Hey guys and welcome back. So what I want to talk to you about in this nugget right
here is all around the concept of firewalls. Now the general user of a computer is pretty
much familiar with this term a firewall but us as Linux engineers we have to understand
the very specifics of how firewalling is invoked within Linux and as usual we have to understand
some of the basic commands that we must know to be able to configure our firewall as well
as the basic components that make up the firewall architecture. So with that said how about
we dig in and begin talking about them. So the first thing that I just want to point
out straight away is that if you happen to be using a new computer or a new Linux machine
should I say you might actually be familiar with something called firewall D. Now all
firewall D is it is the newer implementation of the firewall daemon that can be used to
invoke this action to protect your network using a firewall but for the purposes of the
examination like so often we're actually not going to be focused on the newer technology
instead we're going to be focused on the older technology and that happens to be something
called IP tables. Now IP tables really can cause a lot of frustration for a lot of people
that is due to maybe the architecture of IP tables can be a little bit intimidating if
you do not understand all of the separate components and how those components actually
relate together. The good news is is that within this skill we're going to dig into
those components and really try to make sense of it so hopefully by the end of this this
should all be a lot lot clearer. Okay so now we have the very basics about what we're going
to do let's talk about a little bit about what a firewall actually is and what it actually
provides for us just in case you are a little bit unsure. Now really at its core firewalls
are going to allow us to invoke some type of rules that can effectively control our network.
Now what do I actually mean when I say controller network? Well we're going to be able to specify
particular things such as should particular network traffic should that traffic be allowed
or should that particular traffic be denied. So maybe let's say you happen to have a web
server on your network and you wanted to allow traffic to that network. Well you could set
up a particular rule within your firewall that means that if a particular IP packet comes
in that is destined for the IP address of that particular server you want to allow it.
However let's maybe say some other packet comes in some unknown packet that is not destined
for that particular server. You might decide hey we don't actually want you instead we are going to
create a rule to deny that action in the way we can actually specify those rules as again
by using IP tables. Now IP tables does not just simply filter particular traffic i.e block traffic
or forward traffic it can also do other things such as perform something called NAT. This is
network address translation. Now this is a very important feature of IP tables in fact it is a
very important part of the internet at least in the IPv4 world but for this scale right here we're
not going to focus on this part too much. Another thing that IP tables can also do it can also
not just block or forward packets it can actually modify particular packets. So with that said how
about we try to demystify some of the complexities of the IP tables architecture and begin looking at
those individual components. So the very first thing that we have to understand here are the
main components that comprise this architecture. So what we have here is we have something called
tables okay that is the first component the next thing is something called chains and the third
thing that is going to tie everything together is called rules. So we have our tables we have our
chains and we have our rules each of these components is going to come together so that we can actually
control our traffic. So the very first thing we shall actually talk about here is this concept
of tables. So let's first talk about our tables then now in basic terms really basic terms
all a table is going to do it's going to specify what you want to do. So let's say you wanted to
maybe filter particular traffic that would be what you want to do what if you wanted to modify
particular traffic these can be actually specified within particular tables. So the very first table
we have is that filter table. So suppose you want to filter particular traffic well no surprises
it would be the filter table indeed that you would use. Now it should actually be noted that if we
do not specify a particular table the filter table is going to be the default table so that will be
the one that is assumed to be used to try to remember that filter is the default. The second table
we have is the NAT table and this is as we know just as I said relating to something called
network address translation. Now again you don't have to be too concerned about what network address
translation is quite just yet since we are going to talk about it very very shortly but just conceptualize
in your mind that if you're happened to be asked on a question what type of table would you use to
perform the translating of network addresses well you know it would be the NAT table and the third
one is the quite comically named at least in my opinion it's called the mangle table which sounds
way more violent than it does have to be all this relates to is the modification of particular packets.
