DOCSLIB.ORG

Iptables Tutorial 1.2.2

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Iptables Tutorial 1.2.2 Iptables Tutorial 1.2.2 Oskar Andreasson [email protected] Iptables Tutorial 1.2.2 by Oskar Andreasson Copyright © 2001-2006 Oskar Andreasson Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1; with the Invariant Sections being "Introduction" and all sub-sections, with the Front-Cover Texts being "Original Author: Oskar Andreasson", and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License". All scripts in this tutorial are covered by the GNU General Public License. The scripts are free source; you can redistribute them and/or modify them under the terms of the GNU General Public License as published by the Free Software Foundation, version 2 of the License. These scripts are distributed in the hope that they will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License within this tutorial, under the section entitled "GNU General Public License"; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA Dedications I would like to dedicate this document to my wonderful sister, niece and brother-in-law for giving me inspiration and feedback. They are a source of joy and a ray of light when I have need of it. Thank you! A special word should also be extended to Ninel for always encouraging my writing and for taking care of me when I needed it the most. Thank you! Second of all, I would like to dedicate this work to all of the incredibly hard working Linux developers and maintainers. It is people like those who make this wonderful operating system possible. 3 Table of Contents About the author............................................................................... xiv How to read ....................................................................................... xvi Prerequisites................................................................................... xviii Conventions used in this document............................................... xix 1. Introduction...................................................................................... 1 Why this document was written .................................................... 1 How it was written ......................................................................... 1 Terms used in this document ........................................................ 2 What’s next? ................................................................................. 4 2. TCP/IP repetition.............................................................................. 5 TCP/IP Layers............................................................................... 5 IP characteristics .......................................................................... 9 IP headers .................................................................................. 12 TCP characteristics..................................................................... 17 TCP headers............................................................................... 18 UDP characteristics .................................................................... 21 UDP headers .............................................................................. 22 ICMP characteristics................................................................... 23 ICMP headers............................................................................. 24 ICMP Echo Request/Reply ................................................ 25 ICMP Destination Unreachable .......................................... 26 Source Quench .................................................................. 28 Redirect.............................................................................. 29 TTL equals 0 ...................................................................... 30 Parameter problem............................................................. 31 Timestamp request/reply.................................................... 31 Information request/reply ................................................... 32 SCTP Characteristics ................................................................. 33 Initialization and association .............................................. 35 Data sending and control session ...................................... 35 Shutdown and abort ........................................................... 35 SCTP Headers............................................................................ 36 SCTP Generic header format............................................. 36 iv SCTP Common and generic headers ................................ 37 SCTP ABORT chunk.......................................................... 40 SCTP COOKIE ACK chunk................................................ 41 SCTP COOKIE ECHO chunk............................................. 41 SCTP DATA chunk ............................................................. 42 SCTP ERROR chunk ......................................................... 44 SCTP HEARTBEAT chunk ................................................. 45 SCTP HEARTBEAT ACK chunk......................................... 46 SCTP INIT chunk ............................................................... 46 SCTP INIT ACK chunk....................................................... 50 SCTP SACK chunk ............................................................ 52 SCTP SHUTDOWN chunk................................................. 55 SCTP SHUTDOWN ACK chunk......................................... 56 SCTP SHUTDOWN COMPLETE chunk ............................ 56 TCP/IP destination driven routing ............................................... 57 What’s next? ............................................................................... 58 3. IP filtering introduction................................................................. 59 What is an IP filter....................................................................... 59 IP filtering terms and expressions............................................... 61 HowtoplananIPfilter................................................................ 64 What’s next? ............................................................................... 68 4. Network Address Translation Introduction................................. 69 What NAT is used for and basic terms and expressions............. 69 Caveats using NAT ..................................................................... 71 Example NAT machine in theory................................................. 72 What is needed to build a NAT machine ............................ 72 Placement of NAT machines .............................................. 74 How to place proxies .......................................................... 74 The final stage of our NAT machine ................................... 75 What’s next? ............................................................................... 77 5. Preparations................................................................................... 79 Where to get iptables .................................................................. 79 Kernel setup................................................................................ 79 User-land setup .......................................................................... 84 Compiling the user-land applications ................................. 85 Installation on Red Hat 7.1................................................. 87 v What’s next? ............................................................................... 90 6. Traversing of tables and chains ................................................... 92 General ....................................................................................... 92 Mangle table ............................................................................... 99 Nat table.................................................................................... 101 Raw table .................................................................................. 102 Filter table ................................................................................. 102 User specified chains................................................................ 103 What’s next? ............................................................................. 105 7. The state machine ....................................................................... 106 Introduction ............................................................................... 106 The conntrack entries ............................................................... 107 User-land states........................................................................ 109 TCP connections ...................................................................... 112 UDP connections ...................................................................... 117 ICMP connections..................................................................... 119 Default connections .................................................................. 123 Untracked connections and the raw table ................................. 124 Complex protocols and connection tracking ............................. 125 What’s next? ............................................................................
