실습> 사용자 정의 체인 생성하기
Built-In 체인 : 사용자가 삭제할 수 없는 체인
사용자 정의 체인 : 사용자가 직접 생성하는 체인 (생성/삭제 가능)
테이블 : filter
INPUT : 패킷이 자신에게 들어오면 통과하는 문
FORWARD : 패킷이 자신에게 들어오면 다른쪽으로 포워딩해주는 문
OUTPUT : 자신에게 들어온 패킷이 나가는 문
WEB : 웹서버에 관련된 룰이 설정된 체인
DOS : DOS 공격에 관련된 룰이 설정된 체인
DB : DBMS에 관련된 룰이 설정된 체인
형식 :
-N (new) : 사용자 정의 체인 생성하기
iptables -N 체인명
기본 체인 : (policy ACCEPT) 부분이 있다.
사용자 정의 체인 : (0 references) 부분만 있고 policy 부분은 없다.
WEB, DOS, DB 사용자 정의 체인을 생성한다.
[root@firewall ~]# iptables -N WEB
[root@firewall ~]# iptables -N DOS
[root@firewall ~]# iptables -N DB
[root@firewall ~]# iptables -nL
| Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain DB (0 references) target prot opt source destination Chain DOS (0 references) target prot opt source destination Chain WEB (0 references) target prot opt source destination |
실습> 사용자 정의 체인 삭제하기
참고로 built-in 체인은 삭제할 수 없다.
형식 : iptables -X 체인명
-X (X) : 사용자 정의 체인 삭제하기
-X 로 체인을 삭제하면 두 가지 체인은 지울 수 없다.
1. built-in 체인은 삭제할 수 없다.
2. 룰이 설정된 체인은 삭제할 수 없다.
WEB체인에 출발지 IP주소가 192.168.1.1 이면 DROP한다.
[root@firewall ~]# iptables -A WEB -s 192.168.1.1 -j DROP
[root@firewall ~]# iptables -nL
| Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain DB (0 references) target prot opt source destination Chain DOS (0 references) target prot opt source destination Chain WEB (0 references) target prot opt source destination DROP all -- 192.168.1.1 0.0.0.0/0 |
built-in 체인은 삭제할 수 없다.
[root@firewall ~]# iptables -X INPUT
iptables: Invalid argument. Run `dmesg' for more information.
룰이 설정된 체인은 삭제할 수 없다.
[root@firewall ~]# iptables -X WEB
iptables: Directory not empty.
[root@firewall ~]# iptables -X DOS
[root@firewall ~]# iptables -X DB
[root@firewall ~]# iptables -nL
| Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain WEB (0 references) target prot opt source destination DROP all -- 192.168.1.1 0.0.0.0/0 |
WEB 체인을 초기화한다.
[root@firewall ~]# iptables -F WEB
[root@firewall ~]# iptables -nL
| Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain WEB (0 references) target prot opt source destination |
WEB 체인을 삭제한다.
[root@firewall ~]# iptables -X WEB
[root@firewall ~]# iptables -nL
| Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination |
web(소문자) 체인을 생성한다.
[root@firewall ~]# iptables -N web
[root@firewall ~]# iptables -nL
| Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain web (0 references) target prot opt source destination |
web 체인을 대문자 WEB 으로 변경한다.
[root@firewall ~]# iptables -E web WEB
[root@firewall ~]# iptables -nL
| Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain WEB (0 references) target prot opt source destination |
* 서비스별 포트번호
DNS : 53(UDP), 53(TCP)
HTTP : 80(TCP)
HTTPS : 443(TCP)
SSH : 22(TCP)
SMTP : 25(TCP)
Oracle : 1521(TCP)
MariaDB, MySQL : 3306(TCP)
80번 포트 허용
22번 포트 허용
[root@firewall ~]# iptables -A INPUT -p tcp --dport 22 -j ACCEPT
[root@firewall ~]# iptables -A INPUT -p tcp --dport 80 -j ACCEPT
=
[root@firewall ~]# iptables -A INPUT -p tcp --dport ssh -j ACCEPT
[root@firewall ~]# iptables -A INPUT -p tcp --dport http -j ACCEPT
[root@firewall ~]# iptables -nL INPUT
| Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 |
[root@firewall ~]# iptables -L INPUT
| Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT tcp -- anywhere anywhere tcp dpt:http |
[root@firewall ~]# iptables -D INPUT 3
[root@firewall ~]# iptables -D INPUT 3
INPUT 체인의 룰 끝에는 반드시 DROP이 설정되어 있어야 한다.
