufw

Answer 6

1. ufw status

2. ufw enable

Question 7

UFW

1. Allow all ssh traffic
2. Reject outgoing ssh traffic
3. Delete rejected outgoing ssh traffic

Answer 7

1. ufw allow ssh
2. ufw reject out ssh
3. ufw delete reject out ssh

Question 8

UFW deny outgoing ssh tcp traffic from 1.2.3.4

Answer 8

ufw deny proto tcp from 1.2.3.4 to any port 22

Question 9

UFW Reset all rules

Answer 9

ufw reset

Question 10

UFW list available applications

Get info about specified app

Answer 10

ufw app list

ufw app info Samba

Question 11

UFW enable logging

Answer 11

ufw logging on

Question 12

Firewalld

Answer 12

Zone: a collection of network cards to which rules can be assigned

Interfaces: individual network cards, always assigned to zones

Services: xml-based conf that specified ports to be opened and modules that should be used

Forward ports: used to send traffic coming in on specific port to another port, which may be on another machine

Masquerading: provides NAT

Reach rules: extension to firewalld to make more complex conf possible

Question 13

Firewalld:
Show current conf
Show services of current zone (subset of --list-all command)
Get available services
Add service
Remove service

Answer 13

firewall-cmd --list-all
firewall-cmd --list-services
firewall-cmd --get-services
firewall-cmd -add-service=service
firewall-cmd --remove-service=service

Question 14

Firewalld:

add service

Answer 14

firewall-cmd –add-service=https –permanent