Load more

Recommended publications
  • Pipenightdreams Osgcal-Doc Mumudvb Mpg123-Alsa Tbb
    pipenightdreams osgcal-doc mumudvb mpg123-alsa tbb-examples libgammu4-dbg gcc-4.1-doc snort-rules-default davical cutmp3 libevolution5.0-cil aspell-am python-gobject-doc openoffice.org-l10n-mn libc6-xen xserver-xorg trophy-data t38modem pioneers-console libnb-platform10-java libgtkglext1-ruby libboost-wave1.39-dev drgenius bfbtester libchromexvmcpro1 isdnutils-xtools ubuntuone-client openoffice.org2-math openoffice.org-l10n-lt lsb-cxx-ia32 kdeartwork-emoticons-kde4 wmpuzzle trafshow python-plplot lx-gdb link-monitor-applet libscm-dev liblog-agent-logger-perl libccrtp-doc libclass-throwable-perl kde-i18n-csb jack-jconv hamradio-menus coinor-libvol-doc msx-emulator bitbake nabi language-pack-gnome-zh libpaperg popularity-contest xracer-tools xfont-nexus opendrim-lmp-baseserver libvorbisfile-ruby liblinebreak-doc libgfcui-2.0-0c2a-dbg libblacs-mpi-dev dict-freedict-spa-eng blender-ogrexml aspell-da x11-apps openoffice.org-l10n-lv openoffice.org-l10n-nl pnmtopng libodbcinstq1 libhsqldb-java-doc libmono-addins-gui0.2-cil sg3-utils linux-backports-modules-alsa-2.6.31-19-generic yorick-yeti-gsl python-pymssql plasma-widget-cpuload mcpp gpsim-lcd cl-csv libhtml-clean-perl asterisk-dbg apt-dater-dbg libgnome-mag1-dev language-pack-gnome-yo python-crypto svn-autoreleasedeb sugar-terminal-activity mii-diag maria-doc libplexus-component-api-java-doc libhugs-hgl-bundled libchipcard-libgwenhywfar47-plugins libghc6-random-dev freefem3d ezmlm cakephp-scripts aspell-ar ara-byte not+sparc openoffice.org-l10n-nn linux-backports-modules-karmic-generic-pae
    [Show full text]
  • Iptables Tutorial 1.2.2
    Iptables Tutorial 1.2.2 Oskar Andreasson [email protected] Marc Blanc [email protected] Publié par : Philippe Latu philippe.latu(at)inetdoc.net http://www.inetdoc.net Dédicaces Je voudrais dédier ce document à ma merveilleuse soeur pour m'avoir inspiré et donné ses conseils en retour. Elle est une source de joie et un rayon de soleil quand j'ai besoin d'elle. Merci ! Un mot particulier pour Ninel pour m'avoir toujours encouragé dans mon travail et avoir pris soin de moi quand j'en avais le plus besoin. Merci ! Ensuite, j'aimerais dédicacer ce travail à tous les courageux développeurs et mainteneurs de Linux. Ce sont eux qui font exister ce fabuleux système d'exploitation. Iptables Tutorial 1.2.2 i Table des matières À propos de l'auteur .............................................................................................................................. vii Exploration de ce document .................................................................................................................. viii Préalables ............................................................................................................................................... ix Conventions utilisées dans ce document .................................................................................................. x 1. Introduction ......................................................................................................................................... 1 1.1. Motivations ..............................................................................................................................
