Chapter 3. Securing Your Server with a Firewall

Security is one of those things that's best done in layers. Security-in-depth, we call it. So, on any given corporate network, you will find a firewall appliance separating the internet from the demilitarized zone (DMZ), where your internet-facing servers are kept. You will also find a firewall appliance between the DMZ and the internal LAN, and firewall software installed on each individual server and client. We want to make it as tough as possible for intruders to reach their final destinations within our networks. 

Interestingly though, of all the major Linux distros, only the SUSE distros and the Red Hat-type distros come with firewalls already set up and enabled. When you look at your Ubuntu virtual machine, you'll see that it's wide open, as if it were extending a hearty welcome to any would-be intruder.

Since the focus of this book is on hardening our Linux servers, we'll focus this chapter on that last level of defense, the firewalls...

An overview of iptables

A common misconception is that iptables is the name of the Linux firewall. In reality, the name of the Linux firewall is netfilter and every Linux distro has it built-in. What we know as iptables is just one of several command-line utilities that we can use to manage netfilter. It was originally introduced as a feature of Linux kernel, version 2.6, so it's been around for a long time. With iptables, you do have a few advantages:

• It's been around long enough that most Linux admins already know how to use it
• It's easy to use iptables commands in shell scripts to create your own custom firewall configuration
• It has great flexibility, in that you can use it to set up a simple port filter, a router, or a virtual private network
• It comes preinstalled on pretty much every Linux distro, although most distros don't come with it preconfigured
• It's very well documented, with free of charge, book-length tutorials available on the internet

But, as you might know, there are also a few...

Uncomplicated Firewall for Ubuntu systems

The Uncomplicated Firewall is already installed on your Ubuntu machine. It still uses the iptables service, but it offers a vastly simplified set of commands. Perform just one simple command to enable it, and you have a good, preconfigured firewall. There's a graphical frontend for use on desktop machines, but since we're learning about server security, we'll just cover the command-line utility here.

Basic usage of ufw

ufw is disabled by default, so you'll need to enable it:

donnie@ubuntu:~$ sudo ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup
donnie@ubuntu:~$

To do this, I logged in to the virtual machine remotely from a terminal of my trusty OpenSUSE workstation. It gave me a warning that my Secure Shell connection could be disrupted, but that didn't happen. (It could be because of connection tracking rules, or it could be that I just got lucky.) I'll leave it...

firewalld for Red Hat systems

So far, we've looked at iptables, a generic firewall management system that's available on all Linux distros, and ufw, which is only available for Ubuntu. For our next act, we turn our attention to firewalld, which is specific to Red Hat Enterprise Linux 7 and all of its offspring.

Unlike ufw for Ubuntu, firewalld isn't just an easy-to-use frontend for iptables. Rather, it's an entirely new way of doing your firewall business, and it isn't compatible with iptables. Understand, though, that iptables still comes installed on the Red Hat 7 family, but it isn't enabled, because you can't have iptables and firewalld enabled at the same time. If you have to use older shell scripts that leverage iptables, you can disable firewalld and enable iptables.

Note

The reason that iptables and firewalld are incompatible is that iptables stores its rules in plain text files in the /etc/sysconfig directory, and firewalld stores its rules files in .xml format files in the /etc/firewalld...

nftables – a more universal type of firewall system

Let's now turn our attention to nftables, the new kid on the block. So, what does nftables bring to the table? (Yes, the pun was intended.):

• You can now forget about needing separate daemons and utilities for all of the different networking components. The functionality of iptables, ip6tables, ebtables, and arptables is now all combined in one neat package. The nft utility is now the only firewall utility that you'll need.
• With nftables, you can create multidimensional trees to display your rulesets. This makes troubleshooting vastly easier, because it's now easier to trace a packet all the way through all of the rules.
• With iptables, you have the filter, NAT, mangle, and security tables installed by default, whether or not you use each one. With nftables, you only create the tables that you intend to use, resulting in enhanced performance.
• Unlike iptables, you can specify multiple actions in one rule, instead of having to create multiple rules...

Summary

In this chapter, we've looked at four different frontends for the netfilter firewall. We first looked at our trusty old friend, iptables. We saw that even though it's been around forever and still works, it does have some shortcomings. We then saw how Ubuntu's Uncomplicated Firewall can vastly simplify setting up an iptables-based firewall. For you Red Hatters, we looked at firewalld, which is specific to Red Hat-type distros. Finally, we wrapped things up by looking at the latest in Linux firewall technology, nftables.

In the space allotted, I've only been able to present the bare essentials that you need to set up basic host protection. But, it is at least enough to get you started.