is the framework in the Linux kernel, which implements the rule and filters provided by the user,
through an interface available to user called
There are 5 "tables": filter, nat, mangle, raw, security.
We only care about the filter table, which has these built-in "chains" of rules: INPUT, FORWARD, OUTPUT.
You can create new chains if you wish.
Each rule ends with an action which can be: ACCEPT, DROP, LOG, or name of another chain.
(There is more, but that's all we need to know.)
To see how much traffic is passing through each section of rules in filter table, do "sudo iptables -L -v"
(can reset counters via "sudo iptables -Z").
On my system, with Windscribe VPN active, after doing a bunch of downloading, that gives:
Chain INPUT (policy ACCEPT 2005K packets, 2860M bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy DROP 306 packets, 21425 bytes)
pkts bytes target prot opt in out source destination
486 75925 ACCEPT all -- any any anywhere 192.168.0.0/16
1104 72461 ACCEPT all -- any any anywhere 10.0.0.0/8
0 0 ACCEPT all -- any any anywhere 172.16.0.0/12
495K 860M ACCEPT all -- any any anywhere localhost
1339 139K ACCEPT all -- any any anywhere 104.20.122.38
1369 143K ACCEPT all -- any any anywhere 104.20.123.38
417K 55M ACCEPT all -- any tun+ anywhere anywhere
0 0 ACCEPT all -- any any anywhere localhost
423K 78M ACCEPT all -- any any anywhere 89.238.nnn.nnn
So my system is doing no routing ("FORWARDing").
And if no rule is matched, the packet gets DROPped if it is output, ACCEPTed if it is input.
To block SSH connections from any address, do "sudo iptables -A INPUT -p tcp --dport ssh -j DROP".
Can do the same with http and https if you're not running a web server.
There is "ip6tables" which is separate but mostly has the same syntax as "iptables".
There is a "conntrack" module which lets you do things such as "ctstate" in rules.
To save changes so they survive across system restart, on Ubuntu-type systems,
do "sudo apt-get install iptables-persistent", then
turn off Windscribe VPN and firewall, then do
"sudo su", and then "iptables-save >/etc/iptables/rules.v4" and "ip6tables-save >/etc/iptables/rules.v6".
You can write commands such as "-P INPUT DROP" into a file such as "iptables.txt"
and then run "sudo su" then "iptables-restore <iptable.txt"
How-To Geek's "The Beginner’s Guide to iptables, the Linux Firewall"
Supriyo Biswas's "An In-Depth Guide to iptables, the Linux Firewall"
Ravi Saive's "Basic Guide on IPTables (Linux Firewall) Tips / Commands"
Mitchell Anicas's "Iptables Essentials: Common Firewall Rules and Commands"
IP sets
I ran a bash file with commands:
iptables -P INPUT DROP
iptables -I INPUT -i lo -j ACCEPT
iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -P FORWARD DROP
Ran Windscribe VPN client which resulted ("iptables -L") in:
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere 192.168.0.0/16
ACCEPT all -- anywhere 10.0.0.0/8
ACCEPT all -- anywhere 172.16.0.0/12
ACCEPT all -- anywhere localhost
ACCEPT all -- anywhere 104.20.123.38
ACCEPT all -- anywhere 104.20.122.38
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere localhost
ACCEPT all -- anywhere 89.238.nnn.nnn
That anywhere-anywhere rule actually has "out=tun+" attached to it (can see that via "iptables -L -v"), so all
that traffic goes through the VPN.
Put DROP on all IPv6 chains; my ISP doesn't support IPv6.
Ran a couple of net-testing apps on my phone (which is on my LAN), targeting my PC, and they show all
ports blocked, no response to ping, no services offered.
If you want to log packets that don't match any rule, and end up getting DROPed by the chain policy,
add a rule at the END of the chain via a command such as
"iptables -A FORWARD -m limit --limit 1/minute -j LOG".
Default logfile for iptables is /var/log/kern.log; "dmesg -T" command shows same log, with some useful coloring added.
I would like to log/detect all applications that create output connections.
But it seems this is very difficult to do in a human-readable way:
Super User's "With Linux iptables, is it possible to log the process/command name that initiates an outbound connection?"
Akkana's "Find out what processes are making network connections"
You can get instantaneous snapshots (not cumulative logs) by running
"ss -tp" or "netstat -A inet -p".
To see IP address and other details about each network interface, run
"ip -d address".
I want to log any incoming attempts on protocols/ports I don't use.
Found this: "You can add the --syn flag to make the rule match only packets
with the SYN flag set, which is set only on new connection attempts."
Maybe do this:
"iptables -I INPUT -p tcp --dport ssh --syn -m limit --limit 1/minute -j LOG --log-prefix "Incoming SSH attempt ""
Do similar for FTP, Telnet, HTTP, HTTPS.
I didn't bother to make rules for TeamViewer (port 5938), Remote Desktop (port 3389),
SMB (port 139), NFS (port 2049), VNC (port 5900), http-alt (port 8080), RTelnet (port 107),
TFTP (port 69), Simple FTP (port 115), rsh (port 514), rsync (port 873),
Telnet-TLS (port 992), PPTP (port 1723), SSDP (port 1900), CIFS (port 3020), UPnP (port 5000),
Socks Proxy (port 1080), Microsoft-DS (port 445) attempts.