    [Show full text]
  • Les Systèmes D'exploitation
    Cours IN201 Année 2010-2011 Les Systèmes d’Exploitation Responsable : Bertrand Collin. Auteurs : Bertrand Collin, Marc Baudoin, Manuel Bouyer, Jérôme Gueydan, Thomas Degris, Fré- déric Loyer, Damien Mercier. École nationale supérieure de techniques avancées Copyright c Bertrand Collin 2009–2011 Ce document est mis à disposition selon les termes du contrat Creative Com- mons « Paternité - Pas d’utilisation commerciale - Partage des conditions initiales à l’identique » 2.0 France : http://creativecommons.org/licenses/by-nc-sa/2.0/fr/ Vous êtes libre : – de reproduire, distribuer et communiquer cette création au public ; – de modifier cette création. Selon les conditions suivantes : Paternité. Vous devez citer le nom de l’auteur original de la manière indiquée par l’auteur de l’œuvre ou le titulaire des droits qui vous confère cette autorisation (mais pas d’une manière qui suggérerait qu’ils vous soutiennent ou approuvent votre utilisation de l’œuvre). Pas d’utilisation commerciale. Vous n’avez pas le droit d’utiliser cette création à des fins commerciales. Partage des conditions initiales à l’identique. Si vous modifiez, transformez ou adaptez cette création, vous n’avez le droit de distribuer la création qui en résulte que sous un contrat identique à celui-ci. – À chaque réutilisation ou distribution de cette création, vous devez faire appa- raître clairement au public les conditions contractuelles de sa mise à disposition. La meilleure manière de les indiquer est un lien vers cette page Web. – Chacune de ces conditions peut être levée si vous obtenez l’autorisation du titulaire des droits sur cette œuvre. – Rien dans ce contrat ne diminue ou ne restreint le droit moral de l’auteur ou des auteurs.
    [Show full text]
  • Operating System Stability and Security Through Process Homeostasis
    Operating System Stability and Security through Process Homeostasis by Anil Buntwal Somayaji B.S., Massachusetts Institute of Technology, 1994 DISSERTATION Submitted in Partial Fulfillment of the Requirements for the Degree of Doctor of Philosophy Computer Science The University of New Mexico Albuquerque, New Mexico May 2002 c 2002, Anil Buntwal Somayaji ! iii Dedication To all those system administrators who spend their days nursemaiding our computers. iv Acknowledgments Graduate school has turned out to be a long, difficult, but rewarding journey for me, and I would not have made it this far without the help of many, many people. I cannot hope to completely document how these influences have helped me grow; nevertheless, I must try and acknowledge those who have accompanied me. First, I would like to thank my committee: David Ackley, Rodney Brooks, Barney Maccabe, Margo Seltzer, and especially my advisor, Stephanie Forrest. They all had to read through a rougher manuscript than I would have liked, and had to do so under significant time pressures. They provided invaluable feedback on my ideas and experiments. Most importantly, they have been my teachers. I’m also grateful to have been part of the Adaptive Computation Group at the University of New Mexico and to have been a member of the complex adaptive systems community here in New Mexico. Fellow graduate students at UNM and colleagues at the Santa Fe Institute have shaped my thoughts and have inspired me to do my best work. I will miss all of you. The Computer Science Department at UNM has been my home for the past several years.
