ACTIVE/PASSIVE FTP & IPTABLES FIREWALL

ACTIVE PASSIVE FTP & IPTABLES FIREWALL

FTP Server : To control FTP server is very tricky. To be able to control FTP you must first know how the ftp server behaves. The ftp server behaves in two modes active mode (this is default in windows) passive mode (this is default in linux) first we will try to understand these terms & then how to control ftp through firewall Active FTP: one connection is made by client (FIREWALL) & other connection in opposite direction by FTP Server. in the case of stateless firewalls, active ftp poses great threats. In active ftp, the server makes connections to random ports of client (in this case FIREWALL) so from FIREWALL point of view it becomes difficult which ports to open. How Active FTP works: (1) client (FIREWALL) connects from port 1024 (>1023, assume 1024) to the control port (cmd port) 21 on FTP server side & also sends the PORT 192,168,0,211,154,208 . (2) Sever acknowledges to clients control port 1024 (3) FTP server connection from data port 20 to client's (FIREWALL) data port (154x256+208=39632) (4) client (FIREWALL) sends acknowledgement from data port 39632 to FTP server data port 20 we have written following rules keeping in mind above scenario

# iptables -t filter -A OUTPUT -p tcp –dport 21 -m state –state NEW,ESTABLISHED -j ACCEPT # iptables -t filter -A INPUT -p tcp –sport 21 -m state –state ESTABLISHED -j ACCEPT # iptables -t filter -A INPUT -p tcp –sport 20 -m state –state ESTABLISHED,RELATED -j ACCEPT # iptables -t filter -A OUTPUT -p tcp –dport 20 -m state –state ESTABLISHED -j ACCEPT

Passive FTP: both the connections are made by the client (FIREWALL) in the same direction, one of them to port higher than 1023 on server side. How Passive FTP works: (1) client (FIREWALL) connects from port 1024 (>1023, assume 1024) to the control port (cmd port) 21 on FTP server side & also sends the PASV. (2) Sever acknowledges to clients control port 1024 & sends 192,168,0,201,122,8 (3) client connection from data port 1025 to FTP server data port (122x256+8=31240) (4) Server sends acknowledgement from data port 31240 to client (FIREWALL) data port 1025 we have written following rules keeping in mind above scenario

# iptables -t filter -A OUTPUT -p tcp –dport 21 -m state –state NEW,ESTABLISHED -j ACCEPT # iptables -t filter -A INPUT -p tcp –sport 21 -m state –state ESTABLISHED -j ACCEPT # iptables -t filter -A OUTPUT -p tcp –sport 1024: --dport 1024: -m state –state ESTABLISHED,RELATED -j ACCEPT # iptables -t filter -A INPUT -p tcp –sport 1024: --dport 1024: -m state –state ESTABLISHED -j ACCEPT

NEW : a client requesting new connection ESTABLISHED: a connection that is part of already established connection RELATED: a connection that is requesting a new connection but part of existing connection INVALID: if none of the above states then invalid 

 

 

Full Course on Mastering Iptables Firewall available at Udemy. Join Course 

Setting DMZ with iptables

DMZ (Demilitarised Zone)

What is DMZ : we are segmenting our network in such a way that all the users coming through public network (internet) should be able to access our Web, Mail, DNS servers without a danger of compromising our internal network i.e we have divided our resources into two zones, one highly secured (internal) and one semi-secured (DMZ). Also we want that if any how our DMZ gets compromised, no should be able to access our internal network from DMZ zone, but at the same time we want that internal network should be able to access DMZ servers)

Lab set up : Take a system with 3 lan cards & configure it as a router
eth0 (192.168.10.1/24) connected to internal network
eth1 (200.0.0.1/24 (assume)) connected to internet (public network)
eth2 (192.168.20.1/24) connected to DMZ network (web server 192.168.20.2/24, mail server 192.168.20.3/24, dns server at 192.168.20.4)

# set the default policy to DROP
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# to configure the system as a router, enable ip forwarding by
sysctl -w net.ipv4.ip_forward=1

# allow traffic from internal (eth0) to DMZ (eth2)

iptables -t filter -A FORWARD -i eth0 -o eth2 -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -t filter -A FORWARD -i eth2 -o eth0 -m state –state ESTABLISHED,RELATED -j ACCEPT

# allow traffic from internet (eth1) to DMZ (eth2)

iptables -t filter -A FORWARD -i eth1 -o eth2 -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -i eth2 -o eth1 -m state –state ESTABLISHED,RELATED -j ACCEPT

#redirect incoming web requests at eth1 (200.0.0.1) of FIREWALL to web server at 192.168.20.2
iptables -t nat -A PREROUTING -p tcp -i eth1 -d 200.0.0.1 –dport 80 -j DNAT –to-dest 192.168.20.2
iptables -t nat -A PREROUTING -p tcp -i eth1 -d 200.0.0.1 –dport 443 -j DNAT –to-dest 192.168.20.2

#redirect incoming mail (SMTP) requests at eth1 (200.0.0.1) of FIREWALL to Mail server at 192.168.20.3

iptables -t nat -A PREROUTING -p tcp -i eth1 -d 200.0.0.1 –dport 25 -j DNAT –to-dest 192.168.20.3

#redirect incoming DNS requests at eth1 (200.0.0.1) of FIREWALL to DNS server at 192.168.20.4

iptables -t nat -A PREROUTING -p udp -i eth1 -d 200.0.0.1 –dport 53 -j DNAT –to-dest 192.168.20.4
iptables -t nat -A PREROUTING -p tcp -i eth1 -d 200.0.0.1 –dport 53 -j DNAT –to-dest 192.168.20.4