Unit 7: The network from the host · Lesson 5 of 7 · 18 min
Auditing firewall rules
Read a saved nftables ruleset, find the rule that should not exist and the policy that lets everything else in.
mission
- You are
- You are reviewing web01's firewall for the audit.
- Situation
- The previous admin exported the live ruleset to the inventory. Reading it needs no root, and changing it is a separate, approved step.
- Goal
- Read each rule, explain it and find the weak ones.
- Hand in
- A list of rules to remove or change, with the fixed version.
Read the ruleset
cat /srv/inventory/network/firewall.nft
table inet filter {
chain input {
type filter hook input priority filter; policy accept;
ct state established,related accept
iif "lo" accept
tcp dport 22 accept
tcp dport { 80, 443 } accept
tcp dport 4444 accept
ip saddr 10.20.0.0/24 tcp dport 5432 accept
tcp dport 8081 accept
}
chain output {
type filter hook output priority filter; policy accept;
}
}
Pull out the decisions
grep -n 'dport' /srv/inventory/network/firewall.nft 6: tcp dport 22 accept 7: tcp dport { 80, 443 } accept 8: tcp dport 4444 accept 9: ip saddr 10.20.0.0/24 tcp dport 5432 accept 10: tcp dport 8081 accept grep 'policy' /srv/inventory/network/firewall.nft type filter hook input priority filter; policy accept; type filter hook output priority filter; policy accept;
you should see With policy accept on input, every allow rule is decoration: anything unmatched gets in anyway.
Count the doors
grep -A6 'chain input' /srv/inventory/network/firewall.nft chain input { type filter hook input priority filter; policy accept; ct state established,related accept iif "lo" accept tcp dport 22 accept tcp dport { 80, 443 } accept tcp dport 4444 accept grep -c accept /srv/inventory/network/firewall.nft 9
you should see The input chain's policy is accept, so every unmatched packet gets in anyway.
The input chain, before and after
policy accept;
tcp dport 22 accept
tcp dport { 80, 443 } accept
tcp dport 4444 accept
ip saddr 10.20.0.0/24 tcp dport 5432 accept
tcp dport 8081 acceptEverything gets in
policy drop;
ip saddr 10.10.0.0/24 tcp dport 22 accept
tcp dport { 80, 443 } acceptOnly what the server is for
What a defender takes away
- 1Read rules top to bottom, then read the policy.
- 2A default accept policy defeats the rules.
- 3Every allow rule needs a service that should be reachable.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.