iptables/netfilter hooks&rules

                                    | Incoming             ++---------------------++
                                    ↓                      || raw                 ||
                           +-------------------+           || connection tracking ||
                           | NF_IP_PRE_ROUTING |= = = = = =|| mangle              ||
                           +-------------------+           || nat (DNAT)          ||
                                    |                      ++---------------------++
                                    |
                                    ↓                                                ++------------++
                           +------------------+                                      || mangle     ||
                           |                  |         +----------------+           || filter     ||
                           | routing decision |-------->| NF_IP_LOCAL_IN |= = = = = =|| security   ||
                           |                  |         +----------------+           || nat (SNAT) ||
                           +------------------+                 |                    ++------------++
                                    |                           |
                                    |                           ↓
                                    |                  +-----------------+
                                    |                  | local processes |
                                    |                  +-----------------+
                                    |                           |
                                    |                           |                    ++---------------------++
 ++------------++                   ↓                           ↓                    || raw                 ||
 || mangle     ||           +---------------+          +-----------------+           || connection tracking ||
 || filter     ||= = = = = =| NF_IP_FORWARD |          | NF_IP_LOCAL_OUT |= = = = = =|| mangle              ||
 || security   ||           +---------------+          +-----------------+           || nat (DNAT)          ||
 ++------------++                   |                           |                    || filter              ||
                                    |                           |                    || security            ||
                                    ↓                           |                    ++---------------------++
                           +------------------+                 |
                           |                  |                 |
                           | routing decision |<----------------+
                           |                  |
                           +------------------+
                                    |
                                    |
                                    ↓
                           +--------------------+           ++------------++
                           | NF_IP_POST_ROUTING |= = = = = =|| mangle     ||
                           +--------------------+           || nat (SNAT) ||
                                    |                       ++------------++
                                    | Outgoing
                                    ↓

Deep dive into iptables on k3s node

Was struggling as I could not get "ss" or "netstat" to show me which port is listening on internet:

A Screenshot explains everything ( regarding 32233 port): 

ufw cheatsheet

Why does Linux have such a wide array of different firewalls? Have to make cheatsheet for every single one of them...here it is the ufw one:

Conf files:
/etc/ufw/user.rules
/etc/ufw/user6.rules

ufw enable
ufw disable
ufw show added
ufw status verbose
ufw status numbered
ufw allow 22/tcp
ufw deny 22/up
ufw delete deny 22/udp
ufw delete 2
ufw allow from 192.168.2.0/24 to 192.168.2.25 port 22 proto tcp
ufw allow from 192.168.2.0/24 to 192.168.2.26 port 22 proto tcp
ufw allow from 192.168.1.155 to any port 22 proto tcp
ufw allow 80/tcp comment 'accept Web'
ufw allow 443/tcp comment 'accept HTTPS'

iptables NAT

vim /etc/sysctl.conf 

net.ipv4.ip_forward = 1

sysctl -p

# iptables -t nat -P POSTROUTING DROP

# iptables -t nat -A POSTROUTING -o interfacename -j MASQUERADE

FirewallD

 Have been working on iptables for yrs and still cant get used to the more "friendly" firewalld, well, here it is the cheatsheet:

• -drop: The lowest level of trust. All incoming connections are dropped without reply and only outgoing connections are possible.
• -block: Similar to the above, but instead of simply dropping connections, incoming requests are rejected with an icmp-host-prohibited or icmp6-adm-prohibited message.
• -public: Represents public, untrusted networks. You don’t trust other computers but may allow selected incoming connections on a case-by-case basis.
• -external: External networks in the event that you are using the firewall as your gateway. It is configured for NAT masquerading so that your internal network remains private but reachable.
• -internal: The other side of the external zone, used for the internal portion of a gateway. The computers are fairly trustworthy and some additional services are available.
• -dmz: Used for computers located in a DMZ (isolated computers that will not have access to the rest of your network). Only certain incoming connections are allowed.
• -work: Used for work machines. Trust most of the computers in the network. A few more services might be allowed.
• -home: A home environment. It generally implies that you trust most of the other computers and that a few more services will be accepted.
• -trusted: Trust all of the machines in the network. The most open of the available options and should be used sparingly.

firewall-cmd --state

firewall-cmd --get-default-zone

firewall-cmd --get-active-zones

firewall-cmd --list-all

firewall-cmd --get-zones

firewall-cmd --zone=home --list-all

firewall-cmd --zone=home --list-all-zones

firewall-cmd --zone=home --change-interface=eth0

firewall-cmd --set-default-zone=home

firewall-cmd --get-services

Service Definition:

/usr/lib/firewalld/services

firewall-cmd --reload

firewall-cmd --get-services

firewall-cmd --zone=public --add-service=http

firewall-cmd --zone=public --permanent --add-service=http

firewall-cmd --zone=public --list-services

firewall-cmd --zone=public --add-port=5000/tcp

firewall-cmd --zone=public --permanent --add-port=4990-4999/udp

firewall-cmd --permanent --zone=public --remove-service=dhcpv6-client

firewall-cmd --zone=public --permanent --remove-port=443/tcp

firewall-cmd --zone=public --list-ports

firewall-cmd --runtime-to-permanent

Targets definition:

