Summary(Firewall Networking)

firewalls and networking by examining a sample ruleset and answering questions about it.

These are multipart questions (most have 2 parts). Make sure you answer all parts.

Commands for the firewalls

1. iptables -P FORWARD DROP

2. iptables -P INPUT ACCEPT

3. iptables -A INPUT -s 192.0.2.0/24 -j DROP

4. iptables -A INPUT -i lo -j ACCEPT

5. iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

6. iptables -A INPUT -m state --state NEW -s 198.51.100.0/24 -p tcp --dport 22 -j ACCEPT

7. iptables -A INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT

8. iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT

9. iptables -P INPUT DROP

10.

11. iptables -P OUTPUT ACCEPT

12. iptables -A OUTPUT -o lo -j ACCEPT

13. iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

14. iptables -A OUTPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT

15. iptables -A OUTPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT

16. iptables -A OUTPUT -m state --state NEW -p udp --dport 67 -j ACCEPT

17. iptables -A OUTPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT

18. iptables -A OUTPUT -m state --state NEW -p udp --dport 53 -j ACCEPT

19. iptables -A OUTPUT -m state --state NEW -d 203.0.113.111 -p tcp --dport 3306 -j ACCEPT

20. iptables -A OUTPUT -m state --state NEW -d 203.0.113.45 -p tcp --dport 25 -j ACCEPT

21. iptables -A OUTPUT -m state --state NEW -d 203.0.113.23 -p udp --dport 514 -j ACCEPT

22. iptables -P OUTPUT DROP

Questions

a) Why do we need rule #5? Give a scenario where the machine could be unusable without it.

b) Please explain what rule #3 does, and give one reason the admin may have created this rule.

c) What is the difference between rules 17 and 18, and why do we need both of them?

c.1)Dont just say the service requires it. Research it and state one reason why the service requires it.

d) What do you think the purpose of the system at 203.0.113.23 is? Give an example of a piece of software that may provide that service.

d.1)Example answers [these are not correct]: Its a DNS server, running PowerDNS or Its an XMPP server, possibly running Openfire

d.2)The example you list is just an example you pick -- you have no way of knowing the exact program used from this data.

e) What do you think the purpose of the system at 203.0.113.111 is? Give an example of a piece of software that may provide that service.

f) What do you think the purpose of this system is (the one protected by these firewall rules)?