Mari belajar otodidak: JARINGAN KOMPUTER | Your Short Blog Description Here

Home » Penelusuran JARINGAN KOMPUTER

Part of the Post Set Up Firewall Using Iptables On Ubuntu Part 2 :
Implementing a Drop Rule

We now have four separate rules that explicitly accept packets based on certain criteria. However, our firewall currently is not blocking anything.

If a packet enters the INPUT chain and doesn't match one of the four rules that we made, it is being passed to our default policy, which is to accept the packet anyways. We need to change this.

There are two different ways that we can do this, with some pretty important differences.

The first way we could do this is to modify the default policy of our INPUT chain. We can do this by typing:

· sudo iptables -P INPUT DROP

This will catch any packets that fall through our INPUT chain, and drop them. This is what we call a default drop policy. One of the implications of this type of a design is that it falls back on dropping packets if the rules are flushed.

This may be more secure, but also can have serious consequences if you don't have another way of accessing your server. With DigitalOcean, you can log in through our web console to get access to your server if this happens. The web console acts as a virtual local connection, so iptables rules will not affect it.

You may like your server to automatically drop all connections in the event that the rules are dumped. This would prevent your server from being left wide open. This also means that you can easily append rules to the bottom of the chain easily while still dropping packets as you'd like.

The alternative approach is to keep the default policy for the chain as accept and add a rule that drops every remaining packet to the bottom of the chain itself.

If you changed the default policy for the INPUT chain above, you can set it back to follow along by typing:

· sudo iptables -P INPUT ACCEPT

Now, you can add a rule to the bottom of the chain that will drop any remaining packets:

· sudo iptables -A INPUT -j DROP

The result under normal operating conditions is exactly the same as a default drop policy. This rule works by matching every remaining packet that reaches it. This prevents a packet from ever dropping all of the way through the chain to reach the default policy.

Basically, this is used to keep the default policy to accept traffic. That way, if there are any problems and the rules are flushed, you will still be able to access the machine over the network. This is a way of implementing a default action without altering the policy that will be applied to an empty chain.

Of course, this also means that any rule that any additional rule that you wish to add to the end of the chain will have to be added before the drop rule. You can do this either by temporarily removing the drop rule:

· sudo iptables -D INPUT -j DROP

· sudo iptables -A INPUT new_rule_here

· sudo iptables -A INPUT -j DROP

Or, you can insert rules that you need at the end of the chain (but prior to the drop) by specifying the line number. To insert a rule at line number 4, you could type:

· sudo iptables -I INPUT 4 new_rule_here

If you are having trouble knowing which line number each rule is, you can tell iptables to number the rules by typing:

· sudo iptables -L --line-numbers

Output:

Chain INPUT (policy DROP)

num target prot opt source destination

1 ACCEPT all -- anywhere anywhere

2 ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED

3 ACCEPT tcp -- anywhere anywhere tcp dpt:ssh

4 ACCEPT tcp -- anywhere anywhere tcp dpt:http

Chain FORWARD (policy ACCEPT)

num target prot opt source destination

Chain OUTPUT (policy ACCEPT)

num target prot opt source destination

This can be helpful to make sure you are adding your rule at the appropriate position.

Listing and Deleting Iptables Rules

If you want to learn the details about listing and deleting iptables rules, check out this tutorial: How To List and Delete Iptables Firewall Rules.

Saving your Iptables Configuration

By default, the rules that you add to iptables are ephemeral. This means that when you restart your server, your iptables rules will be gone.

This is actually a feature for some user because it gives them an avenue to get back in if they have accidentally locked themselves out of the server. However, most users will want a way to automatically save the rules you have created and to load them when the server starts.

There are a few ways to do this, but the easiest way is with the iptables-persistent package. You can download this from Ubuntu's default repositories:

· sudo apt-get update

· sudo apt-get install iptables-persistent

During the installation, you will be asked if you would like to save your current rules to be automatically loaded. If you are happy with your current configuration (and you have tested your ability to create independent SSH connections, you can select to save your current rules.

