laforge
/
laforge-slides
1
0
Fork 0
Code Pull Requests Releases Wiki Activity
laforge-slides/2005/iptables-firewall-heinlein2005/f.mgp

455 lines
13 KiB
Plaintext
Raw Blame History

%include "default.mgp"
%default 1 bgrad
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
IP Tables
addrtype match
matches source/destionation address type
types are UNICAST/LOCAL/BROADCAST/ANYCAST/MULTICAST/...
ah match
matches IPSEC AH SPI (range)
comment match
always matches, allows user to place comment in rule
connmark match
connection marking, see later
conntrack match
more extended version of 'state'
match on timeout, fine-grained state, original tuples
dscp match
matches DSCP codepoint (formerly-known as TOS bits)
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
IP Tables
ecn match
matches ECN bits of tcp and ip header
esp match
matches IPSEC ESP SPI (range)
hashlimit match
dynamic limiting
helper match
allows matching of conntrack helper name
iprange match
match on arbitrary IP address ranges (not a mask)
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
IP Tables
length match
match on packet length
limit
static rate limiting
mac
match on source mac address
mark
match on nfmark (fwmark)
multiport
match on multiple ports
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
IP Tables
owner
match on socket owner (uid, gid, pid, sid, command name)
physdev
match underlying device in case of bridge
pkttype
match link-layer packet type (unicast,broadcast,multicast)
realm
match routing realm
recent
see special section below
tcpmss
match on TCP maximum segment size
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
IP Tables
Targets
very dependent on the particular table
Table specific targets will be discussed later
Generic Targets, always available
ACCEPT accept packet within chain
DROP silently drop packet
QUEUE enqueue packet to userspace
LOG log packet via syslog
ULOG log packet via ulogd
RETURN return to previous (calling) chain
foobar jump to user defined chain
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Packet Filtering
Overview
Implemented as 'filter' table
Registers with three netfilter hooks
NF_IP_LOCAL_IN (packets destined for the local host)
NF_IP_FORWARD (packets forwarded by local host)
NF_IP_LOCAL_OUT (packets from the local host)
Each of the three hooks has attached one chain (INPUT, FORWARD, OUTPUT)
Every packet passes exactly one of the three chains. Note that this is very different compared to the old 2.2.x ipchains behaviour.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Packet Filtering
Targets available within 'filter' table
Builtin Targets to be used in filter table
ACCEPT accept the packet
DROP silently drop the packet
QUEUE enqueue packet to userspace
RETURN return to previous (calling) chain
foobar user defined chain
Targets implemented as loadable modules
REJECT drop the packet but inform sender
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Connection Tracking Subsystem
Connection tracking...
implemented seperately from NAT
enables stateful filtering
implementation
hooks into NF_IP_PRE_ROUTING to track packets
hooks into NF_IP_POST_ROUTING and NF_IP_LOCAL_IN to see if packet passed filtering rules
protocol modules (currently TCP/UDP/ICMP/SCTP)
application helpers currently (FTP,IRC,H.323,talk,SNMP)
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Connection Tracking Subsystem
Connection tracking...
divides packets in the following four categories
NEW - would establish new connection
ESTABLISHED - part of already established connection
RELATED - is related to established connection
INVALID - (multicast, errors...)
does _NOT_ filter packets itself
can be utilized by iptables using the 'state' match
is used by NAT Subsystem
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Connection Tracking Subsystem
State tracking for TCP is obvious
TCP inherently stateful
Two TCP state machines on each end have well-defined behaviour
Passive tracking of state machines
In more recent 2.6.x kernels, tracking of TCP window (seq/ack)
Max idle timeout of fully-established session: 5 days
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Connection Tracking Subsystem
State tracking for UDP: How is this possible?
UDP itself not stateful at all
However, higher-level protocols mostly match request-reply
First packet (request) is assumed to be NEW
First matching reply packet is assumed to confirm connection
Further packets in either direction refresh timeout
Timeouts: 30sec unreplied, 180sec confirmed
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Connection Tracking Subsystem
State tracking on ICMP: What's that?
ICMP Errors (e.g. host/net unreachable, ttl exceeded)
They can always be categorized as RELATED to other connections
ICMP request/reply (ECHO REQUEST, INFO REQUEST)
can be treated like UDP request/reply case
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Connection Tracking Subsystem
State tracking on SCTP: What's SCTP?
Streaming Control Transfer Protocol
Linux has SCTP in the network stack, so why should the packet filter not support it?
Pretty much like TCP in most cases
Doesn't support more advanced features such as failover of an endpoint
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Connection Tracking Subsystem
State tracking on other protocols
'generic' protocol: no layer-4 tuple information
'gre' helper in patch-o-matic
State tracking of higher-layer protocols
implemented as 'connection tracking helpers'
currently in-kernel: amanda, ftp, irc, tftp
currently in patch-o-matic: pptp, h.323, sip, quake, ...
have to be explicitly loaded (ip_conntrack_*.[k]o)
work by issuing so-called "expectations"
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Connection Tracking Subsystem
Exemptions to connection tracking
Usually connection tracking is called first in PRE_ROUTING
Sometimes, filtering is preferred before this conntrack lookup
Therefore, the "raw" table was introduced
In some rare cases, one might want to not track certain packets
The NOTRACK can be used in the "raw" table
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Connection Tracking Subsystem
Configuration / Tuning
module parameter "hashsize"
number of hash table buckets
/proc/sys/net/ipv4/ip_conntrack_max
maximum number of tracked connections
/proc/sys/net/ipv4/ip_conntrack_buckets (read-only)
number of hash table buckets
/proc/net/ip_conntrack
list of connections
/proc/net/ip_conntrack_expect
list of pending expectations
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Connection Tracking Subsystem
Configuration / Tuning
/proc/sys/net/ip_conntrack_log_invalid
log invalid packets?
