In this lesson,
you're going to learn what a firewall is,
how it works and how you can configure it
inside a Linux system.
Now if you have a Linux machine,
you already have a certain level of security
enabled by default.
But with the increase in the volume, variety
and intensity of cyber attacks these days,
you really need to understand
how to configure a Linux firewall
as a necessary step to protect yourself and your systems.
In the world of the internet,
there are lots of different servers and computers out there
running without firewalls.
If you're going to run any kind of a server or computer
that's tied to the internet,
you really need to have a firewall
because otherwise the chances of getting hacked
are extremely high.
A properly configured firewall
will block a lot of the malicious traffic,
either based on the IP address of where it's coming from,
the IP address of where it's going to,
or the ports that it's trying to connect to.
Now a firewall is really just a program
that surrounds the interface between a private network
and the rest of the big, bad internet.
You can think of a firewall as a gateway.
And it follows pre-configured rules
that allows certain traffic to pass through it
from the internet into the private network.
And it's going to block a lot of the things
that are unwanted or potentially harmful
if they don't match your allow rules.
Now there are three main generations of firewalls.
The first generation was known as
packet filtering firewalls.
And these make their decisions based on rules
that correspond to one or more network packet attributes.
These rules appear in the form of an access-control list
or ACL.
Now packet filtering firewalls
are also called stateless firewalls
because they only inspect a packet in isolation
and they can't determine what came before
or after that packet to get more valuable context.
To improve upon this,
there was a second generation of firewall created
known as stateful firewalls.
Now stateful firewalls can identify past traffic
that's related to a packet.
And this means that stateful firewall
can actually view the entire conversation
of a given transmission.
For example, it can detect
that there was a three-way handshake that occurred
or that you started the conversation
and the other servers just responding to you.
This is the idea of using a stateful firewall
because they can make more informed decisions
about what traffic they should deny or allow
based on what happened before.
Over time, firewalls got even better
and we created what's known as a third generation firewall.
These third generation firewalls
are also called application layer firewalls
or application aware firewalls
because they can inspect the contents
of application layer traffic
such as protocols like HTTP and FTP.
And then they can make decisions
based on the contents that they're seeing in those packets.
By using an application aware firewall,
you can detect attempts to bypass traditional filtering
and stateful inspection
that leverages known software exploit.
And so an application layer firewall
really is the best of these three generations.
Now a stateless firewall's ACL
is still used by all three generations though.
And a stateless firewall ACL can allow or deny packets
based on various factors such as the source IP address,
the destination IP address, the source TCP or UDP port
that you're sending traffic from,
the destination TCP or UDP port
that you're trying to send traffic to
and the TCP or UDP protocol
that's actually being used for this conversation.
Now once the firewall matches traffic
to a given rule in the ACL,
it can then perform one of three actions.
It can accept it, it can reject it or it can drop it.
Now accept means that the traffic is going to be allowed
through the firewall and sent onto its destination.
When you reject it,
this means that the traffic is blocked at the firewall
and the firewall is going to send a message back to the sender
to say, I rejected it.
I didn't let this traffic go through.
Drop means that the traffic is simply blocked
at the firewall,
but the firewall is not going to notify the sender
and instead it just drops it
and ignores that that packet was ever there
and it never made it into the network.
Now to manage the different ACLs
and packet filtering inside a Linux,
you're going to do this using different tools.
The first one we're going to talk about is iptables.
Now iptables uses different tables
to apply certain contexts or rules
and these rules are known as chains.
And we're going to do all of that inside of Linux
to act as a firewall on our host.
Now a packet is really compared to the first rule
in the appropriate chain of the ACL.
And if it doesn't match that rule,
it's going to go down to the next rule in the chain.
And it's going to continue on
until it either passes through all the rules
or it hits the end of that chain.
Now when a packet matches one of those rules,
it can either be accepted, rejected or dropped
or it can be pushed over to a second set of rules
in a new chain to be further evaluated.
If you want to run iptables,
you can run it by typing in iptables, the options, -t
and the table, commands
and then the chain or rule that you want to specify.
Now iptables has five default tables
that could be activated by default in your kernel.
This includes the filter table,
the nat table, the mangle table, the raw table
and the security table.
Now the first one we have is known as the filter table
which is the default table.