It will also ask you if you want to save the IPv6 rules that you have configured. These are configured through a separate utility called ip6tables which controls the flow of IPv6 packets in almost the same way.

Once the installation is complete, you will have a new service called iptables-persistent that is configured to run at boot. This service will load in your rules and apply them when the server is started.

Saving Updates

If you ever update your firewall and want to preserve the changes, you must save your iptables rules for them to be persistent.

Save your firewall rules with this command:

· sudo invoke-rc.d iptables-persistent save

z 9:53 PM Admin Bandung Indonesia

Set Up Firewall Using Iptables On Ubuntu Part 3 (Finished)

Part of the Post Set Up Firewall Using Iptables On Ubuntu Part 2 : Implementing a Drop Rule We now have four separate rules...

Part of the Post Set Up Firewall Using Iptables On Ubuntu Part 1
A INPUT: The -A flag adds a rule at the end of the chain. This part of the IP tables commands explained we wanted to add a new rule, we want that the rules are added to the end of the chain, and the chain we want to operate is the INPUT chain

-m conntrak: IP tables which have a set of core functionality, and also has a set of extensions or modules that have the extra ability to command part of this, we want to have access to the functionality provided by the conntrack module, mpdul It provides access to commands that are used to make decisions based on packet to the previous connection.

--ctstate: This is the command to invoke module available conntrak. the command allows us to match the packet with the previous packet

j ACCEPT: determining a target packet from which, here we say that the IP tables packet matching the previous criteria should be accepted and allowed through

we can see the changes if we make a list of rules

· sudo iptables -L

Output:

Chain INPUT (policy ACCEPT)

target port opt source destination

ACCEPT all -- anywhere anywhere ctstate RELATED, ESTABLISHED

Chain FORWARD (policy ACCEPT)

target port opt source destination

Chain OUTPUT (policy ACCEPT)

target port opt source destination

Now that you know the general syntax, let's continue by adding some more cases where we want to accept the connection.

Accept Other Necessary Connections

we have been told to keep open connection IP Tables that are already open and allow new connections associated with the connection,

we wanted to keep the two specific ports open, we want to keep the ssh port open (default port is port 22 if you have to change it in the ssh configuration, then you must change it here), we will also assume that the computer is running a web server on the default port 80

two lines of command that we will use in this rule

· sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

· sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

As we have seen, this is very similar to the first, but it might be simpler

-p tcp: This option is suitable packet if the protocol being used is TCP, it is a connection-based protocol that will be used by most applications because it is reliable in communication

-dport: This option is available if -p tcp flag awarded. This provides further requirement of matching the destination port for the packet that matches, the first rule is suitable for TCP packet addressed to port 22 while the second rule matches TCP traffic heading toward the port 80

No one else accepts the rules that we need to make sure that the server can function properly, because often the computer services communicate between client by sending a packet. they do this by utilizing a network interface called a loopback that direct traffic to themselves instead of to other clients. so if one service wants to communicate with other services listening on port 4555 connections, it can send a packet to port 4555 of the loopback device, we want this to be allowed, because it is very important for correct operation for many programs

rules that we need to add

· sudo iptables -I INPUT 1 -i lo -j ACCEPT

This looks a bit different than our other commands. Let's go over what it is doing:

I INPUT 1: The -I flag Tells IP tables to insert a rule.

this is different from the -A flag adds a rule to the end flag-I took the chain from the rule position where you want to insert the new rule.

in this case we add this rule as the first rule from the INPUT chain. This will meet under the rule, we want the top for fundamental and will not be affected by the following rules.

-i lo: This component of emergency rules that match the interface packet use interface "lo". "Lo" interface is another name for the loopback device, this means that all the interfaces that communicate using a packet (packet generated on our servers) must be accepted

to see our current rules, we must use the -S flag. this is because the -l flag does not include some information, such as the interface associated with the rule, which is an important part of the rule we just added

· sudo iptables -S

Output:

-P INPUT ACCEPT

-P FORWARD ACCEPT

-P OUTPUT ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

To be Continue...... z 9:46 PM Admin Bandung Indonesia

Set Up Firewall Using Iptables On Ubuntu Part 2

Part of the Post Set Up Firewall Using Iptables On Ubuntu Part 1 A INPUT: The -A flag adds a rule at the end of the chain. This part of the IP...

