====== Сервис Firewall ======

  * [[http://ru.wikipedia.org/wiki/Межсетевой_экран]]
  * [[http://www.xakep.ru/post/53653/]]

===== Конфигурация для рабочей станции =====

==== nftables ====

  * [[https://habr.com/ru/companies/ruvds/articles/580648/|Переход с iptables на nftables. Краткий справочник]]
  * [[https://cryptoworld.su/kak-perejti-s-iptables-na-nftables-polnaya-istrukciya/|Как перейти с iptables на Nftables — полная инструкция]]

==== Linux (iptables) ====


  * [[https://help.ubuntu.com/community/IptablesHowTo|ubuntu.com community IptablesHowTo]]
  * [[https://ru.wikibooks.org/wiki/Iptables|Материал из Викиучебника iptables — утилита командной строки]]
  * [[https://ru.wikipedia.org/wiki/Netfilter|Материал из Википедии netfilter — межсетевой экран]]

=== Настройка фильтра ===
<code>
root@clientN:~# cat firewall.sh
</code><code>
iptables --flush
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -j DROP
</code><code>
root@clientN:~# sh firewall.sh
</code>

=== Просмотр правил фильтра ===
<code>
# iptables -t filter -n -L -v --line-numbers
или
# iptables -n -L -v --line-numbers
</code>
=== Удаление правил фильтра ===
<code>
iptables -t ТАБЛИЦА -D ЦЕПОЧКА НОМЕР_ПРАВИЛА
</code>
=== Работа с таблицей состояний ===

[[http://conntrack-tools.netfilter.org/conntrack.html]]

<code>
# apt install conntrack

# conntrack -L
</code>

=== Управление состоянием iptables ===

== Вариант 1 ==

== Сохранение состояния iptables ==
<code>
root@gate:~# iptables-save > /etc/iptables.rules
</code>

== Восстановление состояния iptables ==
<code>
root@gate:~# iptables-restore < /etc/iptables.rules
</code>

== Восстановление состояния iptables при загрузке ==
<code>
root@gate:~# cat /etc/network/interfaces
</code><code>
...
auto eth1
iface eth1 inet static
  pre-up iptables-restore < /etc/iptables.rules
...
</code>

== Вариант 2 ==
<code>
# apt install iptables-persistent

# netfilter-persistent save
</code>

==== CentOS ====

=== CentOS 7, AlmaLinux 9 ===

  * [[https://bozza.ru/art-259.html|Настройка firewalld CentOS 7 с примерами команд]]
  * [[https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-firewalld-on-centos-7|How To Set Up a Firewall Using FirewallD on CentOS 7]]
  * [[https://www.linuxjournal.com/content/understanding-firewalld-multi-zone-configurations|Understanding Firewalld in Multi-Zone Configurations]]

<code>
# systemctl status firewalld

# firewall-cmd --get-zones | tr " " "\n"

# firewall-cmd --get-active-zones
!!! даже, если пусто, похоже, в этом случае используется public

# firewall-cmd --get-zone-of-interface=enp0s3
no zone   !!!похоже, в этом случае используется public

# firewall-cmd --list-all

# firewall-cmd --change-interface=enp0s3 --zone=public

# firewall-cmd --get-services | tr " " "\n"

# less /usr/lib/firewalld/services/sip.xml

server# firewall-cmd --zone=public --add-service=http
server# firewall-cmd --zone=public --remove-service=http

gate# firewall-cmd --zone=public --add-port=2222/tcp
gate# firewall-cmd --zone=public --remove-port=2222/tcp

server# firewall-cmd --zone=internal --add-source 192.168.X.0/24
server# firewall-cmd --get-active-zones
server# firewall-cmd --zone=internal --list-all

server# firewall-cmd --zone=internal --add-service=smtp

# firewall-cmd --runtime-to-permanent
  или, возвращаем исходное состояние
# firewall-cmd --reload

# systemctl stop firewalld
</code>

=== CentOS 6 ===
<code>
# service iptables save

# cat /etc/sysconfig/iptables

# service iptables stop
</code>
==== FreeBSD (PF) ====

  * [[http://www.openbsd.org/faq/pf/|PF: The OpenBSD Packet Filter]]