    [Show full text]
  • CERIAS Tech Report 2002-41 a RECURSIVE SESSION TOKEN PROTOCOL for USE in COMPTUER FORENSICS and TCP TRACEBACK by Brian Carrier
    CERIAS Tech Report 2002-41 A RECURSIVE SESSION TOKEN PROTOCOL FOR USE IN COMPTUER FORENSICS AND TCP TRACEBACK by Brian Carrier & Clay Shields Center for Education and Research in Information Assurance and Security, Purdue University, West Lafayette, IN 47907 A Recursive Session Token Protocol For Use in Computer Forensics and TCP Traceback Brian Carrier Clay Shields Center for Education and Research in Department of Computer Science Information Assurance and Security (CERIAS) Georgetown University Purdue University Washington, D.C., 20007 West Lafayette, IN 47907 [email protected] [email protected] C C 0 1 C n−1 We present the Session TOken Protocol (STOP) [5], which H H H H H 0 1 2 n−1 n is based on the ident protocol, and helps forensic investiga- tion of stepping-stone chains while protecting the privacy of H H Fig. 1. Connection chain example between 0 and n users. STOP saves application-level data about the process and user that opened the socket, and can also send requests to pre- vious hosts to identify other hosts in the chain. At each stage, Abstract— We introduce a new protocol designed to assist in the forensic a hashed token is returned; at no point in the protocol does the investigation of malicious network-based activity, specifically ad- requester ever directly learn user or process data. Instead, they dressing the stepping-stone scenario in which an attacker uses a must redeem the token to the system administrator who can de- chain of connections through many hosts to hide his or her iden- termine the merit of releasing user information.
    [Show full text]
  • Kevells Documentation Release 0.1
    kevells Documentation Release 0.1 kevell April 27, 2015 Contents 1 About pharaohtools 1 1.1 Commands................................................1 2 Indices and tables 497 i ii CHAPTER 1 About pharaohtools Welcome to the pharaohtools documentation! The Pharaohs has its own benefit while comparing to other tools as it is user friendly. In this tool the coding and the entire process depends and based php. As the pharaoh tool is framed as per php, it is easier to re-write the codes if required. Its modules functionality provides support to Mac, Linux or Unix, and also for the windows. It is a known as a shorter route which is less time-consuming, limits the use of manpower, reduces the necessity of input from users while installation. No need to download separately the templates and plug-ins that are used to support the software’s as everything gets covers under a single root. It is extensible, as if any extra module is required the user can frame and design the module as per their requirements and they can include. It is also simpler to rewrite the coding as required. By installing a single application ptconfigure entire modules under the pharaoh tool get enveloped. 1.1 Commands 1.1.1 Jrush Cache Synopsis Jrush auxiliary to clear cache in temporary memory. It has two types of cache. But both are having different functions as specified in their name. They are site clear and admin clear. It is gratified with Ubuntu and cent OS. Deleting files, folders and applications – and clearing the data from the temporary memory – won’t do the trick if you’re going to recycle the content wont be available in your computer.
    [Show full text]
  • Step by Step Linux Guide By
    Step by Step Linux Guide by M. B. G. Suranga De Silva Step by Step Linux Guide, describes the system administration aspects of using Linux. It is intended for people who know nothing about system administration. This book TM Step by Step Linux Guide. Page 1 doesn’t tell you how to install Linux since it is very straight forward but it gives you real world mail, DNS, proxy, web, messaging etc… server installations and configurations. System administration is all the things that one has to do to keep a computer system in a useable shape. It Includes things like backing up files and restoring , installing new programs, creating accounts for users, making certain that the filesystem is not corrupted, and so on. There is no one official Linux distribution, so different people have different setups, and many people have a setup they have built up themselves. This book is not targeted at any one distribution, even though I use Red Hat Linux 8 and 9 the contents can be applied to any distribution. Many people have helped me with this book, directly or indirectly. I would like to especially thank my own brother Dilan Kalpa De Silva, Luckshika Jayadeva for her excellent type-setting, my ever loving mother, two sisters and my aunt Mallika Vitharana. TM Step by Step Linux Guide. Page 2 Quick Configs Jabberd Sendmail Qpopper Qmail CourrierIMAP Server Squirrelmail DHCP Server PHP and Mysql PostGRE File Server Squid Squidguard Iptables Freeradius Apache Apache Monitoring Tool (AWTStats) Samba DNS Bind OpenLDAP NoCatAuth Load Balancers Load Sharing Network Monitoring Tool (nagios) Kernal Recompilation Java in Linux Linux commands in brief TM Step by Step Linux Guide.