만약에 설정이 안되어 있다면 방화벽 룰이 없는 것과 동일하다.
룰 끝에 DROP으로 설정되어 있던지
policy 정책에 DROP으로 설정되어 있던지 둘 중 하나를 선택해야 된다.
[root@firewall ~]# iptables -A INPUT -j DROP
[root@firewall ~]# iptables -nL
| Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 DROP all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination |
[root@firewall ~]# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
<-- 반응이 없다.
어떤 룰을 넣어야 ping 8.8.8.8 이 응답이 올 것인가 ?
[root@firewall ~]# iptables -I INPUT 3 -p icmp -j ACCEPT
[root@firewall ~]# iptables -nL
| Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 <-- insert 한 룰 DROP all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination |
[root@firewall ~]# ping 8.8.8.8
| PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=128 time=128 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=128 time=131 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=128 time=138 ms 64 bytes from 8.8.8.8: icmp_seq=4 ttl=128 time=138 ms 64 bytes from 8.8.8.8: icmp_seq=5 ttl=128 time=138 ms ^C --- 8.8.8.8 ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4008ms rtt min/avg/max/mdev = 128.855/135.173/138.934/4.184 ms |
[root@firewall ~]# iptables -nvL
| Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 643 48136 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 5 420 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 707 59356 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 41 packets, 5352 bytes) pkts bytes target prot opt in out source destination |
OUTPUT 체인에 룰을 설정한다.
[root@firewall ~]# iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
[root@firewall ~]# iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT
[root@firewall ~]# iptables -A OUTPUT -j DROP
[root@firewall ~]# iptables -nL
| Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 DROP all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:22 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:80 DROP all -- 0.0.0.0/0 0.0.0.0/0 |
OUTPUT 체인에 패킷의 카운트가 있다는 것은 들어온 22번 패킷들이 OUTPUT으로 잘 나간다는 의미이다.
[root@firewall ~]# iptables -nvL
| Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 891 66344 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 5 420 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 708 59432 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 71 8456 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:22 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:80 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 |
OUTPUT 체인에 룰을 잘못 설정한 경우
[root@firewall ~]# iptables -F OUTPUT
[root@firewall ~]# iptables -nvL
| Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 942 70048 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 5 420 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 708 59432 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 4 packets, 480 bytes) pkts bytes target prot opt in out source destination |
-p tcp --sport 22 를 등록해야 하지만 잘못 설정한 경우이다.
[root@firewall ~]# iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
[root@firewall ~]# iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
[root@firewall ~]# iptables -A OUTPUT -j DROP
[root@firewall ~]# iptables -nvL
| Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 1174 88160 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 5 420 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 708 59432 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 20 packets, 2944 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 |
[root@firewall ~]# iptables -A OUTPUT -j DROP
<-- 막혔다...
콘솔로 접속해서 iptables -F OUTPUT을 모두 초기화하고 다시 접속한다.
'Linux > iptables' 카테고리의 다른 글
| [Linux] Ubuntu 서버에 iptables NAT 설정 (0) | 2021.11.13 |
|---|---|
| [Linux] iptables NAT 구현 (0) | 2021.11.13 |
| [Linux] iptables 로그 기록 (0) | 2021.11.13 |
| [Linux] iptables 방화벽을 이용한 IP 주소 차단하기 (0) | 2021.11.13 |
| [Linux] iptables 방화벽 정책 구성 (0) | 2021.11.13 |