This is going to be used
for typical packet filtering functionality.
The second table is known as the nat table.
And this is used to implement
network address translation rules
going from public to private and private to public.
The mangle table is going to be used to alter packets
TCP/IP headers and be able to change them as you go.
The raw table is going to be used to configure exceptions
for packets that are involved in connection tracking.
And the security table is going to be used to mark packets
with SELinux security context properly.
Now by default, different rule sets within iptables
will be lost on reboot.
In CentOS and Red Hat Enterprise Linux,
you can install the iptable-services package
and issue the service iptables save command
to ensure that your changes will be persistent
between reboots.
If you're using a Debian-based Linux distro,
you can install the iptables-persistent package
and this will allow you to do the same thing.
After you install it,
you'll be asked to confirm
that you want your current rules to be persistent.
If you do, say yes, and then whenever you reboot,
those rules will stay in place.
Once you do this, your ipables-persistent
or iptables-service package
will load up automatically at boot
and load up all your rules for your firewall.
Now you can also enable logging for iptable rules
by yelling into the log action.
Now another thing you might want to enable
inside of iptables is logging.
Logging is a great thing to see
what things are being blocked
and what things are being allowed.
To do this, you're going to include the log action
when issuing the command.
So to create a new chain, you're going to type in
iptables -N, and then the name you want such as log chain.
To ensure all your packets that are coming in,
that were not already processed by a prior rule
will jump to that log chain,
you can do this by typing in iptables -I INPUT -j LOGCHN.
Now if you want to enable logging
of everything that reaches this particular rule or chain,
you can type in iptables -l LOGCHAIN -j LOG
and this will log all the packets that reach the chain
log chain.
Now if you actually want to drop those packets,
you can go ahead and set that up by doing
iptables -l LOGCHN -j DROP
and this will perform the actual dropping of those packets.
Now generally all of your iptable events
are going to be written into your logs
in the /var/log/messages
or /var/log/kern.log file.
Now the next firewall we're going to talk about is known as UFW
or the Uncomplicated Firewall.
Now the Uncomplicated Firewall
is a firewall management tool
that makes it easier to configure the iptables service.
And it's primarily used for home users
who don't have experience with all the intricacies
of a firewall configuration.
You can use the UFW command from the command line.
For example, if I want to set up an allow rule for HTTP,
I can go ahead and do that by typing in ufw allow http/tcp.
Notice how simple it is.
By entering in this single command,
I now am allowing all HTTP traffic
using TCP as its protocol.
If you want to enable logging with UFW,
it's a lot easier than it was in iptables.
To enable logging,
simply type ufw logging on and hit Enter
and this will turn on logging for you.
If you want to enable the firewall,
it's also pretty easy.
Just type in ufw enable
and this will enable the firewall inside of ufw.
Anytime you want to run a command in UFW,
simply type in ufw, the options and the action.
And they usually use this very common English vernacular
to be able to tell it what to do.
If you want to learn all the commands,
you can always go into man UFW and see all about it.
Now if you want to use UFW
to have a more complicated firewall, you can do that too,
but you're going to have to edit a text file to do that.
To do this, first configure your high level settings
like your policy defaults and kernel module usage
inside the /etc/default/ufw file.
If you want more granular control,
you can do that as well by going into the /etc/ufw directory
and editing those files.
Each of these files will allow you to control the rules
when they're going to be applied,
what customizations you want and other things like that
all from within those text files.
Now the next firewall we're going to talk about
is known as the firewall daemon or firewalld.
Now firewalld is a command
that's used to dynamically manage a firewall
without requiring the firewall to restart
upon a modification.
This is an alternative to iptables
and it uses zones and services rather than chains and rules.
Now firewall zones are the rule sets
that can be applied to specific network resources
like a network interface card.
Now there are various default zones
and each of these have different levels of trust.
For example, the zone with the lowest level of trust
is called drop
and it immediately drops all incoming connections.
The firewall-cmd command
is going to enable you to configure the firewalld
or firewall daemon by querying, adding, modifying
and deleting zones and services as you want.
Now because firewalld is the default firewall service
for many Linux distributions
including Red Hat Enterprise Linux and CentOS,
you're going to be using the firewall-cmd command
pretty regularly.
