%include "default.mgp" %default 1 bgrad %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page %nodefault %back "blue" %center %size 7 netfilter/iptables training %size 4 Nov 05/06/07, 2007 Day 1 %center %size 4 by Harald Welte %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Contents Day 1 Introduction Highly Scalable Linux Network Stack Netfilter Hooks Packet selection based on IP Tables The Connection Tracking Subsystem The NAT Subsystem Packet Mangling %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Introduction Who is speaking to you? an independent Free Software developer who earns his living off Free Software since 1997 who is one of the authors of the Linux kernel firewall system called netfilter/iptables [who can claim to be the first to have enforced the GNU GPL in court] %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Introduction Linux and Networking Linux is a true child of the Internet Early adopters: ISP's, Universities Lots of work went into a highly scalable network stack Not only for client/server, but also for routers Features unheared of in other OS's %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Introduction Did you know, that a stock 2.6.x linux kernel can provide a stateful packet filter ? fully symmetric NA(P)T ? policy routing ? QoS / traffic shaping ? IPv6 firewalling ? packet filtering, NA(P)T on a bridge ? layer 2 (mac) address translation ? packet forwarding rates of up to 2.1Mpps ? %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Introduction Why did we need netfilter/iptables? Because ipchains... has no infrastructure for passing packets to userspace makes transparent proxying extremely difficult has interface address dependent Packet filter rules has Masquerading implemented as part of packet filtering code is too complex and intermixed with core ipv4 stack is neither modular nor extensible only barely supports one special case of NAT (masquerading) has only stateless packet filtering %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Introduction Who's behind netfilter/iptables The core team Paul 'Rusty' Russel co-author of iptables in Linux 2.2 James Morris Marc Boucher Harald Welte Jozsef Kadlecsik Martin Josefsson Patrick McHardy %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Netfilter Hooks What is netfilter? System of callback functions within network stack Callback function to be called for every packet traversing certain point (hook) within network stack Protocol independent framework Hooks in layer 3 stacks (IPv4, IPv6, DECnet, ARP) Multiple kernel modules can register with each of the hooks Traditional packet filtering, NAT, ... is implemented on top of this framework Can be used for other stuff interfacing with the core network stack, like DECnet routing daemon. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Netfilter Hooks Netfilter architecture in IPv4 %font "typewriter" %size 4 in --->[1]--->[ROUTE]--->[3]--->[4]---> out | ^ | | | [ROUTE] v | [2] [5] | ^ | | v | %font "standard" 1=NF_IP_PRE_ROUTING 2=NF_IP_LOCAL_IN 3=NF_IP_FORWARD 4=NF_IP_POST_ROUTING 5=NF_IP_LOCAL_OUT %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Netfilter Hooks Netfilter Hooks Any kernel module may register a callback function at any of the hooks The module has to return one of the following constants NF_ACCEPT continue traversal as normal NF_DROP drop the packet, do not continue NF_STOLEN I've taken over the packet do not continue NF_QUEUE enqueue packet to userspace NF_REPEAT call this hook again %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial IP tables Packet selection using IP tables The kernel provides generic IP tables support Each kernel module may create it's own IP table The four major parts of the firewalling subsystem are implemented using IP tables Packet filtering table 'filter' NAT table 'nat' Packet mangling table 'mangle' The 'raw' table for conntrack exemptions %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial IP Tables Managing chains and tables An IP table consists out of multiple chains A chain consists out of a list of rules Every single rule in a chain consists out of match[es] (rule executed if all matches true) target (what to do if the rule is matched) implicit packet and byte counter %size 4 matches and targets can either be builtin or implemented as kernel modules %size 5 The userspace tool iptables is used to control IP tables handles all different kinds of IP tables supports a plugin/shlib interface for target/match specific options %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial IP Tables Basic iptables commands To build a complete iptables command, we must specify which table to work with which chain in this table to use an operation (insert, add, delete, modify) one or more matches (optional) a target The syntax is %font "typewriter" %size 3 iptables -t table -Operation chain -j target match(es) %font "standard" %size 5 Example: %font "typewriter" %size 3 iptables -t filter -A INPUT -j ACCEPT -p tcp --dport smtp %font "standard" %size 5 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial IP Tables Matches Basic matches -p protocol (tcp/udp/icmp/...) -s source address (ip/mask) -d destination address (ip/mask) -i incoming interface -o outgoing interface %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial IP Tables addrtype match matches source/destionation address type types are UNICAST/LOCAL/BROADCAST/ANYCAST/MULTICAST/... ah match matches IPSEC AH SPI (range) comment match always matches, allows