=== Настройка ===
<code>
[gate:~] # cat /etc/pf.conf
</code><code>
set skip on lo0

block in all
pass out inet all keep state
</code>

=== Включение ===
<code>
[gate:~] # cat /etc/rc.conf
</code><code>
...
pf_enable=yes
</code><code>
[gate:~] # /etc/rc.d/pf check

[gate:~] # /etc/rc.d/pf start

[gate:~] # /etc/rc.d/pf reload

[gate:~] # pfctl -s rules

[gate:~] # pfctl -vs rules

[gate:~] # pfctl -vs state

[gate:~] # pfctl -F state
</code>
===== Конфигурация для шлюза WAN - LAN =====

==== Debian/Ubuntu (iptables) ====
<code>
root@gate:~# cat firewall.sh
</code><code>
iptables --flush

iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 22 -j ACCEPT
iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 53 -j ACCEPT
iptables -A FORWARD -i eth1 -p udp -d 192.168.X.10 --dport 53 -j ACCEPT
#iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 25 -j REJECT
#iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 25 -j ACCEPT
#iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 465 -j ACCEPT
#iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 587 -j ACCEPT
#iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 143 -j ACCEPT
iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 80 -j ACCEPT
iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 5222 -j ACCEPT

#iptables -A FORWARD -i eth1 -p udp -d 192.168.X.10 --dport 5060 -j ACCEPT
#iptables -A FORWARD -i eth1 -p udp -d 192.168.X.10 --dport 4569 -j ACCEPT
#iptables -A FORWARD -i eth1 -p udp -d 192.168.X.10 --dport 10000:20000 -j ACCEPT

#iptables -A FORWARD -i eth0 -p tcp --dport 25 -j REJECT
#iptables -A FORWARD -s 192.168.100+X.0/24 -p tcp --dport 80 -j REJECT
#iptables -A FORWARD -s 192.168.100+X.0/24 -p tcp --dport 443 -j REJECT

iptables -A FORWARD -i eth0 -s 192.168.X.0/24 -j ACCEPT
#iptables -A FORWARD -s 192.168.100+X.0/24 -j ACCEPT

iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -j DROP

conntrack -F
</code><code>
root@gate:~# apt install conntrack

root@gate:~# sh firewall.sh

root@gate:~# iptables-save > /etc/iptables.rules
</code><code>
root@gate:~# cat /etc/modules
</code><code>
...
nf_conntrack_ftp
</code>

==== CentOS ====
<code>
...
# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i eth0 -o eth1 -j ACCEPT
# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
...
</code>
==== FreeBSD (pf) ====

<code>
[gate:~] # cat /etc/pf.conf
</code><code>
corp_net="192.168.X/24"
#pppoe_corp_net="192.168.100+X/24"

ssh_server="192.168.X.10"
dns_server="192.168.X.10"
www_server="192.168.X.10"
mail_server="192.168.X.10"
asterisk_server="192.168.X.10"

set skip on lo0

block in all

#block return in quick inet proto tcp from any to $mail_server port 25
#block return out quick inet proto tcp from $corp_net to !$corp_net port 25

pass in inet from any to {em0,em1}

pass in inet from $corp_net to any
#pass in inet from $dns_server to any
#pass in inet from $pppoe_corp_net to any

pass out inet all keep state

pass in inet proto tcp from any to $ssh_server port 22
pass in inet proto tcp from any to $mail_server port 25
pass in inet proto {udp,tcp} from any to $dns_server port 53
pass in inet proto tcp from any to $www_server port 80
pass in inet proto tcp from any to $mail_server port 143