Now the command also includes options to identify which zone
and which interface you want to configure
as well as the ability to permit services by name
or by port number.
To run this command, type in firewall-cmd and the options.
Now there are several different things that you should know
when using the firewall-cmd command.
For example,
if you want to list out all the available firewall zones,
you can do that by typing firewall-cmd --get-zones
and hit Enter.
Now if you want to list out additional details
about the DMZ zone, including its interfaces,
ports, services, protocols and things like that,
you can do that by typing in
firewall-cmd --zone=dmz --list-all.
If you want to be able to add the specified interface
to the DMZ zone,
you can do that by using
firewall-cmd --zone-dmz --change-interface=
and the device ID.
Let's say for example I want to add the HTTP service
to that DMZ zone.
Well, I can do that by typing in
firewall-cmd --zone=dmz --add-service=http.
I think you're getting the idea here.
You use firewall-cmd --zone= the zone you want to modify
and then that thing you want to do.
For example if I wanted to add a port,
I can do --add-port=21/tcp
to add port 21 over TCP
which is used for FTP into that DMZ zone.
If you want to remove a port,
you can do that by typing --remove-port=21/tcp
and that would remove that new port 21 that I just had
for FTP from the DMZ zone.
Now if I want to reload all the zone's configuration,
I can do that by typing in firewall-cmd --reload
and hit Enter and that will reload
all the zone's configuration.
Now like iptables,
firewalld does not persist its changes by default.
This is called the runtime mode.
Now if you wanted to survive a reboot,
you need to commit a change
by using the --permanent option and that way it will persist
after you restart the daemon or reboot your system.
Now the next one we're going to talk about
is known as netfilter.
Now netfilter is a Linux kernel framework
that handles packets that traverse a network interface.
Some of the major services
it's going to provide are packet filtering, nat
and connection tracking.
So it works as a firewall.
netfilter is going to support the configuration
of all these services by providing hooks
into the kernel's network stack.
And every packet that traverses the network interface
is going to be caught by those hooks
and so it can be applied through netfilter.
Both UFW and firewalld call iptables in some capacity.
And likewise, they also call on netfilter.
You'll also see this called nttables
because nftables is netfilter.
Now nftables or netfilter tables
was designed as a replacement for the older iptables
and is installed by default on most
Debian-baseed Linux distributions.
Now one of the functionalities
that these firewalls do for you is IP forwarding.
And IP forwarding
is the way the Linux kernel's implementation
of network routing actually happens.
This enables incoming traffic on the network interface
to be forwarded over to another network interface
if you need to.
IP forwarding is really useful
in systems that have multiple interfaces.
So if you set up a Linux server
to act as a firewall for your entire network
and you have two network interface cards,
one coming in and one going out,
you can use IP forwarding to act as a router or gateway
or firewall in between those two networks.
Now IP sets are another thing we need to talk about.
IP sets are stores collections of IP addresses,
network ranges, MAC addresses, port numbers
and network interface names.
The iptables tool can leverage these different IP sets
for more efficient rule matching.
So for example, let's say you wanted to drop traffic
that originated from one of several IP address ranges
that you know to be malicious.
We're basically calling these the block list.
Instead of configuring rules for each range
and the iptables directly,
we can instead create an IP set
and then reference that in the IP tables rule.
The IP set enables you to create and modify
different IP sets by running the IP set command.
To do this, type in ipset, the options
and then the command you want to use.
The IP set tool can really be used
when you're troubleshooting the iptable's firewall as well.
For example, you can use the test subcommand in IP set
to test whether or not an entry exists.
If the firewall still isn't handling
the IP address ranges as you expected,
you can then list out those rules using the relevance set
and see everything that's in there.
Now another great thing about using IP sets
is that you can then take those files
and put 'em on other systems.
So for example, if you have 20 Linux servers,
instead of having to configure each one individually,
you can reference a common IP set file
across all 20 servers
and they'll all have the same block list.
As you know, many network services and applications
require the use of ports to establish a connection endpoint.
Now most common protocols have a dedicated port number
as assigned by IANA,
the Internet Assigned Numbers Authority.
For example, port 21 is FTP, port 80 is HTTP
and things like that.
