Firewall Rules Lab

1

Firewall Rule Fundamentals

15 minutes

Objective: Understand iptables rule structure, chains, and the default policy concept.

iptables Rule Structure

# Syntax: iptables -A CHAIN -p PROTOCOL --dport PORT -s SOURCE -j ACTION # Allow incoming SSH from trusted network # iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/24 -j ACCEPT # Allow incoming HTTP and HTTPS from anywhere # iptables -A INPUT -p tcp --dport 80 -j ACCEPT # iptables -A INPUT -p tcp --dport 443 -j ACCEPT # Allow DNS queries (outbound) # iptables -A OUTPUT -p udp --dport 53 -j ACCEPT # Drop all other incoming traffic (default deny) # iptables -P INPUT DROP

Key Concepts

Chain	Direction	Purpose
INPUT	Inbound	Traffic destined for this host
OUTPUT	Outbound	Traffic originating from this host
FORWARD	Through	Traffic passing through (routing/NAT)

Action	Behavior
ACCEPT	Allow the packet through
DROP	Silently discard the packet
REJECT	Discard and send error response back
LOG	Log the packet then continue processing

Rule Order Matters: iptables processes rules top to bottom. The FIRST matching rule wins. Always put specific rules before general ones, and set a default deny policy last.

Questions

Q1: What chain handles packets coming INTO this server?

Q2: What is the difference between DROP and REJECT?

Q3: In the rules above, can 10.0.0.50 connect via SSH? (yes/no)

Q4: Can 192.168.5.10 connect via SSH? (yes/no)

2

Write Firewall Rules

20 minutes

Objective: Write iptables rules to match a given security policy.

Scenario: Web Server Hardening

You are securing a web server (10.50.25.100). The security policy requires:

Allow HTTP (80) and HTTPS (443) from anywhere
Allow SSH (22) only from admin subnet 10.50.1.0/24
Allow outbound DNS (53/udp) and NTP (123/udp)
Allow established/related return traffic
Default deny everything else (INPUT and OUTPUT)

Interactive Rule Builder

Build your iptables rule:

Chain

Protocol

Dest Port

Source (-s)

Action

iptables -A INPUT -p tcp --dport -j ACCEPT

Questions

Q1: Write the iptables command to allow SSH from 10.50.1.0/24

Q2: Write the rule to allow established/related connections (stateful)

Q3: Write the default deny policy for INPUT

3

UFW - Uncomplicated Firewall

15 minutes

Objective: Learn UFW as a simplified iptables frontend commonly used on Ubuntu/Debian.

UFW vs iptables Comparison

Task	iptables	ufw
Allow SSH	iptables -A INPUT -p tcp --dport 22 -j ACCEPT	ufw allow ssh
Allow HTTP	iptables -A INPUT -p tcp --dport 80 -j ACCEPT	ufw allow 80/tcp
Allow from subnet	iptables -A INPUT -s 10.0.0.0/24 -j ACCEPT	ufw allow from 10.0.0.0/24
Deny port	iptables -A INPUT -p tcp --dport 23 -j DROP	ufw deny 23/tcp
Default deny	iptables -P INPUT DROP	ufw default deny incoming
View rules	iptables -L -n -v	ufw status verbose

UFW Status Output

$ sudo ufw status numbered Status: active To Action From -- ------ ---- [ 1] 22/tcp ALLOW IN 10.50.1.0/24 [ 2] 80/tcp ALLOW IN Anywhere [ 3] 443/tcp ALLOW IN Anywhere [ 4] 23/tcp DENY IN Anywhere [ 5] 80/tcp (v6) ALLOW IN Anywhere (v6) [ 6] 443/tcp (v6) ALLOW IN Anywhere (v6)

Questions

Q1: Write the ufw command to allow HTTPS from anywhere

Q2: Write the ufw command to allow SSH only from 10.50.1.0/24

Q3: What is the ufw command to delete rule number 4?

4

Test Rules Against Traffic

20 minutes

Objective: Given a ruleset, predict whether specific traffic will be allowed or blocked.

Active Firewall Rules

# Rule 1: Allow established connections iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Rule 2: Allow SSH from admin network iptables -A INPUT -p tcp --dport 22 -s 10.50.1.0/24 -j ACCEPT # Rule 3: Allow HTTP iptables -A INPUT -p tcp --dport 80 -j ACCEPT # Rule 4: Allow HTTPS iptables -A INPUT -p tcp --dport 443 -j ACCEPT # Rule 5: Allow ICMP (ping) iptables -A INPUT -p icmp -j ACCEPT # Rule 6: Log and drop everything else iptables -A INPUT -j LOG --log-prefix "FW_DROP: " iptables -A INPUT -j DROP

Predict the Outcome

For each traffic scenario, select whether it will be ALLOWED or BLOCKED by the ruleset above.

T1: External user browsing website on port 443

T2: Admin (10.50.1.15) connecting via SSH

T3: External user (192.168.5.10) trying SSH

T4: Ping from anywhere

T5: External user trying to connect to MySQL (port 3306)

T6: Inbound FTP connection on port 21

T7: Return traffic from an HTTP request this server initiated (established)

Default Deny Principle: In a properly configured firewall, everything is denied by default. You only open the ports that are explicitly needed. This is a fundamental security principle -- deny all, permit by exception.