In this lesson, you will learn about IP tables firewalls. So IP tables is a classic tool
for managing advanced firewalls. The fun thing is that at some point IP tables got deprecated,
but there's a lot of people that like it. So now it's living a revival. So IP tables
has been rebranded and you can use it to write firewall rules that are compatible to the
current syntax. Why would you want to do that? Because it offers advanced features for configuring
very specific firewall rules. So if you are a powerful firewall user, IP tables is a very
nice utility. In modern Red Hat, NFT is provided as a standard solution to manage advanced
firewalling. And as I just mentioned, the IP tables tool has been reworked to generate NF
tables firewall rules. And what is the reason behind that? Well, NF tables is quite complex,
and the rules are not as easily written as IP tables rules. So that is why you might want to
use IP tables instead of NF tables. Now when you work with IP tables, you should understand the
command anatomy. So how does it work? Well, IP tables first has either a minus A or a minus I.
Minus A is for append, and minus I is for insert. Minus A appends to the end of the chain. Now the
fact is that in an IP tables firewall, the position of your rules does matter. Because if you first
are going to allow all SSH traffic, and then you are going to deny all SSH traffic for a specific
host, well, that's not going to work. Because the allow rule matches the incoming traffic also for
the denied host before you meet the deny rule. And that is why generically, you want more specific
exceptions first, and the generic rules to the end. Next component is minus I or minus O, I have
name. So that is the input or output interface name, which is optional, by the way. If you don't
specify an interface name, it just applies to all interfaces. Now we have minus S or minus D for
source or destination followed by an IP address with its CIDR subnet mask. Next, you get minus P,
UDP, or TCP, which is always followed by a minus minus D port or a minus minus S port for the
destination port or the source port. And the final component is minus J. Minus J is specifying what
exactly you want to do. And your options are log and accept and reject and drop. Well, log is
writing to the logs, accept is obviously accepting it, reject will reject while sending an error
message so that the initiator of the traffic can know what was going wrong, and drop will silently
drop it. Let me demonstrate. So I'm going to do this on my CentOS 10 host, and in order to do so, I need
systemctl disable minus minus now firewalld. And then I'm going to use IP tables minus L, which is
listing, and I can see that I have an input chain and a forward chain and an output chain, and the
policy is set to accept. So input is for incoming packets, output is for outcoming packets, and
forward is a chain that I'm going to ignore here. The policy is set to accept. If you want a decent
firewall that is really holding off everything, then it's a good idea to use policy first. So minus P,
output, must be in uppercase by the way, drop. And I'm also going to set the policy on input to drop.
And now let's try to ping google.com. And what do we get? We get a name or service not known.
A name or service not known? That's a DNS message. And that is right, because the very first thing
that is happening when you are pinging google.com, you need to connect to DNS to find the IP address,
and DNS cannot be reached. So we need to make sure that this is going to happen. And how do we do
that? Well, by using IP tables, minus A, output. So I'm working on the output chain. Minus P for
protocol, ICMP, for the internet core message protocol. That's a protocol that is used by
the ping command. And minus J, accept. So I want to accept outgoing ping. Now this is not going to be
any better, because we still have two problems. And problem number one is that I do accept ping
now, but I still cannot reach out to DNS. Second problem is the return traffic. I'll show you in
a bit. But first, IP tables, minus A, output, minus P, TCP, minus minus D port is 53, minus J,
accept. Port 53, that's your DNS port, and that is now accepted. In case you are not too sure about
the ports, well, remember ETC services. You can find it in ETC services. I'm going to do
almost exactly the same, but this time minus P, UDP, also accept. And that is because DNS traffic
can go over TCP as well as over UDP. Now what do you think? Are we all right at this moment?
Well, when we ping google.com, we still don't get anything. So that doesn't work, and that is because
of the return packets. Look, IP tables minus L is showing that we now have some traffic that we allow
in the output chain, but nothing is allowed back. And to take care of that, I'm using IP tables minus
A, input, minus M, state. This minus M command is to call a kernel module, and we are calling the state
kernel module, which is tracking package state. And I'm going to look for state is established
or related, minus J, accept. And what does that mean? That means that we are going to accept
incoming traffic only if it's an answer to a state that was already existing. So only if it's
an answer to authorized outgoing traffic. And you can see that that is now listed in the firewall
rules, and we can try to ping google.com again. And now it works. Now let's do one more thing,
control C first to interrupt the ping. I'm going to use IP tables minus A, output, there we go,
and minus T, minus P, TCP, and minus minus D port is 80, 443. And oh boy, what do we see? Doesn't
work with a comma separated list. Okay, then we need to do it one by one. So port 80 as well as
port 443, because you probably want to allow some web traffic to go out as well. And at this point,
we have a pretty decent IP tables firewall configuration. Now I am going to reboot this
system to get rid of all the IP tables configuration. I don't want to make it
persistent. I just wanted to explain how it works.