#pass in inet proto udp from any to $asterisk_server port 5006
#pass in inet proto udp from any to $asterisk_server port 10000:20000
#pass in inet proto udp from any to $asterisk_server port 4569
</code><code>
[gate:~] # /etc/rc.d/pf check

[gate:~] # /etc/rc.d/pf reload
</code>

==== FreeBSD (ipfw statefull) ====
<code>
# cat /etc/ipfw.rules
</code><code>
ipfw -q -f flush
ipfw -q add check-state
ipfw -q add deny all from any to any frag
ipfw -q add deny tcp from any to any established

ipfw -q add allow tcp from 192.168.X.0/24 to any setup keep-state
ipfw -q add allow udp from 192.168.X.0/24 to any keep-state
ipfw -q add allow icmp from 192.168.X.0/24 to any keep-state

#ipfw -q add allow tcp from any to 192.168.X.10 22 keep-state
ipfw -q add allow tcp from any to 192.168.X.10 22-80 keep-state
#ipfw -q add allow udp from any to 192.168.X.10 53 keep-state
#ipfw -q add allow ip from any to 192.168.X.10 keep-state
</code>

==== FreeBSD (ipfw stateless) ====
<code>
# cat /etc/ipfw.rules
</code><code>
ipfw -q -f flush

ipfw -q add allow ip from 192.168.X.0/24 to any
ipfw -q add allow tcp from any to 192.168.X.0/24 established
ipfw -q add allow udp from any 1024-65535 to any 1024-65535
ipfw -q add allow udp from any 53 to any 1024-65535
ipfw -q add allow icmp from any to any

ipfw -q add allow tcp from any to 192.168.X.10 22-23
ipfw -q add allow udp from any to 192.168.X.10 53

</code>

===== Протоколирование отброшенных пакетов =====

==== Debian/Ubuntu (iptables) ====
<code>
root@gate:~# cat firewall.sh
</code><code>
...
iptables -A ... -j LOG --log-prefix "iptables denied: " --log-level 7
iptables -A ... -j DROP
</code><code>
root@gate:~# sh firewall.sh

root@gate:~# iptables-save > /etc/iptables.rules

root@gate:~# tail -f /var/log/syslog
</code>

==== FreeBSD (pf) ====
<code>
[gate:~] # cat /etc/rc.conf
</code><code>
...
pflog_enable="YES"
</code><code>
[gate:~] # /etc/rc.d/pflog start

[gate:~] # ifconfig

[gate:~] # cat /etc/pf.conf
</code><code>
...
block in log all
</code><code>

[gate:~] # /etc/rc.d/pf check

[gate:~] # /etc/rc.d/pf reload

[gate:~] # tcpdump -n -i pflog0

[gate:~] # tcpdump -n -r /var/log/pflog
</code>

===== Конфигурация для шлюза WAN - LAN - DMZ =====
==== Debian/Ubuntu (iptables) ====
<code>
root@gate:~# cat firewall.sh
</code><code>
iptables --flush

iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth2 -j ACCEPT

#### for openvpn ####
iptables -A FORWARD -i tun+ -j ACCEPT

iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -j DROP
iptables -A OUTPUT -o eth2 -j DROP
</code><code>
root@gate:~# sh firewall.sh

root@gate:~# iptables-save > /etc/iptables.rules
  или
root@gate:~# netfilter-persistent save
</code>

==== FreeBSD (pf) ====
<code>
[gate:~] # cat /etc/pf.conf
</code><code>
lan_net="192.168.100+X/24"
dmz_net="192.168.X/24"
vpn_nets="{ 192.168.200+X/24, 192.168.100+Y/24}"

nat on em1 from $lan_net to any -> (em1)

block in all
pass out inet all keep state

block out from any to $lan_net
#pass out from $vpn_nets to $lan_net

pass in inet from any to {em0,em1,em2}

pass in inet from any to $dmz_net

pass in inet from $dmz_net to !$lan_net

pass in inet from $lan_net to any

pass in inet from $vpn_nets to $lan_net
</code>

===== Конфигурация для защиты от bruteforce =====

==== Debian/Ubuntu (iptables) ====

=== Ограничение частоты подключений ===
<code>
root@gate:~# cat firewall.sh
</code><code>
iptables --flush
...
iptables -A FORWARD -p tcp --dport 80 -i eth1 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j LOG
iptables -A FORWARD -p tcp --dport 80 -i eth1 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
iptables -A FORWARD -p tcp --dport 80 -i eth1 -m conntrack --ctstate NEW -m recent --set