You can go a little nuts with this stuff. I think I don't have
listeners active for any of it, but it would be nice to log and drop the packets.
But it turns out you can make one rule for multiple ports, so I made:
"iptables -I INPUT -p tcp --match multiport --dports 5938,3389,139,2049,5900,8080,107,69,115,514,873,992,1723,1900,3020,5000 --syn -m limit --limit 1/minute -j LOG --log-prefix "Incoming suspicious port attempt ""
Limit of 15 port numbers per rule; had to split it into two.
If one of your rules logs incoming HTTP attempts, test it by putting address
"localhost:80" into browser's address field, then looking in logs. Or test
by running "curl localhost" on the CLI.
If one of your rules logs incoming HTTPS attempts, test it by putting address
"https://localhost" into browser's address field, then looking in logs. Or test
by running "curl localhost:443" on the CLI.
If your rules log incoming SSH and/or Telnet and/or FTP attempts, test them by running
"ssh localhost" and/or "telnet localhost" and/or "ftp localhost" in CLI, then looking in logs.
Or doing "curl localhost:22" and/or "curl localhost:23" and/or "curl localhost:21" in CLI, then looking in logs.
But I want to drop the packets after logging them.
So I did this:
iptables -N I_LOG_DROP
iptables -A I_LOG_DROP -m limit --limit 4/minute -j LOG --log-prefix "IPTABLES-I-LOG-DROP: " --log-level 6
iptables -A I_LOG_DROP -j DROP
iptables -P INPUT DROP
iptables -A INPUT -p tcp --match multiport --dports 20,21,22,23,80,5938,3389,139,2049,5900,8080,107 --syn -j I_LOG_DROP
iptables -A INPUT -p tcp --match multiport --dports 69,115,514,873,992,1723,1900,3020,5000 --syn -j I_LOG_DROP
At some point, maybe it's easier to list the ports that should be open, instead
of those that should be blocked. But maybe some high port numbers get opened dynamically.
"iptables -I INPUT -p tcp --match multiport ! --dports 80,443 --syn -m limit --limit 1/minute -j LOG --log-prefix "Incoming suspicious port attempt ""
Did this (in a shell script file):
iptables -F
iptables -Z
iptables -N I_LOG_DROP
iptables -A I_LOG_DROP -m limit --limit 4/minute -j LOG --log-prefix "IPTABLES-I-LOG-DROP: " --log-level 6
iptables -A I_LOG_DROP -j DROP
iptables -N O_LOG_DROP
iptables -A O_LOG_DROP -m limit --limit 4/minute -j LOG --log-prefix "IPTABLES-O-LOG-DROP: " --log-level 6
iptables -A O_LOG_DROP -j DROP
iptables -P INPUT DROP
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -m tcp --syn -j I_LOG_DROP
# UDP 1194 for ProtonVPN, UDP 5353 is multicast DNS / Avahi
iptables -A INPUT -p udp --match multiport ! --dports 22,67,68,80,443,1194,5353 -j I_LOG_DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
# port 23189 used by SFTP
iptables -A OUTPUT -p tcp --match multiport ! --dports ssh,http,https,23189 --syn -j O_LOG_DROP
# UDP 1194 for ProtonVPN, UDP 5037 when using Wireshark
iptables -A OUTPUT -p udp --match multiport ! --dports 22,53,67,68,80,123,443,1194,1900,5037,5353,30000:64000 -j O_LOG_DROP
The whole thing gets more complicated because your VPN probably does iptables stuff too.
Windscribe VPN adds rules and changes chain policies. I had to have a big shell script
to add rules before the VPN starts, then a small script to do a couple of tweaks after VPN has started.
And the number of ports keeps growing and growing. Apps such as Firefox and
torrent-client open lots of high port numbers. Most/all of them may be
on localhost, so maybe you have to start wiring addresses into your rules.
The whole thing just gets too complicated.
If you see an iptables LOG line in /var/log/kern.log that doesn't show source and dest
ports, but gives "PROTO=n", look up that protocol number in /etc/protocols.
Do "sudo netstat -tulpn" to see what ports have listeners.
(Also "sudo ss -lptu")
Around this time, I mostly gave up with iptables. I think it was the wrong approach.
Instead, concentrate on reducing and understanding the number of listeners you have.
It doesn't matter if an incoming packet gets through iptables, as long as no
process is listening on that port.
Let the VPN do what it wants with iptables. Maybe do "sudo iptables -L -v" occasionally
to see how much traffic is hitting each rule.
I think it would be different with a server, running only a few services.
There you could allow only 10 or so open ports.
Maybe there are some "listeners" built into the protocol stack ?
Turn off protocols you know you aren't using.
Maybe do this to see unusual protocols:
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
...
# assuming your INPUT chain policy is ACCEPT, put these at the end of the chain
iptables -A INPUT -p tcp -j ACCEPT
iptables -A INPUT -p udp -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -m limit --limit 1/minute -j LOG --log-prefix "Incoming IPv4 protocol "
