Red Hat ENTERPRISE LINUX 4 - SECURITY GUIDE Manual

Also see for ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE: Installation guide Installation guide Tuning guide Installation guide Manual

Contents

Basic Firewall Policies65service ip6tables stopchkconfig ip6tables offTo make iptables start by default whenever the system is booted, you must change runlevel statuson the service using chkconfig.chkconfig --level 345 iptables onThe syntax of iptables is separated into tiers. The main tier is the chain. A chain specifies the stateat which a packet is manipulated. The usage is as follows:iptables -A chain -j targetThe -A option appends a rule at the end of an existing ruleset. The chain is the name of the chainfor a rule. The three built-in chains of iptables (that is, the chains that affect every packet whichtraverses a network) are INPUT, OUTPUT, and FORWARD. These chains are permanent andcannot be deleted. The -j target option specifies the location in the iptables ruleset where thisparticular rule should jump. Some built in targets are ACCEPT, DROP, and REJECT.New chains (also called user-defined chains) can be created by using the -N option. Creating a newchain is useful for customizing granular or elaborate rules.7.2.1. Basic Firewall PoliciesEstablishing basic firewall policies creates a foundation for building more detailed, user-defined rules.iptables uses policies (-P) to create default rules. Security-minded administrators usually elect todrop all packets as a policy and only allow specific packets on a case-by-case basis. The followingrules block all incoming and outgoing packets on a network gateway:iptables -P INPUT DROPiptables -P OUTPUT DROPAdditionally, it is recommended that any forwarded packets — network traffic that is to be routed fromthe firewall to its destination node — be denied as well, to restrict internal clients from inadvertentexposure to the Internet. To do this, use the following rule:iptables -P FORWARD DROPAfter setting the policy chains, you can create new rules for your particular network and securityrequirements. The following sections outline some rules you may implement in the course of buildingyour iptables firewall.