#iptables -A FORWARD -p tcp -i eth1 -m conntrack --ctstate NEW -m recent --update --seconds 1 --hitcount 10 -j LOG
#iptables -A FORWARD -p tcp -i eth1 -m conntrack --ctstate NEW -m recent --update --seconds 1 --hitcount 10 -j DROP
#iptables -A FORWARD -p tcp -i eth1 -m conntrack --ctstate NEW -m recent --set
...
</code><code>
root@gate:~# tail -f /var/log/syslog
root@gate:~# journalctl -f

root@gate:~# cat /proc/net/xt_recent/DEFAULT
root@gate:~# watch cat /proc/net/xt_recent/DEFAULT

root@gate:~# echo -10.5.7.1 >/proc/net/xt_recent/DEFAULT

root@gate:~# echo / >/proc/net/xt_recent/DEFAULT
</code>

==== nftables ====

=== Блокировка абонентов, превысивших частоту подключений ===

  * [[https://access.redhat.com/documentation/ru-ru/red_hat_enterprise_linux/7/html/security_guide/sec-using_nftables_to_limit_the_amount_of_connections|Using nftables to limit the amount of connections]]

<code>
gate# cat /etc/nftables.conf
</code><code>
...
table inet filter {
        set denylist {
                type ipv4_addr
                size 65535
                flags dynamic,timeout
                timeout 5m
        }
...
        chain forward {
                type filter hook forward priority filter; policy accept;
                ip protocol tcp ct state new,untracked limit rate over 10/second add @denylist { ip saddr }
                ip saddr @denylist drop
        }
...
</code>
==== FreeBSD (pf) ====

[[http://www.opennet.ru/base/sec/bruteforce_pf.txt.html]]

<code>
gate# cat /etc/pf.conf
</code><code>
table <fail2ban> persist
block in quick from <fail2ban>

pass in on em1 proto tcp to \
     port 22 flags S/SA keep state \
     (max-src-conn-rate 4/60, overload <fail2ban> flush)
</code><code>
# pfctl -t fail2ban -T show

# pfctl -t fail2ban -T delete 172.16.1.254

# pfctl -t fail2ban -T add 172.16.1.254
# pfctl -k 172.16.1.254

# pfctl -t fail2ban -T flush
</code>
===== Мониторинг соединений =====

==== Debian/Ubuntu (iptables) ====
<code>
root@gate:~# conntrack -L

root@gate:~# iptstate

root@gate:~# conntrack -F
</code>

==== FreeBSD (pf) ====
<code>
[gate:~] # pfctl -vs state

[gate:~] # pfctl -k 0.0.0.0/0 -k 172.16.1.254

[gate:~] # pfctl -F states

[gate:~] # pkg install pftop

[gate:~] # pftop
</code>

===== Transparent Firewall =====

==== NetFilter ====

[[http://bwachter.lart.info/linux/bridges.html]]

===== Дополнительные материалы =====

==== FreeBSD ipfilter ====

  * [[https://www.freebsd.org/doc/handbook/firewalls-ipf.html]]

<code>
# touch /etc/ipf.rules

# cat /etc/rc.conf
</code><code>
...
ipfilter_enable=yes
</code><code>
# service ipfilter start

# ipfstat -hio
</code>
==== Пример пользовательского интерфейса для управления pf ====

[[Средства программирования shell#Использование программы dialog]]