Otodidak Learner - Set Up Firewall Using Iptables On Ubuntu: build a good firewall is an important step to secure network systems and operating systems. Most Linux distributions have some firewall that we can use. one of which is IP tables that we will discuss now.

[NOTE]: in this manner include IPv4 security. in Linux, separated from IPv4 IPv6 security, as an example of "IP tables" is only set for IPv4 addresses but still has a relationship with IPv6 called "ip6tables" configured for IPv6 network address

Prerequisites
Before starting IPTables configuration you need to install ubuntu server. in this post-Ubuntu 14:04 and accounts with access rights setup on your ubuntu.

Basic IP tables Commands

I assume that you have a good understanding of the basic concepts of IP tables. to set the IP tables interface in general

First, you should know that the IP tables command must be run with root access. This means you must be logged in as root, using su or sudo -i to access a root shell, or add all the commands with sudo. I will use sudo in this post. for the early stages of the configuration of IP tables you do it with the -l flag

$ sudo iptables -L


Output:
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

as seen we already have 3 default chain (INPUT, OUTPUT, AND FORWARD). we also can see each chain's default policy (each chain has a default policy ACCEPT). we can also see some of the column headers. but we did not see the actual rules since in this case, Ubuntu does not ship with a set of the default rule. we can see that the output command Reflects Necessary to enable each rule and policy by instead using the -S Flag

sudo iptables -S

Once again, the default policy is very important here, because, when all of the policy is removed from your chain, the default policy will not change with this command. it means that you are connected remotely. you also have to make sure the default policy on the INPUT and OUTPUT, chain set to ACCEPT as flushing the rules, you can do so by typing..

sudo iptables -P INPUT ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -F

We can change the default policy to DROP drop. after you set it explicitly rules that allow your connection.

We will make the First Rule

The full rule we need is this:

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

glance looks very complicated, but it will make sense when we all these components

to be continued......

z 8:25 PM Admin Bandung Indonesia

Set Up Firewall Using Iptables On Ubuntu Part 1

Otodidak Learner - Set Up Firewall Using Iptables On Ubuntu: build a good firewall is an important step to secure network systems and operating...

Border Gateway Protocol ( BGP Confederation ) on Mikrotik

Otodidak learner - Previously we have learned about the route reflector which we can use to solve problems on the IBGP full mesh topology Peering....

Border Gateway Protocol ( Route Reflector ) On Mikrotik

Almost same with Border Gateway Protocol ( BGP Backdoor ) then we have to configure Full Mesh Peering. It certainly would be a problem if we have 100 IBGP router, full mesh peering network would be very burdensome.

To overcome these problems, we can configure the route reflector, so that each router IBGP only need to do peering with the route reflector. The following topology which we will use

First, we configure the IP address of the entire router

[admin@MikroTik] > system identity set name=R1

[admin@R1] > interface bridge add name=lo0
[admin@R1] > ip address
[admin@R1] /ip address> add address=22.22.22.1/24 interface=ether1
[admin@R1] /ip address> add address=192.168.0.1/24 interface=lo0

[admin@MikroTik] > system identity set name=R2
[admin@R2] > interface bridge add name=lo0
[admin@R2] > ip address
[admin@R2] /ip address> add address=22.22.22.2/24 interface=ether1
[admin@R2] /ip address> add address=23.23.23.2/24 interface=ether2
[admin@R2] /ip address> add address=192.168.1.1/24 interface=lo0

[admin@MikroTik] > system identity set name=R3
[admin@R3] > interface bridge add name=lo0
[admin@R3] > ip address
[admin@R3] /ip address> add address=23.23.23.3/24 interface=ether1
[admin@R3] /ip address> add address=192.168.3.1/24 interface=lo0