• ACCEPT: accept the packet.
• %%REJECT%%: reject the packet, returning a reject reply.
• DROP: drop the packet, returning no reply.
• default: don't do anything. The zone washes its hands of the problem, and kicks it "upstairs".

firewall-cmd --permanent --zone=public --set-target=DROP

Cumulus....cumulus.....

net add interface swp11 link autoneg on

net add interface swp11 link speed 40000

ip link set dev swp3s0 up

net commit

sudo l1-show swp3s0

sudo cat /etc/lsb-release

sudo ethtool -m swp1

sudo net del interface swp3s0

sudo net add interface swp3 breakout 4x

====sometimes the breakout command doesnt work, then try to nano the ports.conf====

sudo nano /etc/cumulus/ports.conf

/etc/network/interfaces

EVE with Wireshark remote capture

 Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\capture]
@="URL:UNetLab interface capture"
"URL Protocol"=""
[HKEY_CLASSES_ROOT\capture\shell]
[HKEY_CLASSES_ROOT\capture\shell\open]
[HKEY_CLASSES_ROOT\capture\shell\open\command]
@="\"C:\\Program Files\\Wireshark\\wireshark_wrapper.bat\" %1"

======wireshark_wrapper.bat file=============

========================================================

As long as you get putty works with key, this would be easy, plink will use default putty settings(key in my case) find out the plink file from putty package, and install wireshark with sshtcpdump (ssh remote capture)

=======================================================

@ECHO OFF

SET USERNAME="root"

SET PASSWORD="blablablabla"

SET S=%1

SET S=%S:capture://=%

FOR /f "tokens=1,2 delims=/ " %%a IN ("%S%") DO SET HOST=%%a&SET INT=%%b

IF "%INT%" == "pnet0" SET FILTER=" not port 22"

ECHO "Connecting to %USERNAME%@%HOST%..."

"C:\Program Files\PuTTY\plink.exe" -ssh -pw %PASSWORD% %USERNAME%@%HOST% "tcpdump -U -i %INT% -s 0 -w -%FILTER%" | "C:\Program Files\Wireshark\Wireshark.exe" -k -i -

Netplan config

sysadm@linuxtechi:~$ sudo vi /etc/netplan/00-installer-config.yaml

# This is the network config written by 'subiquity'

network:

  ethernets:

    enp0s3:

      dhcp4: true

  version: 2

Above are the default entries, which shows that interface “enp0s3” is getting the IP from DHCP server. As it is an yaml file, so while making the changes in the file we must follow correct indentation. Add the following lines to the yaml file,

network:

  ethernets:

    enp0s3:

      addresses: [192.168.1.3/24]

      gateway4: 192.168.1.1

      nameservers:

        addresses: [4.2.2.2, 8.8.8.8]

  version: 2

Linux firewall related settings

============iptables============

#!/bin/bash

iptables -F

iptables -P INPUT DROP

iptables -P OUTPUT ACCEPT

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -i lan0 -j ACCEPT

iptables -A INPUT -i ens21f0 -j ACCEPT

iptables -A INPUT -i ens21f1 -j ACCEPT

iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

=============NAT via firewall-cmd=================

vim /etc/sysctl.conf 

net.ipv4.ip_forward = 1

sysctl -p

#define zone

firewall-cmd --permanent --zone=external --change-interface=eth0 

firewall-cmd --permanent --zone=internal --change-interface=eth1

#set NAT masquerade

firewall-cmd --zone=external --add-masquerade --permanent

#NAT rules

firewall-cmd --permanent --direct --passthrough ipv4 -t nat -I POSTROUTING -o em1 -j MASQUERADE -s 172.16.10.0/24

firewall-cmd --reload

#Check:

[root@620 ~]# firewall-cmd  --direct --get-passthroughs ipv4 -t nat -I POSTROUTING -o em1 -j MASQUERADE -s 172.16.10.0/24

Linux network configuration

SSH tunnel:

#!/bin/bash

ssh -fNT -R 62002:127.0.0.1:22 root@blablabla -p 10022

====================================

NIC Parameter:

ethtool -s p2p2 speed 10000 duplex full autoneg on

====================================

Link up/down:

ip addr add 50.1.1.1/29 dev p2p1

ip link set dev p2p1 up

====================================

Autossh:

/usr/bin/autossh -M 0 -f -NT -R 62007:10.2.4.207:22 root@jumphost -p 10022 

===================================

Sample ifcfg

[root@localhost ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

BOOTPROTO=static

ONBOOT=yes

IPADDR=172.16.10.21

NETMASK=255.255.255.0

GATEWAY=172.16.10.1

DNS1=8.8.8.8

==================================

UUID:

[root@sysadmins ~]# nmcli connection 

 NAME   UUID                                  TYPE      DEVICE 

 ens32  97f8ee48-fa54-4a91-b20f-17144533b9c0  ethernet  ens32  

 ens33  1633af9e-dcfd-4612-899c-479ea028140f  ethernet  --     

=================================

route add

route add -net 10.255.255.0/24 gw 172.16.10.3

route add -net 10.10.255.0/24 gw 172.16.10.3