Install CentOS 7.6 and configure it as a firewall router - Part7 - iptables

In Part 7, I finish writing the iptables firewall_script and test it to make sure it is working as expected. New rules are added to iptables firewall script including a rule to port forward traffic on port 80 to the Squid proxy server on port 3128

Below is the firewall_script line by line:

#!/bin/bash
# Basic firewall script

# Define variables
ipt="/sbin/iptables"
int_intf=enp0s8
ext_intf=enp0s3

# Flush all active rules and delete all custom chains
$ipt -F
$ipt -t nat -F
$ipt -t mangle -F
$ipt -X
$ipt -t nat -X
$ipt -t mangle -X

# Set default policies
$ipt -P INPUT ACCEPT
$ipt -P FORWARD ACCEPT
$ipt -P OUTPUT ACCEPT
$ipt -t nat -P OUTPUT ACCEPT
$ipt -t nat -P PREROUTING ACCEPT
$ipt -t nat -P POSTROUTING ACCEPT
$ipt -t mangle -P PREROUTING ACCEPT
$ipt -t mangle -P POSTROUTING ACCEPT

# This line is necessary for the loopback interface
# and internal socket-based services to work correctly
$ipt -A INPUT -i lo -j ACCEPT

# Enable IP masquerading (NAT)
$ipt -t nat -A POSTROUTING -o $ext_intf -j MASQUERADE

# Allow outside connections to servers
$ipt -A INPUT -p tcp --dport 22 --sport 1024:65535 -m state --state NEW -j ACCEPT
$ipt -A INPUT -p tcp --dport 80 --sport 1024:65535 -m state --state NEW -j ACCEPT

# Enable unrestricted outgoing traffic, incoming traffic
# is restricted to locally-initiated sessions only
$ipt -A INPUT -i $ext_intf -m state --state ESTABLISHED,RELATED -j ACCEPT
$ipt -A INPUT -i $int_intf -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$ipt -A FORWARD -i $ext_intf -o $int_intf -m state --state ESTABLISHED,RELATED -j ACCEPT
$ipt -A FORWARD -i $int_intf -o $ext_intf -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Accept important ICMP messages
$ipt -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
$ipt -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
$ipt -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT

# Reject connection attempts not initiated from inside the LAN
$ipt -A INPUT -p tcp --syn -j DROP

# Send LAN web requests to Squid,
# the line below is commented out at first until Squid is installed and configured
#$ipt -t nat -A PREROUTING -i $int_intf -p tcp --dport 80 -j DNAT --to 172.16.1.1:3128

5. Start iptables then run your script to configure iptables

# service iptables start
# ./firewall_script //if errors exist fix script, save, and run script again

6. Take a screenshot of your firewall script and another of your firewall running successfully

# service iptables status

[takeit]

I hope you finish the scenario :) Thanks for everything. You speech very clearly and well, i understand many of things.

[siucbset]

Material: Nice to see you giving a lot more material on your channel of late. BTW, I really like your subnetting series!

[DeathMachine]

Really enjoying this video series, looking forward to the next =D any chance we could get a link to that instructon that you are following along with?

[williamm]

Muchas gracias !! Thanks for the tutorial, really like this.

[arvinmoravej]

Hi im looking for local root exploit for cent os 6.10 (2.6.32 kernel) could you help me?

[ThisCanNotBTheFuture]

I'm almost positive I've copied the firewall script exactly, and yet I get


"Bad argument 'MASQUERADE' "
"Bad argument 'state' "

"Bad argument 'enp0s8' "
"Bad argument 'state' "