user to place comment in rule connmark match connection marking, see later conntrack match more extended version of 'state' match on timeout, fine-grained state, original tuples dscp match matches DSCP codepoint (formerly-known as TOS bits) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial IP Tables ecn match matches ECN bits of tcp and ip header esp match matches IPSEC ESP SPI (range) hashlimit match dynamic limiting helper match allows matching of conntrack helper name iprange match match on arbitrary IP address ranges (not a mask) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial IP Tables length match match on packet length limit static rate limiting mac match on source mac address mark match on nfmark (fwmark) multiport match on multiple ports %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial IP Tables owner match on socket owner (uid, gid, pid, sid, command name) physdev match underlying device in case of bridge pkttype match link-layer packet type (unicast,broadcast,multicast) realm match routing realm recent see special section below tcpmss match on TCP maximum segment size %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial IP Tables Targets very dependent on the particular table Table specific targets will be discussed later Generic Targets, always available ACCEPT accept packet within chain DROP silently drop packet QUEUE enqueue packet to userspace LOG log packet via syslog ULOG log packet via ulogd RETURN return to previous (calling) chain foobar jump to user defined chain %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Packet Filtering Overview Implemented as 'filter' table Registers with three netfilter hooks NF_IP_LOCAL_IN (packets destined for the local host) NF_IP_FORWARD (packets forwarded by local host) NF_IP_LOCAL_OUT (packets from the local host) Each of the three hooks has attached one chain (INPUT, FORWARD, OUTPUT) Every packet passes exactly one of the three chains. Note that this is very different compared to the old 2.2.x ipchains behaviour. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Packet Filtering Targets available within 'filter' table Builtin Targets to be used in filter table ACCEPT accept the packet DROP silently drop the packet QUEUE enqueue packet to userspace RETURN return to previous (calling) chain foobar user defined chain Targets implemented as loadable modules REJECT drop the packet but inform sender %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Connection Tracking Subsystem Connection tracking... implemented seperately from NAT enables stateful filtering implementation hooks into NF_IP_PRE_ROUTING to track packets hooks into NF_IP_POST_ROUTING and NF_IP_LOCAL_IN to see if packet passed filtering rules protocol modules (currently TCP/UDP/ICMP/SCTP) application helpers currently (FTP,IRC,H.323,talk,SNMP) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Connection Tracking Subsystem Connection tracking... divides packets in the following four categories NEW - would establish new connection ESTABLISHED - part of already established connection RELATED - is related to established connection INVALID - (multicast, errors...) does _NOT_ filter packets itself can be utilized by iptables using the 'state' match is used by NAT Subsystem %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Connection Tracking Subsystem State tracking for TCP is obvious TCP inherently stateful Two TCP state machines on each end have well-defined behaviour Passive tracking of state machines In more recent 2.6.x kernels, tracking of TCP window (seq/ack) Max idle timeout of fully-established session: 5 days %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Connection Tracking Subsystem State tracking for UDP: How is this possible? UDP itself not stateful at all However, higher-level protocols mostly match request-reply First packet (request) is assumed to be NEW First matching reply packet is assumed to confirm connection Further packets in either direction refresh timeout Timeouts: 30sec unreplied, 180sec confirmed %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Connection Tracking Subsystem State tracking on ICMP: What's that? ICMP Errors (e.g. host/net unreachable, ttl exceeded) They can always be categorized as RELATED to other connections ICMP request/reply (ECHO REQUEST, INFO REQUEST) can be treated like UDP request/reply case %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Connection Tracking Subsystem State tracking on SCTP: What's SCTP? Streaming Control Transfer Protocol Linux has SCTP in the network stack, so why should the packet filter not support it? Pretty much like TCP in most cases Doesn't support more advanced features such as failover of an endpoint %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Connection Tracking Subsystem State tracking on other protocols 'generic' protocol: no layer-4 tuple information 'gre' helper in patch-o-matic State tracking of higher-layer protocols implemented as 'connection tracking helpers' currently in-kernel: amanda, ftp, irc, tftp currently in patch-o-matic: pptp, h.323, sip, quake, ... have to be explicitly loaded (ip_conntrack_*.