Linux Iptables Cronjob
You can do the command in a cronjob similar to :
*/5 * * * * iptables-save > /etc/iptables.rules > /dev/null 2>&1
This will save the iptables setup every 5 minutes.
Linux Transit VM Port Forward
Need forwarding to Telford Internal IP Address – 10.10.1.1
Fixed Internet IP Address – 1.1.1.1
Ports 40000, 41000, 42000, 43000, 44000, 45000, & 46000 need forwarding to 10.10.1.1
Configuration to be Done.
Need to create a Ethernet Subinterface on the VM :
# Advanced Micro Devices [AMD] 79c970 [PCnet32 LANCE]
DEVICE=eth1:3
BOOTPROTO=static
ONBOOT=yes
HWADDR=00:0c:29:fa:da:13
IPADDR=1.1.1.1
NETMASK=255.255.255.0
NETWORK=1.1.1.254
BROADCAST=1.1.1.253
Bring Interface UP :
sudo ifup eth1:3
To View a list of rules with the NAT table :
sudo iptables -vnL -t nat –line-numbers
Need to complete PREROUTING chain in order to DNAT these ports from WAN to destination LAN address :
sudo iptables -t nat -I PREROUTING 1 -d 1.1.1.1 -p tcp –dport 40000 -j DNAT –to 10.10.1.1
sudo iptables -t nat -I PREROUTING 2 -d 1.1.1.1 -p tcp –dport 41000 -j DNAT –to 10.10.1.1
sudo iptables -t nat -I PREROUTING 3 -d 1.1.1.1 -p tcp –dport 42000 -j DNAT –to 10.10.1.1
sudo iptables -t nat -I PREROUTING 4 -d 1.1.1.1 -p tcp –dport 43000 -j DNAT –to 10.10.1.1
sudo iptables -t nat -I PREROUTING 5 -d 1.1.1.1 -p tcp –dport 44000 -j DNAT –to 10.10.1.1
sudo iptables -t nat -I PREROUTING 6 -d 1.1.1.1 -p tcp –dport 45000 -j DNAT –to 10.10.1.1
sudo iptables -t nat -I PREROUTING 7 -d 1.1.1.1 -p tcp –dport 46000 -j DNAT –to 10.10.1.1
To summarize this as one rule :
sudo iptables -t nat -I PREROUTING 18 -d 85.234.86.115 -p tcp -m multiport –dport 40000,41000,42000,43000,44000,45000,46000 -j DNAT –to 10.10.1.1
Need to complete POSTROUTING chain in order to SNAT these ports from LAN address to destination Subinterface : :
sudo iptables -t nat -I POSTROUTING 20 -o eth1:3 -s 10.10.1.1 -p tcp -m multiport –dports 40000,41000,42000,43000,44000,45000,46000 -j SNAT –to 1.1.1.1
To Delete a Chain Rule
sudo iptables -t nat -D POSTROUTING 20
sudo iptables -t nat -D PREROUTING 20
Troubleshooting Diagnostics Testing :
From the Internet :
telnet 85.234.86.115 40000
B00m.
How to log in LINUX IPTABLES
Before we get into the iptables rules, lets make sure that what we are doing is going to log.
First lets open up “/etc/syslog.conf” and add this entry
kern.* /var/log/firewall.log
Now restart your syslog daemon.. “/etc/init.d/syslog restart”
sudo iptables -I OUTPUT -j LOG
This means to jump to the LOG chain in iptables.
Now lets say you want your logging to be more verbose.
In iptables we can fix that by adding this entry in the rule.. –log-level 7.
This is the highest level of logging (DEBUG LEVEL).
e.g :
sudo iptables -I OUTPUT -j LOG –log-level 7
Logging
In the above examples none of the traffic will be logged.
If you would like to log dropped packets to syslog, this would be the quickest way:
iptables -I INPUT 5 -m limit –limit 5/min -j LOG –log-prefix “iptables denied: ” –log-level 7
iptables -I OUTPUT 5 -m limit –limit 5/min -j LOG –log-prefix “iptables denied: ” –log-level 7
To have packets Denied/Dropped, Place rule at the bottom of Chain or have
it modified for source/destination addresses.
iptables -A INPUT -j block
iptables -A OUTPUT -j block
Using Linux Gentoo:
sudo vi /syslog-ng/syslog-ng.conf
Add these lines :
source kernsrc { file(“/proc/kmsg”); };
destination kern { file(“/var/log/kern.log”); };
destination firewall { file(“/var/log/firewall.log”); };
filter f_firewall { match(“firewall”); };
filter f_kern { facility(kern) and not filter(f_firewall);};
log { source(kernsrc); filter(f_kern); destination(kern); };
log { source(kernsrc); filter(f_firewall); destination(firewall); };
IPTables Path Directory
sudo vi /etc/sysconfig/iptables.save
sudo vi /var/lib/iptables/rules-save
sudo vi /etc/iptables/iptables
!
!
