1. Network and System Security Risk Assessment
Firewall

2. Review Last week, we have talked about sniffer and firewall
Sometimes, sniffer can sniff users’ private information
http, telnet….
Wireshark sniffing on the network
Firewall can control a computer/network communication
Iptables, ufw

3. Review Stateful firewall
Traditional: to allow outgoing website visiting and to drop other communication
To allow input tcp with source port 80 and ack
Can’t visit websites on ports other than 80
To use stateful firewall
State tracking
sudo iptables -A OUTPUT -p tcp --dport 80 -j DROP
sudo iptables -A INPUT -p udp -j ACCEPT (DNS)
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -p tcp --sport 80 --tcp-flags SYN,ACK,RST,FIN ACK -j ACCEPT

4. Practice Iptables Examples
Prevent a machine from telneting to other machines
Prevent a telnet server from being connected by other machines
Prevent inner network from connecting a social network
iptables -A OUTPUT -p tcp --dport 23 -j DROP
Iptables –A INPUT –p tcp –dport 23 –j DROP
Iptables –A INPUT –p tcp –d –j DROP

5. Practice Iptables examples Disable to be pinged, enable to ping
To limit the number of pings
To change the source IP of a ping packet sent out from our machine
sudo iptables -A INPUT -p icmp --icmp-type 8 -j DROP
iptables -P INPUT DROP
iptables -A INPUT -I eth0 -p icmp -m state --state ESTABLISH,RELATED -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
sudo iptables -t nat -A POSTROUTING -p icmp --icmp-type 8 -j SNAT --to-source

6. Practice Allow outgoing web access; Disable all other communication
iptables –A INPUT –p tcp –sport 80 –j ACCEPT
Problem?

7. Practice Iptables example To act as a firewall (protect inner network)
To enable packet forward
Find /etc/sysctl.conf
sudo sysctl –p /etc/sysctl.conf
to redirect the input packet to a specific website
To change the source and dst
to change the reply packet to a specific source and port
sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination :80
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 80 -j DNAT --to-destination  :80
Iptables –t nat –A PREROUTING –p tcp –dport 8123 –j DNAT –to :80
sudo iptables -t nat -A PREROUTING -p tcp --dport j DNAT --to :80
sudo iptables -t nat -A POSTROUTING -p tcp -s j SNAT --to
sudo iptables -t nat -A PREROUTING -p tcp -s sport 80 -j DNAT --to
sudo iptables -t nat -A POSTROUTING -p tcp -s sport 80 -j SNAT --to :8123

8. Practice Iptables example To stop conntrack
sudo iptables -t raw -A OUTPUT -j NOTRACK
sudo iptables -t raw -A PREROUTING -j NOTRACK

9. Practice Iptables example To act as a firewall (protect inner network)
To enable packet forward
Change the .1 machine to the firewall itself
sudo iptables -t nat -A PREROUTING -p tcp --dport j DNAT --to :80
sudo iptables -t nat -A POSTROUTING -p tcp -s j SNAT --to
sudo iptables -t nat -A PREROUTING -p tcp -s sport 80 -j DNAT --to
sudo iptables -t nat -A POSTROUTING -p tcp -s sport 80 -j SNAT --to :8123
sudo iptables -t nat -A OUTPUT -p tcp --dport j DNAT --to :80

10. Practice Iptables example To disable traffic To enable ftp
Must enable ip_conntrack_ftp
Modprobe ip_conntrack_ftp
You should use ESTABLISHED and RELATED at the same time. Otherwise, either the command or the data connection can’t be established.

11. Practice Iptables example the secure version of telnet: ssh
Besides encryption, ssh has another function: port forwarding
Using ssh port forwarding, firewall rules can be bypassed
sudo iptables -A INPUT -i lo -j ACCEPT
Sudo iptables –t nat –A OUTPUT –p tcp –dport 21 –j DEDIRECT –to-ports 7001

12. SSH服务器拥有一项服务，SSH客户端电脑希望能够使用。但是SSH服务器限定为仅有本机可以使用这种服务。
使用了端口转发之后，TCP 端口 A 与 B 之间现在并不直接通讯，而是转发到了 SSH 客户端及服务端来通讯，从而自动实现了数据加密并同时绕过了防火墙的限制

13. Practice Iptables example
ftp server: only allows localhost ftp service
Also demonstrate ftp data and control connections
On the server, ftp is blocked
On the client, we try to do ssh port forwarding
sudo iptables -t nat -A OUTPUT -p tcp --dport 21 -j DNAT --to-destination :7002
ssh -L 7002:localhost:21

14. Practice Iptables example Support squid to act as a web proxy
iptables -t nat -A PREROUTING  -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 3128