However, you sometimes need to run a custom
or uncommon application that requires network access
and you're going to pick your own port for that
because that application
may not have a standardized port number.
In those cases, you're going to need to choose the port number
and then associate it with your application.
And you're going to do that
by opening the port in the firewall.
Now trusted ports also known as privileged ports
are ports inside the well known range of zero to 1023.
In Linux, if a process is starting to listen
on a trusted port or to establish a remote connection
from a trusted port, it must have super user privileges.
This helps that the other side of the connection
confirm that the services they're connecting to
are actually trusted.
Now over time as you configure and implement your firewalls,
you may run into some issues
where the firewall is blocking traffic
when you think it shouldn't.
If this happens, you should check your firewall's rules
to ensure it's not blocking a port
that your system actually needs to forward
for outgoing traffic.
Sometimes the cause of the block
is that you have the protocol blocked
and not the port blocked.
And if you've configured it inside of your set
to block a certain protocol like FTP,
that even if you open up port 21,
it's not going to allow that
because you're blocking it at the application layer.
So keep that in mind as well.
Also, sometimes your ACLs are just too restrictive.
And so you might need to configure an ACL
to open up a little bit more
to allow you to get a known IP address or port range
to be open and available for a connection.
Now in addition to firewalls,
we also have something known as an IPS,
which is an Intrusion Prevention System.
Now an IPS is a security appliance
that monitors and evaluates systems for signs of attacks
and progress.
And it can actively block traffic that deems malicious.
Now firewall is like a security guard
who let's guests into the building
based on whether or not they matched predefined rules.
But an IPS is more akin to somebody who actually looks
deeply into everybody who's going in
and doing full background checks on them.
Even if the outside guard, this firewall lets somebody in,
the inside guard, that IPS,
can actually watch that guest and see what they're doing
and then if it's suspicious, they can kick them out.
In other words, your IPS should be a second layer of defense
that monitors traffic once it makes it past the firewall
and starts looking for anomalous behavior.
Now there are many different IPS solutions available
but two common third party solutions
are DenyHosts and Fail2ban.
Both of which are going to be used to examine log files
for anomalies.
Now DenyHost is primarily going to protect your SSH servers
from brute force password cracking attacks.
In these kind of attacks,
an attacker is attempting to repeatedly
log into an SSH server
using credentials that they change each time.
For example, I start out with AAA and then I go to AAB, AAC
and I keep changing it until I find the right password.
So DenyHost is going to monitor your authentication log
to look for these failed log in entries.
And it's going to take the source IP address
and the number of failed attempts into consideration.
Now Fail2ban is another command we can use
to prevent brute force attacks.
But unlike DenyHost, it doesn't focus on just one service.
Instead, it's going to monitor your log files
that pertain to any system service
that has an authentication component.
It's going to leverage things like iptables
and netfilter as well to perform the blocking actions
and it can even be able to update your firewall rules
for you based on what it sees.
For example, if I see 10 failed login attempts,
I'm going to block that IP address from connecting to me.
The primary configuration file for DenyHost
is located in the /etc/denyhosts.conf file.
There are various settings that you can adjust to this file.
For example, you can use admin_email setting
to define what email address to send your alerts to.
You can use the block_service setting
to define what services will be blocked from access
by unauthorized users.
You can also use the deny_threshold_valid setting
to define how many times a user can attempt to log
into an existing account before they're going to be blocked.
For example, maybe they missed to type the password 10 times
and that's where we're going to block them.
On the other hand, if you're using Fail2ban,
you're going to find the primary configuration file
in /etc/fail2ban/jail.conf.
Now if you're going to configure Fail2ban,
it's a good idea to copy this file over
to /etc/fail2ban/jail.local and make your changes there.
You can also use the bantime setting inside Fail2ban
to define how long a host is going to be blocked
from accessing a resource.
For example, maybe they logged in wrong three times
and you're going to block 'em for 20 minutes.
You can set that using bantime.
You can also set up the maximum retry setting
by using maxretry.
And this will define the number of times
a host can fail to authenticate before they're blocked.
And if you use ignoreip,
this will define a whitelist of acceptable hosts
that can try to log in repeatedly if they need to
without being blocked because you trust them.
For example, this IP might be something like
your system administrator who you trust and know
because they're internal to your network.