Hey everyone and welcome back. In the previous nugget we had talked about some of the architecture
around IP tables. We still have to focus on a little bit more pieces of information in
order to put together all of the pieces. Now where we left off we were discussing the
concept of rules. Now in order to be able to begin enforcing these rules we have to understand
one more vital piece of information and that is called our targets. Now with respect to IP
tables we have a bunch of built-in targets that we want to know about as well as some extensions.
So realistically when a particular packet traversing the network happens to match a
particular rule that we want to set we want to tell the router what exactly it should do with
that packet. So these are indeed the targets. So the first target is going to be the drop target
and this might be quite self-explanatory. Simply put this is just going to drop the packet and no
logging is going to happen with this particular target. We will just quietly drop that packet.
Now the next target is pretty much the opposite of drop it is going to be the accept target.
As you can imagine this is going to allow the packet to keep on moving it's going to be accepted
meaning that it can continue on to the next part of the chain. Now the drop and accept targets are
deemed built-in targets but we also have these extensions. So the extension targets are as follows
we're going to have the log target. Simply put if we match on a particular rule and we have set
the action i.e. the target to be log we are just going to log that particular packet and lastly
we are going to have our reject target. Now this is really quite similar to the drop target. The
main difference being is that drop is just going to silently drop the packet whereas if we set the
action to be reject we are going to drop the packet but we're also going to report that the
packet was dropped. We're going to send the back additional information so depending if you want
to hide the behavior maybe you get a lot of malicious attacks you don't want to divulge
any information about your network perhaps you just want to silently drop any incoming packets that
match the rule that you have set whereas perhaps for diagnostic purposes if you happen to have
maybe a trusted network and for some reason a packet is dropped maybe you actually want to flag
that and report back this behavior. So really two different viewpoints but ultimately these targets
are going to allow us to invoke our particular rules. So as we say what we could do is if we happen to
have our server right here this is our local server let's just again say it's 10111. If we happen to
have traffic coming from let's maybe say the source of 8.8.8.8 we might have a particular rule
to say hey by the way if we get a packet from this source address 8.8.8.8 we want to allow that in
but we can specify a particular filter that we are going to accept anything coming from this
particular source address coming into our local machine that would be the input chain and ultimately
this packet would be allowed. Conversely we could maybe say if we happen to have let's maybe say
again another server this could be 9.9.9.9 we could say the same type of thing we want to apply
some type of filter on the input chain for packets targeting our local machine. If it comes from let's
say this source address the target we're going to use is the drop target and ultimately this packet
would be dropped and not allowed into our system and of course you get the drift that we could
allow particular packets we could forward particular packets that were not destined for us all of this
is possible. Now one thing we have to be aware of is that with respect to our Linux system there are
some particular locations that we have to be aware of for the lpik2 examination when we want to utilize
our system as a routing device. Let me just quickly show you what this is I'll just clear the screen
now the location we want to be looking at is if we go into our proc directory and then the sys directory
and then net and then ipv4 and i do an ls we're going to see a whole bunch of particular files
right here what we want to go into is one called ip forward you can actually just see it right here
you can just see this right here ip forward if i happen to cat this particular file i say cat ip
forward and hit enter we can see here the value here is the value zero now if we want to configure
our device to act like a router ie so that it can actually forward ip packets we need to change this
value to be the value one instead of zero so what i'm going to do is i'm going to change the value
here by just saying echo and then in quotation marks i will have the value one and i'm going to
redirect that value into that particular file so again i could just say ip forward but i can also
give the full path i can say proc sys net ipv4 and then into the ip forward file and if i hit enter
oh of course i have to use my super user privileges so what i will do is i will substitute user to the
root account we'll do echo and before i do this i better make sure i'm redirecting it in there we go
and hit enter try again now if i happen to cat this particular file cat ip forward hit enter now the
value has been changed to one so now realistically our device here this ubuntu server can actually
act as a router for the different networks to which it is connected to let's imagine i have my ubuntu
server here and let's say i have my interface here let's just call this eth0 and let's imagine
that this was connected to the network of 10 1 1 0 slash 24 and we could also have another network
here on this interface let's imagine this was eth1 and this could be connected to 172 16 0 0 slash 16
now we have two completely separate networks and traffic can now transit through our device
coming say for example in on this network and our device is now configured to forward ip packets
so we can actually take it in from one interface and pass it out into another interface into another
network effectively rooting the traffic so now we have transformed our device into a
router and as such if we so wished as we were passing traffic through our device we could invoke
all sorts of complex or simple if you wish firewalling rules using ip tables so that if we do happen to
forward the traffic we can forward it on particular conditions or we could drop it on particular
conditions whatever we so choose now one thing we have to be aware of is that this change that we
made was within as we can see here the proc directory we know that the changes here are going to be
temporary if we want to have persistence for our connection or rather persistence for our
configuration should i say we actually have to make the modification in a different location that
is going to be let me just show you clear the screen if we go into the etsy directory done ls and i
say sudo nano the file we want to modify is sysctl.conf if i go in here if i scroll on down notice this
particular configuration here if i uncomment this this is going to allow the same action i.e.
transform our device into a router that is capable of forwarding ip packets then we want to uncomment
this and like i say the difference being is that this configuration would actually survive a system
shutdown so if we shut the system down and reboot the system whatever it may be the configuration
this way will still hold whereas if we just modify it in our proc sysnet ipv4 ip forward file that will
only be maintained so long as the system is on as soon as the system is shut down that configuration
will be terminated so now that we understand that some of these crucial concepts what i now
want to dig into is the concept of network address translation as well as showing you some examples
of writing our firewall rules so our actual ip tables configuration is going to be coming up next
i hope this has been informative for you and i'd like to thank you for viewing