Ubuntu/Bespin/Old/Iptables - Revision history

Unknown user: Admin moved page Ubuntu/Bespin/Iptables to Ubuntu/Bespin/Old/Iptables without leaving a redirect

2020-08-19T00:19:19Z

Admin moved page Ubuntu/Bespin/Iptables to Ubuntu/Bespin/Old/Iptables without leaving a redirect

← Older revision

Revision as of 00:19, 19 August 2020

Unknown user: /* Existing Iptables Rules */

2020-07-18T20:50:29Z

Existing Iptables Rules

← Older revision		Revision as of 20:50, 18 July 2020
Line 8:		Line 8:
	* It is important to plan out what services will need to talk to each other		* It is important to plan out what services will need to talk to each other
	* If traffic isn't flowing like it is supposed to, start logging blocked packets, and use tcpdump to see if packets are showing up at the right network interface		* If traffic isn't flowing like it is supposed to, start logging blocked packets, and use tcpdump to see if packets are showing up at the right network interface

			=Installing Stuff=

			To make iptables rules persistent:

			<pre>
			sudo apt-get -y install netfilter-persistent
			</pre>

	=Existing Iptables Rules=		=Existing Iptables Rules=
Line 107:		Line 115:
	sudo netfilter-persistent save		sudo netfilter-persistent save
	</pre>		</pre>


	=Improvements=		=Improvements=

Unknown user at 17:23, 11 July 2020

2020-07-11T17:23:26Z

← Older revision		Revision as of 17:23, 11 July 2020
Line 2:		Line 2:

	We give a walkthru of the current iptables, then cover some improvements we can make.		We give a walkthru of the current iptables, then cover some improvements we can make.

			Summary of important information:
			* Need to restart the docker service after flushing all iptables rules
			* Loopback interfaces can't talk to each other unless explicitly (via rule) or implicitly (via allow all) allowed
			* It is important to plan out what services will need to talk to each other
			* If traffic isn't flowing like it is supposed to, start logging blocked packets, and use tcpdump to see if packets are showing up at the right network interface

	=Existing Iptables Rules=		=Existing Iptables Rules=

Unknown user: /* Final Script */

2020-07-11T17:13:16Z

Final Script

← Older revision		Revision as of 17:13, 11 July 2020
Line 450:		Line 450:
	# Make rules persistent		# Make rules persistent
	sudo netfilter-persistent save		sudo netfilter-persistent save

			# Restore docker iptables rules
			sudo service docker restart
	</pre>		</pre>

Unknown user: /* Save Rules */

2020-07-11T17:13:02Z

Save Rules

← Older revision		Revision as of 17:13, 11 July 2020
Line 324:		Line 324:
	# Restore docker iptables rules		# Restore docker iptables rules
	sudo service docker restart		sudo service docker restart
	~~</pre>~~

	~~==Save Rules==~~

	~~Last bit:~~

	~~<pre>~~
	~~# Make rules persistent~~
	~~sudo netfilter-persistent save~~
	</pre>		</pre>

Unknown user: /* DNS Stops Working */

2020-07-11T17:12:17Z

DNS Stops Working

← Older revision		Revision as of 17:12, 11 July 2020
Line 355:		Line 355:

	Second, I discovered that the line <code>127.0.0.1 localhost</code> was missing from my <code>/etc/hosts</code> file, very suspicious. If that line is missing it also makes sudo suuuuuuper slow.		Second, I discovered that the line <code>127.0.0.1 localhost</code> was missing from my <code>/etc/hosts</code> file, very suspicious. If that line is missing it also makes sudo suuuuuuper slow.

			Last of all, docker creates iptables rules, and I was flushing those, and my DNS depends on everything passing through a PiHole run via a docker container, so when docker fails my DNS fails.