To Save :
/etc/init.d/iptables save
sudo /etc/init.d/iptables save
IPTables: SNAT
Flags:
-A Append
-I Insert
Example using the append flag:
sudo iptables -t nat -A POSTROUTING -o eth0 -d 1.2.3.4 -j SNAT –to-source 5.6.7.8
!
sudo iptables -t nat -I hml -s 172.20.6.99 -j SNAT –to-source 10.94.43.10
Example using the insert flag:
iptables -t nat -I POSTROUTING 17 -o eth0 -d 1.2.3.4 -j SNAT –to-source 5.6.7.8
Delete a Rule:
sudo iptables -t nat -D hml
sudo iptables -t nat -D POSTROUTING
sudo iptables -t nat -D PREROUTING
Linux Iptables POSTROUTING
sudo iptables -vnL -t nat
sudo iptables -vnL -t nat –line-numbers
!
sudo iptables -t nat -D POSTROUTING 2
sudo iptables -A POSTROUTING 2 -t nat -s 192.168.1.0/255.255.255.0 -d 80.74.22.151 -j hml
sudo iptables -I POSTROUTING 11 -t nat -s 195.110.181.74 -d 172.20.0.0/16 -j ACCEPT
!
sudo iptables -I POSTROUTING -s 1.1.1.1 -d 2.2.2.2 -j ACCEPT
sudo iptables -I POSTROUTING -s 120.1.1.1/255.255.255.224 -o eth2 -j SNAT –to-source 1.1.1.1
!
!
When we have a linux vm solution in place :
Postrouting on VM through to Cisco Device…
sudo iptables -I POSTROUTING -s 80.74.22.64/255.255.255.224 -d 109.231.196.34 -j ACCEPT
Cisco Router: on WAN IP = 80.74.22.64/32
ip nat inside source static tcp 172.16.24.1 5631 interface dialer 0 5631
ip nat inside source static udp 172.16.24.1 5632 interface dialer 0 5632
!
ip access-list extended 111
permit udp host 109.231.196.34 any eq 5632
permit tcp host 109.231.196.34 any eq 5631
Linux Iptables Output Chain
sudo iptables -I smtp_out 1 -p tcp -s 10.11.254.250 -d 0.0.0.0/0 –dport 25 -j ACCEPT
sudo iptables -I smtp_out 2 -p tcp -s 10.11.254.251 -d 0.0.0.0/0 –dport 25 -j ACCEPT
sudo iptables -I smtp_out 4 -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 –dport 25 -j LOG
sudo iptables -I smtp_out 4 -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 –dport 25 -j DROP
The below statement will log all deny traffic which needs to be entered before the deny statement.
sudo iptables -I smtp_out 4 -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 –dport 25 -j LOG
Run this command to see log messages:
sudo cat /var/log/messages | grep DST=25
sudo cat /var/log/messages | grep 217.154.157.250
Iptables Rules
less <filename> (reads a file)
vi <filename> (edits a file)
Local history file(s)
/.bash_history (records the last entries made, so less the file to read it)
/var/lib/iptables/rules-save (records the last entries saved in iptables)
Examples :
iptables -vnL (lists the iptables ruleset)
iptables -vnL – t nat (lists the iptables nat tables, i.e PREROUTING,POSTROUTING)
1. Inserts a rule in the INPUT chain at line 5 that allows 10.10.0.0/16 to 1.1.1.1
iptables -I INPUT 5 -s 10.10.0.0/16 -d 1.1.1.1 -j ACCEPT
2. Deletes the above rule :
iptables -D INPUT 5
-A will append the rule to the Chain, rather than insert it
-I will insert the rule to the Chain, rather than append it
3. REDIRECT port 80 traffic to port 8080
iptables -I PREROUTING 9 -t nat -s 1.1.1.1 -p tcp -m tcp –dport 80 -j REDIRECT –to-ports 8080
4. Source NAT everything from 1.1.1.1 to go out as 2.2.2.2
iptables -I POSTROUTING 20 -t nat -s 1.1.1.1 -o eth1 -j SNAT –to-source 2.2.2.2
5. Allows 1.1.1.1 to talk to our ranges and vpn box
iptables -I POSTROUTING 8 -t nat -s 1.1.1.1 -d 83.44.16.6 -j ACCEPT
iptables -I POSTROUTING 12 -t nat -s 1.1.1.1 -d 83.44.16.8/29 -j ACCEPT
6. /etc/init.d/iptables save (saves the changes made to iptables)
7. DNATs, SNATs and ports
-i eth1 (for in port)
-o eth1 (for out port)
–dport <port number> (destination port) –to <ip address> (NAT to an IP)
Examples :
Adds a rule in to POSTROUTING chain, to SNAT everything out of eth0 with a source address of 172.16.26.1 to 83.44.16.6
iptables -I POSTROUTING 6 -t nat -o eth0 -s 172.16.26.1 -j SNAT –to 83.44.16.6
8. Adds a rule in PREROUTING to DNAT everything from 83.44.16.6 on tcp port 443 to 172.16.209.201
iptables -t nat -I PREROUTING -d 83.44.16.6 -p tcp –dport 443 -j DNAT –to 172.16.209.201
9. Adds a rule in the FORWARD chain allowing everything from 10.10.1.2 with a destination tcp port of 25
iptables -I FORWARD -s 10.10.1.2 -p tcp –dport 25 -j ACCEPT
Iptables Filtered Web Rule
-A filtered_web -d 206.190.60.37 -p tcp -m tcp –dport 443 -j DROP
-A filtered_web -d 68.180.206.184 -p tcp -m tcp –dport 443 -j DROP
-A filtered_web -d 68.180.206.184 -p tcp -m tcp –dport 443 -j DROP
-A filtered_web -p tcp -m tcp –dport 443 -j DNAT