Next we try to create IBGP peering at R1, R2, and R3,

[admin@R1] /ip address> /routing bgp
[admin@R1] /routing bgp> instance set 0 as=123
[admin@R1] /routing bgp> peer add remote-address=22.22.22.2 remote-as=123
[admin@R1] /routing bgp> network add network=192.168.0.0/24

[admin@R2] /ip address> /routing bgp
[admin@R2] /routing bgp> instance set 0 as=123
[admin@R2] /routing bgp> peer add remote-address=22.22.22.1 remote-as=123 route-reflect=yes
[admin@R2] /routing bgp> peer add remote-address=23.23.23.3 remote-as=123 route-reflect=yes
[admin@R2] /routing bgp> network add network=192.168.1.0/24

[admin@R3] /ip address> /routing bgp
[admin@R3] /routing bgp> instance set 0 as=123
[admin@R3] /routing bgp> peer add remote-address=23.23.23.2 remote-as=123
[admin@R3] /routing bgp> network add network=192.168.2.0/24

Note that we configure the router R2 as a reflector (parameter route-reflect = yes). next to the test, we look at the routing table on R1

[admin@R1] /routing bgp> /ip route print 

Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 ADC 22.22.22.0/24 22.22.22.1 ether1 0
1 A S 23.23.23.0/24 22.22.22.2 1
2 ADC 192.168.0.0/24 192.168.0.1 lo0 0
3 ADb 192.168.1.0/24 22.22.22.2 200
4 ADb 192.168.3.0/24 23.23.23.3 200

z 6:24 PM Admin Bandung Indonesia

Border Gateway Protocol ( Route Reflector ) On Mikrotik

Border Gateway Protocol ( Route Reflector ) On Mikrotik Almost same with Border Gateway Protocol ( BGP Backdoor ) then we have to configure Full...

Pages 1 of 6 12 3 4 5 Next Last

Mari belajar otodidak

Recents in Beach

Set Up Firewall Using Iptables On Ubuntu Part 3 (Finished)

Set Up Firewall Using Iptables On Ubuntu Part 2

Otodidak Learner - Set Up Firewall Using Iptables On Ubuntu: build a good firewall is an important step to secure network systems and operating systems. Most Linux distributions have some firewall that we can use. one of which is IP tables that we will discuss now.

Prerequisites
Before starting IPTables configuration you need to install ubuntu server. in this post-Ubuntu 14:04 and accounts with access rights setup on your ubuntu.

Basic IP tables Commands

We will make the First Rule

Set Up Firewall Using Iptables On Ubuntu Part 1

Border Gateway Protocol ( BGP Confederation ) on Mikrotik

Border Gateway Protocol ( Route Reflector ) On Mikrotik

Border Gateway Protocol ( Route Reflector ) On Mikrotik

Romeltea Media

Blog Romeltea

BolaGP Sport

Set Up Firewall Using Iptables On Ubuntu Part 3 (Finished)

Set Up Firewall Using Iptables On Ubuntu Part 2

Otodidak Learner - Set Up Firewall Using Iptables On Ubuntu: build a good firewall is an important step to secure network systems and operating systems. Most Linux distributions have some firewall that we can use. one of which is IP tables that we will discuss now.

PrerequisitesBefore starting IPTables configuration you need to install ubuntu server. in this post-Ubuntu 14:04 and accounts with access rights setup on your ubuntu.

Basic IP tables Commands

We will make the First Rule

Set Up Firewall Using Iptables On Ubuntu Part 1

Border Gateway Protocol ( BGP Confederation ) on Mikrotik

Border Gateway Protocol ( Route Reflector ) On Mikrotik

Border Gateway Protocol ( Route Reflector ) On Mikrotik

Romeltea Media

Blog Romeltea

BolaGP Sport

Prerequisites
Before starting IPTables configuration you need to install ubuntu server. in this post-Ubuntu 14:04 and accounts with access rights setup on your ubuntu.