How to share network connection with iptables

While working in isolated environment you might need to share your machine internet connection with other computers or virtual machines (e.g. host only network in VirtualBox). Ensure you have iptables installed.

apt-get install iptables

There are two thing we need to do: let kernel know that it is permitted to forward network traffic.

echo "sysctl net.ipv4.ip_forward=1" >> \
    /etc/sysctl.d/ip_forward.conf

and apply masquerading for the interface that we what to share (eth0), add the following line to /etc/rc.local:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

You have to restart your computer so the changes take place during the next system boot.

Combining port knocking and password-less ssh login to a single click

You need to follow previous posts related to port knocking and password-less ssh. Here is a script that combines both:

@echo off

set ip=XXX.XXX.XXX.XXX
cd nmap-5.00
cmd /c knockin.cmd %ip% AAA BBB CCC DDD

cd ..\putty
start putty.exe -file deby %ip%

Here are few comments to the script:

• Both nmap-5.00 and putty are sub directories of the script location.
• Replace XXX.XXX.XXX.XXX with your remote host ip address
• Replace AAA BBB CCC DDD with your knockin code
• Putty uses file session (settings) stored in file deby.

The only thing you have to do is create a shortcut to your quick launch toolbar and you are done.

Block netbios traffic using iptables

If you already have basic firewall, just add the following:

# ----------- BEGIN OF CUSTOM RULES -----------
#
# Ignore netbios-ns, netbios-dgm, netbios-ssn, 
# microsoft-ds, bootps, bootpc, epman
-A INPUT -p tcp -m multiport --dports netbios-ns,netbios-dgm,netbios-ssn,microsoft-ds,bootps,bootpc,epman -j DROP
-A INPUT -p udp -m multiport --dports netbios-ns,netbios-dgm,netbios-ssn,microsoft-ds,bootps,bootpc,epman -j DROP

#
# ------------ END OF CUSTOM RULES ------------

Note: The list of system known ports (as well as known to iptables) is based on file /etc/services. Now you can activate these rules as described here.

Allow ping using iptables

If you already have basic firewall, just add the following:

# ----------- BEGIN OF CUSTOM RULES -----------
#
# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

#
# ------------ END OF CUSTOM RULES ------------

Now you can activate these rules as described here.

Allow HTTP/HTTPS traffic with iptables

If you already have basic firewall, just add the following:

# ----------- BEGIN OF CUSTOM RULES -----------
#
# Allows HTTP and HTTPS connections from anywhere
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

#
# ------------ END OF CUSTOM RULES ------------

Now you can activate these rules as described here.

Port knocking using iptables

The following let you in basic firewall through sequential port knocking to open SSH access for 5 seconds:

# ----------- BEGIN OF CUSTOM RULES -----------
#
# Note: Knock ports 100,200,300,400 to open SSH port for 5 seconds.
-N INTO-PHASE2
-A INTO-PHASE2 -m recent --name PHASE1 --remove
-A INTO-PHASE2 -m recent --name PHASE2 --set
-A INTO-PHASE2 -j LOG --log-prefix "INTO PHASE2: "
-A INTO-PHASE2 -j DROP
-N INTO-PHASE3
-A INTO-PHASE3 -m recent --name PHASE2 --remove
-A INTO-PHASE3 -m recent --name PHASE3 --set
-A INTO-PHASE3 -j LOG --log-prefix "INTO PHASE3: "
-A INTO-PHASE3 -j DROP
-N INTO-PHASE4
-A INTO-PHASE4 -m recent --name PHASE3 --remove
-A INTO-PHASE4 -m recent --name PHASE4 --set
-A INTO-PHASE4 -j LOG --log-prefix "INTO PHASE4: "
-A INTO-PHASE4 -j DROP

-A INPUT -m recent --name PHASE1 --update

-A INPUT -p tcp --dport 100 -i eth0 -m recent --set --name PHASE1
-A INPUT -p tcp --dport 200 -m recent --rcheck --name PHASE1 -j INTO-PHASE2
-A INPUT -p tcp --dport 300 -m recent --rcheck --name PHASE2 -j INTO-PHASE3
-A INPUT -p tcp --dport 400 -m recent --rcheck --name PHASE3 -j INTO-PHASE4

-A INPUT -p tcp --dport 22 -i eth0 -m recent --rcheck --seconds 5 --name PHASE4 -j ACCEPT

#
# ------------ END OF CUSTOM RULES ------------

If you are knocking from windows client you can use nmap tool. Download command-line zipfile nmap-5.21-win32.zip. Add to knockin.cmd:

@echo off
echo Knock in... %1
nmap -PN --host_timeout 1501 --max-retries 0 -p %2 %1 1>&0 2>&0
nmap -PN --host_timeout 1501 --max-retries 0 -p %3 %1 1>&0 2>&0
nmap -PN --host_timeout 1501 --max-retries 0 -p %4 %1 1>&0 2>&0
nmap -PN --host_timeout 1501 --max-retries 0 -p %5 %1 1>&0 2>&0

Run as the following (suppose you are knocking to 192.168.1.100):

C:\Program Files\nmap-5.00>knockin.cmd 192.168.1.100 100 200 300 400

Right after you issued above command the SSH port remains open for 5 seconds. Use your favorite SSH client to login. Just in case have a look here.

Basic iptables firewall

Here are basic firewall features:

• allows lo0 traffic
• accepts established connections
• allows all outgoing traffic
• log everything denied.

Place the following into ~/iptables.rules

*filter

#
# http://wiki.debian.org/iptables
#
# Defaults are to DROP anything sent to firewall or internal
# network, permit anything going out.
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT

# Flush all specific rules
-F INPUT
-F FORWARD
-F OUTPUT

# Allows all loopback (lo0) traffic and drop all traffic to 127/8 
# that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -i ! lo -d 127.0.0.0/8 -j REJECT

# Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allows all outbound traffic
# You could modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

# ----------- BEGIN OF CUSTOM RULES -----------
# Add your custom rules here, e.g. port knocking, ignore netbios, etc.

#
# ------------ END OF CUSTOM RULES ------------

# log iptables denied calls (access via 'dmesg' command)
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Reject all other inbound - default deny unless explicitly 
# allowed policy:
-A INPUT -j DROP
-A FORWARD -j DROP

COMMIT

Now you can activate these rules as described here.

Activate iptables rules after reboot

List iptables rules:

iptables -L

Activate rules from file:

iptables-restore < iptables.rules

Save rules:

iptables-save > /etc/iptables.up.rules

These rules need to be restored when the network connection is going up.

touch /etc/network/if-pre-up.d/iptables
chmod +x /etc/network/if-pre-up.d/iptables

Add the following to /etc/network/if-pre-up.d/iptables:

#!/bin/sh
/sbin/iptables-restore < /etc/iptables.up.rules