Inside of Ubuntu and other POSIX based systems,
we deal with IP tables instead of Windows Firewall.
Now, IP tables is a very specific,
I got it that time,
firewall program for us to be able to go through
and identify to and from ports and also forwarding rules,
which we will be covering in depth here
pretty soon in the course.
But the reason that I bring this up
is because by default,
as you can see here on the screen, it's pretty empty.
Now, what does this mean?
Well, there's a couple of things.
We know that firewalls work off the general idea
of allow by exception,
meaning that everything is going to be denied
unless it's specifically stated
inside of a firewall to open up.
So this opens, this right here as config by default,
doesn't open anything, but we still have ports open.
So there's a balance here, right?
Because when we do a scan using programs like Nmap,
we only get ports open on the system
that are associated with active forms of communication
or programs like Apache and also SSH,
as we have seen earlier.
Understanding the IP tables here
is a way for us to be able to go through
and understand on the actual system,
how that correlates with seeing things like filtered
whenever we get ports back from our Nmap suite.
Now, I have the command for this below.
This is IP tables and this command right here
will issue out a listing of all rules
inside of the actual IP tables.
This is important to know
because let's say you are able to remote
into a different system over SSH.
You can review the IP tables inside of terminal like so
and not have it pop up on the other person's system.
Now you may be wondering if there's nothing in the IP tables
and the general rule of thumb is deny all
and permit by exception,
is there any communication going on at all?
And the answer is yes,
because we can prove this by doing a netstat-ano.
And this is what it looks like for traffic
going on the inside of the network and going out.
And some of these programs may be talking to themselves
because they just have to have network capabilities
for whatever reason by design.
But you can see that we have to and from
both IPv4, IPv6,
along with the actual port number themselves
and the actual list name.
Now we could very well as administrators
and security specialists,
go in and put in IP table rules
that deny port 22, port 80, port 631, et cetera, et cetera.
And this would prevent HTTP,
or excuse me, SSH and whatever is on 631
from being able to go in and out of this particular system.
So do we have any rules here that are enabled
that would prevent this?
No, because earlier in the skill, we've already done this.
Understanding those IP tables though,
it's going to give us the ability to understand
how that system interacts and can communicate
with other systems on the network
within that range of IP addresses
that's inside of our scope for the rules of engagement.