[k]o) work by issuing so-called "expectations" %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Connection Tracking Subsystem Exemptions to connection tracking Usually connection tracking is called first in PRE_ROUTING Sometimes, filtering is preferred before this conntrack lookup Therefore, the "raw" table was introduced In some rare cases, one might want to not track certain packets The NOTRACK can be used in the "raw" table %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Connection Tracking Subsystem Configuration / Tuning module parameter "hashsize" number of hash table buckets /proc/sys/net/ipv4/ip_conntrack_max maximum number of tracked connections /proc/sys/net/ipv4/ip_conntrack_buckets (read-only) number of hash table buckets /proc/net/ip_conntrack list of connections /proc/net/ip_conntrack_expect list of pending expectations %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Connection Tracking Subsystem Configuration / Tuning /proc/sys/net/ip_conntrack_log_invalid log invalid packets? /proc/sys/net/ip_conntrack_tcp_be_liberal basically disables window tracking, if "1" /proc/sys/net/ip_conntrack_tcp_loose how many packets required until sync in case of pickup if set to zero, disables pickup /proc/sys/net/ip_conntrack_tcp_max_retrans maximum number of retransmitted packets without seeing a n ACK /proc/sys/net/ip_conntrack_*timeout* timeout values of respective protocol states %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Network Address Translation Network Address Translation Previous Linux Kernels only implemented one special case of NAT: Masquerading Linux 2.4.x / 2.6.x can do any kind of NAT. NAT subsystem implemented on top of netfilter, iptables and conntrack Following targets available within 'nat' Table SNAT changes the packet's source whille passing NF_IP_POST_ROUTING DNAT changes the packet's destination while passing NF_IP_PRE_ROUTING MASQUERADE is a special case of SNAT REDIRECT is a special case of DNAT SAME NETMAP %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Network Address Translation Source NAT SNAT Example: %font "typewriter" %size 3 iptables -t nat -A POSTROUTING -j SNAT --to-source 1.2.3.4 -s 10.0.0.0/8 %font "standard" %size 4 MASQUERADE Example: %font "typewriter" %size 3 iptables -t nat -A POSTROUTING -j MASQUERADE -o ppp0 %font "standard" %size 5 Destination NAT DNAT example %font "typewriter" %size 3 iptables -t nat -A PREROUTING -j DNAT --to-destination 1.2.3.4:8080 -p tcp --dport 80 -i eth1 %font "standard" %size 4 REDIRECT example %font "typewriter" %size 3 iptables -t nat -A PREROUTING -j REDIRECT --to-port 3128 -i eth1 -p tcp --dport 80 %font "standard" %size 5 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Packet Mangling Purpose of 'mangle' table packet manipulation except address manipulation Integration with netfilter 'mangle' table hooks in all five netfilter hooks priority: after conntrack Simple example: %font "typewriter" %size 3 iptables -t mangle -A PREROUTING -j MARK --set-mark 10 -p tcp --dport 80 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Packet Mangling Targets specific to the 'mangle' table: DSCP manipulate DSCP field ECN manipulate ECN bits IPV4OPTSSTRIP strip IPv4 options MARK change the nfmark field of the skb TCPMSS set TCP MSS option TOS manipulate the TOS bits TTL set / increase / decrease TTL field CLASSIFY classify packet (for tc/iproute) CONNMARK set mark of connection %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial The raw Table Purpose of 'raw' table to allow for filtering rules _before_ conntrack Targets specific to the 'raw' table: NOTRACK don't do connection tracking The table can also be useful for flood protection rules that happen before traversing the (computational) expensive connection tracking subsystem. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Advanced Netfilter concepts %size 4 Userspace logging flexible replacement for old syslog-based logging packets to userspace via multicast netlink sockets easy-to-use library (libipulog) plugin-extensible userspace logging daemon (ulogd) Can even be used to directly log into MySQL Queuing reliable asynchronous packet handling packets to userspace via unicast netlink socket easy-to-use library (libipq) provides Perl bindings experimental queue multiplex daemon (ipqmpd) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Advanced Netfilter concepts Firewalling on a Bridge (ebtables + iptables) totally transparent to layer 2 and above no attack vector since firewall has no IP address even possible to do NAT on the bridge or even NAT of MAC addresses ipset - Faster matching iptables are a linear list of rules ipset represents a 'group' scheme Implements different data types for different applications hash table (for random addresses) bitmask (for let's say a /24 network) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Advanced Netfilter concepts ipv6 packet filtering ip6tables almost identical to iptables no connection tracking in mainline yet, but patches exist ip6_conntrack initial copy+paste 'port' by USAGI was not accepted because of code duplication nf_conntrack generalized connection tracking, supports ipv4 and ipv6 mutually exclusive with ip_conntrack as of now, no ipv4 nat on to of nf_conntrack %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %page netfilter/iptables tutorial Thanks Thanks to the BBS scene, Z-Netz, FIDO, ... for heavily increasing my computer usage in 1992 KNF (http://www.franken.de/) for bringing me in touch with the internet as early as 1994 for providing a playground for technical people for telling me about the existance of Linux! Alan Cox, Alexey Kuznetsov, David Miller, Andi Kleen for implementing (one of?) the world's best TCP/IP stacks Paul 'Rusty' Russell for starting the netfilter/iptables project for trusting me to maintain it today Astaro AG for sponsoring parts of my netfilter work