So if you want to modify the headers of a particular packet you would do so using the mangle table so
maybe let's say you wanted to change something like I don't know the time to live value something
we've seen earlier on within this course and these are the three main tables that you have to be
concerned about. Now there are two more but they're not quite so common I will mention them just for
posterity we also have the raw table and we also have what's called the security table but really
for the purposes of the LPIC2 examination it is the first three tables that we want to be really
focusing on so like I say these tables tell us what we want to do whether we want to filter
traffic or modify the IP headers of a traffic or maybe invoke network address translation now we
want to specify whereabouts in the path do we actually want to invoke this behavior so this
might be a little bit confusing let's say imagine that we happen to have our router here or our Linux
server which is acting as a router and we have an interface here this could be maybe say eth0
and we have an interface here this could be eth1 and we have some ethernet connection connecting to
another device here this could be another server and let's just maybe say we are also connected to
another server so this can be server z this can be server x and we actually operate server y so
let's imagine that server x was sending in a packet okay so the packet is coming this way so really
the packet is coming inbound on our ethernet zero interface you see that it's coming into it and then
within our server we're going to process this particular traffic and if we want to send it
forward towards another machine i.e. in this case machine number z it would actually go outbound
of ethernet one you see that it comes in ethernet zero and it leaves ethernet one so we could
perform a particular action using a table such as filtering this traffic but the question is
whereabouts would we want to perform this type of action and this is where the second component
comes in this is going to be the chains component of the architecture now there are five different
routing chains that we have to know about the very first chain this one is called the pre-routing chain
now this is before any route calculation is taken so basically no decisions have been made yet
the next chain is called the input chain and this chain is going to be invoked when a particular
packet is destined for the local machine so this machine right here the next chain is called the
forward chain this is invoked when packets are routed to other networks or other devices
so basically when the packet is not destined for the local system we want to forward that traffic
the next chain is the output chain this is for packets going outbound this could actually be
locally generated packets i.e. packets which were generated meaning that they were sourced
from our server or it can be packets passing through our server going outbound from our server
and the last one is known as the post-routing chain and this is ultimately after the routing
calculation so we now know about tables we now know about chains the third component the rules
so really the rules are going to tie in and pull together what we want to do via the tables
and whereabouts we actually want to invoke this particular behavior so if we want to construct
a particular rule that is made up of particular tables reference in particular chains we have to
know which tables can be used with which chains because as it transpires not all tables and chains
can be used together so let's briefly talk about which tables and chains can be used together and
then begin discussing the path order for particular types of traffic if we happen to be using the
filter table that can be used with the input chain and the forward chain as well as the output chain
whereas if we happen to be using the NAT table that can use the pre-routing chain
as well as the output chain and the post-routing chain and then if we are talking about our
mangle table well the mangle table can use all the chains it can use the pre-routing chain
it can use the input as well as the forward output as well as the post-routing chain so the
modification of packets can basically happen absolutely anywhere whereas filtering as well as
the invocation of network address translation they happen to be a little bit more specific about
where they can be invoked so let's talk about some very simple traffic examples so imagine we have
our little router here this can be our local server now let's imagine that a packet comes in
to our device and in fact let me give my device an ip address such as imagine this was called
1011 if the actual packet here which is coming in if that has a destination ip address of 10111
i.e its final endpoint is destined for our particular server here the path order is going to be
in fact let me just write this up here destined for local the actual path order of the chains
would be the pre-routing chain and then the input chain because as it comes in it's going to invoke
the pre-routing chain before any routing calculations have happened then once we determine that this
packet is destined for our local machine see here's the packet here going for our local machine
we don't want to forward that traffic we're just going to accept it via the input chain you see that
whereas if i clear the screen let's imagine we had our server once again little linux server
and we had a packet coming in and again let's keep our same ip address of 10111
let's just maybe say this packet was somehow destined for 8.8.8.8 well that is not our local
network therefore we would be expected to pass this on to another device along the way to its
final destination of 8.8.8.8 so this time we want to forward that traffic so again i'll just say when
it's destined another machine the actual path this time would be to use the pre-routing chain of
course as it comes in before any routing decision is made we make the determination that this address
is not our local address in fact it has a remote network that has to be forwarded so therefore we
invoke the forward chain and then as it's going out we invoke the post-routing chain now the other
example i would like to give is let's say that we have our local server once again and we can keep
the same ip address of 10111 let's say that traffic does not actually come into us instead what if we
happen to be the originator of that traffic ie we are the source the one who started and generated
the packet so it doesn't come into us instead it's just generated by us and we send it out to
another device well if this is locally generated the actual chain that we're going to invoke it's
going to actually start with the output chain and then the post-routing chain so notice now because
the packet was generated by us locally it did not come into us by virtue of it not coming into us
we're not going to invoke the pre-routing chain and if the packet is destined for us locally ie we
don't have to send it to anyone else we are not going to invoke the post-routing chain and if the
packet is destined for us locally we will invoke the input chain whereas if it's destined for another
machine we will invoke the forward chain so this is some of the basic architecture that we have to
understand with respect to ip tables and our firewalling like i say we have our tables we have
our chains and we have our rules now there is some more information that we have to actually understand
with respect to our firewalling when writing our rules and well that's what we're going to be talking
about in the very next nuggets i hope it's been informative for you and i'd like to thank you for viewing