/proc/sys/net/ip_conntrack_tcp_be_liberal
basically disables window tracking, if "1"
/proc/sys/net/ip_conntrack_tcp_loose
how many packets required until sync in case of pickup
if set to zero, disables pickup
/proc/sys/net/ip_conntrack_tcp_max_retrans
maximum number of retransmitted packets without seeing a n ACK
/proc/sys/net/ip_conntrack_*timeout*
timeout values of respective protocol states
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Network Address Translation
Network Address Translation
Previous Linux Kernels only implemented one special case of NAT: Masquerading
Linux 2.4.x / 2.6.x can do any kind of NAT.
NAT subsystem implemented on top of netfilter, iptables and conntrack
Following targets available within 'nat' Table
SNAT changes the packet's source whille passing NF_IP_POST_ROUTING
DNAT changes the packet's destination while passing NF_IP_PRE_ROUTING
MASQUERADE is a special case of SNAT
REDIRECT is a special case of DNAT
SAME
NETMAP
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Network Address Translation
Source NAT
SNAT Example:
%font "typewriter"
%size 3
iptables -t nat -A POSTROUTING -j SNAT --to-source 1.2.3.4 -s 10.0.0.0/8
%font "standard"
%size 4
MASQUERADE Example:
%font "typewriter"
%size 3
iptables -t nat -A POSTROUTING -j MASQUERADE -o ppp0
%font "standard"
%size 5
Destination NAT
DNAT example
%font "typewriter"
%size 3
iptables -t nat -A PREROUTING -j DNAT --to-destination 1.2.3.4:8080 -p tcp --dport 80 -i eth1
%font "standard"
%size 4
REDIRECT example
%font "typewriter"
%size 3
iptables -t nat -A PREROUTING -j REDIRECT --to-port 3128 -i eth1 -p tcp --dport 80
%font "standard"
%size 5
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Packet Mangling
Purpose of 'mangle' table
packet manipulation except address manipulation
Integration with netfilter
'mangle' table hooks in all five netfilter hooks
priority: after conntrack
Simple example:
%font "typewriter"
%size 3
iptables -t mangle -A PREROUTING -j MARK --set-mark 10 -p tcp --dport 80
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Packet Mangling
Targets specific to the 'mangle' table:
DSCP
manipulate DSCP field
ECN
manipulate ECN bits
IPV4OPTSSTRIP
strip IPv4 options
MARK
change the nfmark field of the skb
TCPMSS
set TCP MSS option
TOS
manipulate the TOS bits
TTL
set / increase / decrease TTL field
CLASSIFY
classify packet (for tc/iproute)
CONNMARK
set mark of connection
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
The raw Table
Purpose of 'raw' table
to allow for filtering rules _before_ conntrack
Targets specific to the 'raw' table:
NOTRACK
don't do connection tracking
The table can also be useful for flood protection rules that happen before traversing the (computational) expensive connection tracking subsystem.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Advanced Netfilter concepts
%size 4
Userspace logging
flexible replacement for old syslog-based logging
packets to userspace via multicast netlink sockets
easy-to-use library (libipulog)
plugin-extensible userspace logging daemon (ulogd)
Can even be used to directly log into MySQL
Queuing
reliable asynchronous packet handling
packets to userspace via unicast netlink socket
easy-to-use library (libipq)
provides Perl bindings
experimental queue multiplex daemon (ipqmpd)
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Advanced Netfilter concepts
Firewalling on a Bridge (ebtables + iptables)
totally transparent to layer 2 and above
no attack vector since firewall has no IP address
even possible to do NAT on the bridge
or even NAT of MAC addresses
ipset - Faster matching
iptables are a linear list of rules
ipset represents a 'group' scheme
Implements different data types for different applications
hash table (for random addresses)
bitmask (for let's say a /24 network)
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Advanced Netfilter concepts
ipv6 packet filtering
ip6tables almost identical to iptables
no connection tracking in mainline yet, but patches exist
ip6_conntrack
initial copy+paste 'port' by USAGI
was not accepted because of code duplication
nf_conntrack
generalized connection tracking, supports ipv4 and ipv6
mutually exclusive with ip_conntrack
as of now, no ipv4 nat on to of nf_conntrack
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
netfilter/iptables tutorial
Thanks
Thanks to
the BBS scene, Z-Netz, FIDO, ...
for heavily increasing my computer usage in 1992
KNF (http://www.franken.de/)
for bringing me in touch with the internet as early as 1994
for providing a playground for technical people
for telling me about the existance of Linux!
Alan Cox, Alexey Kuznetsov, David Miller, Andi Kleen
for implementing (one of?) the world's best TCP/IP stacks
Paul 'Rusty' Russell
for starting the netfilter/iptables project
for trusting me to maintain it today
Astaro AG
for sponsoring parts of my netfilter work
View Git Blame Copy Permalink