	=Final Script=		=Final Script=

Unknown user: /* Playing Nice with Docker */

2020-07-11T17:00:17Z

Playing Nice with Docker

← Older revision		Revision as of 17:00, 11 July 2020
Line 322:		Line 322:
	sudo netfilter-persistent save		sudo netfilter-persistent save

	# ~~We wiped out~~ docker's iptables rules~~, so restore them~~		# Restore docker iptables rules
	sudo service docker restart		sudo service docker restart
	</pre>		</pre>

Unknown user: /* Updated Rules for Allowing DNS */

2020-07-11T16:59:43Z

Updated Rules for Allowing DNS

← Older revision		Revision as of 16:59, 11 July 2020
Line 306:		Line 306:

	done		done
			</pre>

			==Playing Nice with Docker==

			Something I didn't realize (that probably caused me some frustration a few days ago) was that each time I ran the iptables script, and each time it flushed all of the rules, it also flushed DOCKER iptables rules!

			Helpful article from Docker on the topic of Docker and iptables: https://docs.docker.com/network/iptables/

			It turns out that to allow docker to keep working, you either have to restart (preserving all of the iptables rules we just created, but then starting the docker startup service, which restores all the docker iptables rules), or you have to restart the docker service.

			We modify the script by adding the following line at the very end, to allow docker to restore its rules:

			<pre>
			# Make rules persistent
			sudo netfilter-persistent save

			# We wiped out docker's iptables rules, so restore them
			sudo service docker restart
	</pre>		</pre>

Unknown user: /* Log Dropped Packets */

2020-07-11T16:40:54Z

Log Dropped Packets

← Older revision		Revision as of 16:40, 11 July 2020
Line 319:		Line 319:
	=Troubleshooting=		=Troubleshooting=

	==~~Log~~ Dropped Packets==		==Logging Dropped Packets==

	If you have services that aren't working, troubleshoot by adding logging directives to the bottom of the iptables script:		If you have services that aren't working, troubleshoot by adding logging directives to the bottom of the iptables script:
Line 329:		Line 329:
	iptables -A LOGGING -j DROP		iptables -A LOGGING -j DROP
	</pre>		</pre>

			==DNS Stops Working==

			Once I switched over to the more restrictive iptables script, my DNS queries stopped working. I could still ping 8.8.8.8 so I knew the problem was with the dnsmasq DNS server.

			First, I discovered that it was trying to send queries directly to 8.8.8.8 instead of to the PiHole at 127.53.0.1 (when did that happen??).

			Second, I discovered that the line <code>127.0.0.1 localhost</code> was missing from my <code>/etc/hosts</code> file, very suspicious. If that line is missing it also makes sudo suuuuuuper slow.

	=Final Script=		=Final Script=

Unknown user: /* Final Script */

2020-07-11T16:22:59Z

Final Script

← Older revision		Revision as of 16:22, 11 July 2020
Line 373:		Line 373:
	$ipt -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT		$ipt -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
	# Allow incoming SSH traffic, if part of established conversation		# Allow incoming SSH traffic, if part of established conversation
	$ipt -A INPUT -p tcp --sport 22 -m ~~conntrck~~ --ctstate ESTABLISHED -j ACCEPT		$ipt -A INPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

	########### VPN ###############		########### VPN ###############
Line 379:		Line 379:
	$ipt -A INPUT -p udp --dport 1194 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT		$ipt -A INPUT -p udp --dport 1194 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
	# Allow incoming VPN traffic coming from 1194, part of established conversation		# Allow incoming VPN traffic coming from 1194, part of established conversation
	$ipt -A INPUT -p udp --sport 1194 -m ~~conntrck~~ --ctstate ESTABLISHED -j ACCEPT		$ipt -A INPUT -p udp --sport 1194 -m conntrack --ctstate ESTABLISHED -j ACCEPT

	########### HTTP/HTTPS ########		########### HTTP/HTTPS ########
	# Allow incoming HTTP/HTTPS traffic, part of established conversation		# Allow incoming HTTP/HTTPS traffic, part of established conversation
	$ipt -A INPUT -p tcp --sport 80 -m ~~conntrck~~ --ctstate ESTABLISHED -j ACCEPT		$ipt -A INPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT
	$ipt -A INPUT -p tcp --sport 443 -m ~~conntrck~~ --ctstate ESTABLISHED -j ACCEPT		$ipt -A INPUT -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

	########### DHCP ##############		########### DHCP ##############