Changes between Version 24 and Version 25 of Csle2022/Agenda/FW
- Timestamp:
- Nov 29, 2022, 9:10:50 PM (2 years ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
Csle2022/Agenda/FW
v24 v25 93 93 }}} 94 94 95 Before making our firewall rules, check your connection to Ubuntu Machine using following methods. Please replace VM ip according to your setup. You can view your ip either using GUI or Terminal. 96 97 1. Ping from your host machine to ubuntu VM 98 {{{ 99 ping <ubuntu VM ip> 100 }}} 101 102 2. Check web server by typing following in your Host machine browser 103 {{{ 104 http://ubuntu VM ip 105 }}} 106 107 3. Using a VNC client. (if you don't have vnc client in host pc, please install) 108 95 109 = Making your First Rule := 96 110 ''' 1. Implementing a DROP rule :''' … … 105 119 We’ll take an example to understand the topic. 106 120 107 Let’s assume we want to block the traffic coming from an IP address 192.168.1. 3. The following command can be used:-108 {{{ 109 sudo iptables -A INPUT -s 192.168.1. 3-j DROP121 Let’s assume we want to block the traffic coming from an IP address 192.168.1.4. The following command can be used:- 122 {{{ 123 sudo iptables -A INPUT -s 192.168.1.4 -j DROP 110 124 }}} 111 125 This may look complicated, but most of it will make sense when we go over the components:- … … 118 132 In this flag the rules are added to the top of the chain. 119 133 120 '''-s 192.168.1. 3:-'''121 The flag -s is used to specify the source of the packet. This tells the iptable to look for the packets coming from the source 192.168.1. 3134 '''-s 192.168.1.4:-''' 135 The flag -s is used to specify the source of the packet. This tells the iptable to look for the packets coming from the source 192.168.1.4 122 136 123 137 '''-j DROP''' 124 138 This specifies what the iptable should do with the packet. 125 139 126 In short, the above command adds a rule to the INPUT chain which says, if any packet arrives whose source address is 192.168.1.3 then drop that packet, that means do not allow the packet reach the computer. 140 In short, the above command adds a rule to the INPUT chain which says, if any packet arrives whose source address is 192.168.1.4 then drop that packet, that means do not allow the packet reach the computer. 141 142 As a result it will disconnect your ssh connection to Ubuntu Machine. 143 144 Now go to Ubuntu Desktop and open the Terminal program and execute following command as root. 127 145 128 146 Once you execute the above command you can see the changes by using the command:- … … 132 150 133 151 The Output would be:- 134 image 152 [[Image(image2.png)]] 135 153 136 154 '''2. Implementing a ACCEPT rule :'''
