In this lesson, you will learn about IP tables firewalls. So IP tables is a classic tool
for managing advanced firewalls. The fun thing is that at some point IP tables got deprecated,
but there's a lot of people that like it. So now it's living a revival. So IP tables
has been rebranded and you can use it to write firewall rules that are compatible to the
current syntax. Why would you want to do that? Because it offers advanced features for configuring
very specific firewall rules. So if you are a powerful firewall user, IP tables is a very
nice utility. In modern Red Hat, NFT is provided as a standard solution to manage advanced
firewalling. And as I just mentioned, the IP tables tool has been reworked to generate NF
tables firewall rules. And what is the reason behind that? Well, NF tables is quite complex,
and the rules are not as easily written as IP tables rules. So that is why you might want to
use IP tables instead of NF tables. Now when you work with IP tables, you should understand the
command anatomy. So how does it work? Well, IP tables first has either a minus A or a minus I.
Minus A is for append and minus I is for insert. Minus A appends to the end of the chain. Now the
fact is that in an IP tables firewall, the position of your rules does matter. Because if you first
are going to allow all SSH traffic, and then you are going to deny all SSH traffic for a specific
host, well, that's not going to work. Because the allow rule matches the incoming traffic also for
the denied host before you meet the deny rule. And that is why generically, you want more specific
exceptions first and the generic rules to the end. Next component is minus I or minus O ifname. So
that is the input or output interface name, which is optional, by the way. If you don't specify an
interface name, it just applies to all interfaces. Now we have minus S or minus D for source or
destination followed by an IP address with a CIDR subnet mask. Next, you get minus P, UDP, or TCP,
which is always followed with by a minus minus D port or a minus minus S port for the destination
port or the source port. And the final component is minus J. Minus J is specifying what exactly you
want to do. And your options are log and accept and reject and drop. Well, log is writing to the
logs, accept is obviously accepting it, reject will reject while sending an error message so that the
initiator of the traffic can know what was going wrong, and drop will silently drop it. Let me
demonstrate. So I'm going to do this on my CentOS 10 host. And in order to do so, I need systemctl
disable, minus minus now, firewalld. And then I'm going to use IP tables minus L, which is listing.
And I can see that I have an input chain and a forward chain and an output chain. And the policy is
set to accept. So input is for incoming packets, output is for outcoming packets, and forward is a
chain that I'm going to ignore here. The policy is set to accept if you want a decent firewall that is
really holding off everything, then it's a good idea to use policy first. So minus P, output, must be
in uppercase, by the way, drop. And I'm also going to set the policy on input to drop. And now let's
try to ping google.com. And what do we get? We get a name or service not known. A name or service not
known, that's a DNS message. And that is right, because the very first thing that is happening,
where you are pinging google.com, you need to connect to DNS to find the IP address, and DNS cannot be
reached. So we need to make sure that this is going to happen. And how do we do that? Well, by using IP
tables, minus A, output. So I'm working on the output chain. Minus P for protocol, ICMP, for the
internet core message protocol. That's a protocol that is used by the ping command. And minus J,
accept. So I want to accept outgoing ping. Now, this is not going to be any better, because we still
have two problems. And problem number one is that I do accept ping now, but I still cannot reach out to
DNS. Second problem is the return traffic. I'll show you in a bit. But first, IP tables, minus A,
output, minus P, TCP, minus minus D, port is 53, minus J, accept. Port 53, that's your DNS port. And
that is now accepted. In case you are not too sure about the port, well, remember ETC services, you can
find it in ETC services. I'm going to do almost exactly the same, but this time, minus P, UDP, also
accept. And that is because DNS traffic can go over TCP, as well as over UDP. Now, what do you think?
Are we all right at this moment? Well, when we ping google.com, we still don't get anything. So that doesn't
work. And that is because of the return packets. Look, IP tables minus L is showing that we now have some
traffic that we allow in the output chain, but nothing is allowed back. And to take care of that, I'm using IP
tables, minus A, input, minus M, state. This minus M command is to call a kernel module. And we are calling the
state kernel module, which is tracking packet state. And I'm going to look for state is established or
related, minus J, accept. And what does that mean? That means that we are going to accept incoming traffic only
if it's an answer to a state that was already existing. So only if it's an answer to authorized outgoing traffic. And
you can see that that is now listed in the firewall rules. And we can try to ping google.com again. And now it
works. Now let's do one more thing, Control C first to interrupt the ping. I'm going to use IP tables, minus A,
output. There we go. And minus T, minus P, TCP. And minus minus D port is 80 comma 443. And oh boy, what do we see
doesn't work with a comma separated list. Okay, then we need to do it one by one. So port 80 as well as port 443.
Because you probably want to allow some web traffic to go out as well. And at this point, we have a pretty decent IP
tables firewall configuration. Now, I am going to reboot this system to get rid of all the IP tables configuration. I
don't want to make it persistent. I just wanted to explain how it works.