    [Show full text]
  • Operating System Stability and Security Through Process Homeostasis
    Operating System Stability and Security through Process Homeostasis by Anil Buntwal Somayaji B.S., Massachusetts Institute of Technology, 1994 DISSERTATION Submitted in Partial Fulfillment of the Requirements for the Degree of Doctor of Philosophy Computer Science The University of New Mexico Albuquerque, New Mexico July 2002 c 2002, Anil Buntwal Somayaji iii iv Dedication To all those system administrators who spend their days nursemaiding our computers. v vi Acknowledgments Graduate school has turned out to be a long, difficult, but rewarding journey for me, and I would not have made it this far without the help of many, many people. I cannot hope to completely document how these influences have helped me grow; nevertheless, I must try and acknowledge those who have accompanied me. First, I would like to thank my committee: David Ackley, Rodney Brooks, Barney Maccabe, Margo Seltzer, and especially my advisor, Stephanie Forrest. They all had to read through a rougher manuscript than I would have liked, and had to do so under significant time pressures. They provided invaluable feedback on my ideas and experiments. Most importantly, they have been my teachers. I'm also grateful to have been part of the Adaptive Computation Group at the University of New Mexico and to have been a member of the complex adaptive systems community here in New Mexico. Fellow graduate students at UNM and colleagues at the Santa Fe Institute have shaped my thoughts and have inspired me to do my best work. I will miss all of you. The Computer Science Department at UNM has been my home for the past several years.
    [Show full text]
  • Linux IP Masquerade HOWTO
    Linux IP Masquerade HOWTO David A. Ranch <[email protected]> May 22, 2005 May 22, 2005 This document describes how to enable the Linux IP Masquerade feature on a given Linux host. IP Masquerade is a form of Network Address Translation or NAT which NAT allows internally connected computers that do not have one or more registered Internet IP addresses to communicate to the Internet via the Linux server's Internet IP address. Linux IP Masquerade HOWTO Table of Contents Chapter 1. Introduction......................................................................................................................................1 1.1. Introduction to IP Masquerading or IP MASQ.................................................................................1 1.2. Foreword, Feedback & Credits.........................................................................................................1 1.3. Copyright & Disclaimer....................................................................................................................2 Chapter 2. Background Knowledge..................................................................................................................3 2.1. What is IP Masquerade?...................................................................................................................3 2.2. Current Status...................................................................................................................................3 2.3. Who Can Benefit From IP Masquerade?..........................................................................................4
    [Show full text]
  • Iptables Tutorial 1.2.2
    Iptables Tutorial 1.2.2 Oskar Andreasson [email protected] Iptables Tutorial 1.2.2 by Oskar Andreasson Copyright © 2001-2006 Oskar Andreasson Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1; with the Invariant Sections being "Introduction" and all sub-sections, with the Front-Cover Texts being "Original Author: Oskar Andreasson", and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License". All scripts in this tutorial are covered by the GNU General Public License. The scripts are free source; you can redistribute them and/or modify them under the terms of the GNU General Public License as published by the Free Software Foundation, version 2 of the License. These scripts are distributed in the hope that they will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License within this tutorial, under the section entitled "GNU General Public License"; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA Dedications I would like to dedicate this document to my wonderful sister, niece and brother-in-law for giving me inspiration and feedback. They are a source of joy and a ray of light when I have need of it. Thank you! A special word should also be extended to Ninel for always encouraging my writing and for taking care of me when I needed it the most.
    [Show full text]
  • A Recursive Session Token Protocol for Use in Computer Forensics and TCP Traceback
    A Recursive Session Token Protocol For Use in Computer Forensics and TCP Traceback Brian Carrier Clay Shields Center for Education and Research in Department of Computer Science Information Assurance and Security (CERIAS) Georgetown University Purdue University Washington, D.C., 20007 West Lafayette, IN 47907 [email protected] [email protected] C C 0 1 C n−1 We present the Session TOken Protocol (STOP) [5], which H H H H H 0 1 2 n−1 n is based on the ident protocol, and helps forensic investiga- tion of stepping-stone chains while protecting the privacy of H H Fig. 1. Connection chain example between 0 and n users. STOP saves application-level data about the process and user that opened the socket, and can also send requests to pre- vious hosts to identify other hosts in the chain. At each stage, Abstract— We introduce a new protocol designed to assist in the forensic a hashed token is returned; at no point in the protocol does the investigation of malicious network-based activity, specifically ad- requester ever directly learn user or process data. Instead, they dressing the stepping-stone scenario in which an attacker uses a must redeem the token to the system administrator who can de- chain of connections through many hosts to hide his or her iden- termine the merit of releasing user information. Random ses- tity. Our protocol, the Session TOken Protocol (STOP), enhances sion IDs in the requests allow cycle detection. Additionally, the Identification Protocol (ident) infrastructure by sending re- cursive requests to previous hosts on the connection chain.
    [Show full text]
  • Lista.Txt Thu Jan 01 10:19:02 2015 1 0Ad-Data 2Ping 2Vcard 389
    lista.txt Thu Jan 01 10:19:02 2015 1 0ad-data 2ping 2vcard 389-console 3dchess 3depict 4digits 4g8 4store 6tunnel 7kaa-data 8086tiny 8086tiny-dev 9base 9menu 9wm a2jmidid a2ps a56 a7xpg a7xpg-data aa3d aajm aaphoto abacas abby abcde abcm2ps abcmidi abcmidi-yaps abe abe-data abgate abi-compliance-checker abicheck abinit abinit-doc abiword abiword-common abiword-dbg abiword-plugin-grammar abiword-plugin-mathview abntex abook abootimg abr2gbr abraca abs-guide abtransfers abuse abuse-lib abuse-sfx accerciser accessodf accountsservice acct ace-gperf ace-netsvcs ace-of-penguins acedb-other acedb-other-belvu acedb-other-dotter aces3 acetoneiso acfax lista.txt Thu Jan 01 10:19:02 2015 2 acgvision-agent acheck acheck-rules acheck-rules-fr achilles ack ack-grep acl acl2 acl2-books acl2-books-certs acl2-books-source acl2-doc acl2-emacs acl2-infix acl2-infix-source acl2-source aclock.app acm aconnectgui acorn-fdisk acoustid-fingerprinter acpi-support acpi-support-base acpid acpitool acpitool-dbg actionaz activemq activity-log-manager activiz.net-doc activiz.net-examples ada-reference-manual-2005 ada-reference-manual-2012 adabrowse adacgi1 adacontrol adanaxisgpl adanaxisgpl-data addresses-goodies-for-gnustep addresses.framework addressmanager.app addressview.framework adduser adept adjtimex adlint admesh adminer adns-tools adonthell-data adplay adplug-utils adun.app advancecomp advene advi advi-examples adzapper aegis aegis-doc aegis-tk aegis-web aegisub aegisub-l10n lista.txt Thu Jan 01 10:19:02 2015 3 aeolus aephea aes2501-wy aesfix aeskeyfind aeskulap
    [Show full text]