
-----------------------------------------------------------------------------------------------------------------

Start			2020-09-13 || 07:53 PM
Finished		2020-09-13 || 09:34 PM

-----------------------------------------------------------------------------------------------------------------

TASK 40 - IPtables Installation And Configuration

REQUIREMENTS:

We have one of our websites up and running on our Nautilus infrastructure in Stratos DC. Our security team has raised a concern that right now Apache’s port i.e 3004 is open for all since there is no firewall installed on these hosts. So we have decided to add some security layer for these hosts and after discussions and recommendations we have come up with the following requirements:


Install iptables and all its dependencies on each app host.

Block incoming port 3004 on all apps for everyone except for LBR host.

Make sure the rules remain, even after system reboot.

-----------------------------------------------------------------------------------------------------------------

CONTENT:
	I.		REFERENCES
	II.		STEPS - SUMMARY
	III.	COMMANDS USED
	IV.		STEPS - BREAKDOWN

-----------------------------------------------------------------------------------------------------------------

I.		REFERENCES

https://community.kodekloud.com/t/iptables-installation-and-configuration-failed/3705/3
https://community.kodekloud.com/t/iptables-installation-and-configuration-failed/11649/10
https://community.kodekloud.com/t/iptables-install-and-configuration-task/1474

-----------------------------------------------------------------------------------------------------------------

II.		STEPS - SUMMARY

#	1.	SSH into the jump server, Loadbalancer, App server 1, App server 2, and App server 3 and switch 
#		to root (You cannot switch to root on LB).
#	2.	On both the Load Balancer and the Jump server, try to curl all the App servers using the specified port.
#		Both should be able to curl the App servers.
#	3.	On each App Server, install the iptables-services.
#		Enable, starts, and verify status afterwards.
#	4.	Put in the necessary rules to allow traffic only from the LBR host from the specified port.
#		Traffic coming from sources other than the LBR HOST thru the specified port should be denied.
#	5.	Verify that the rules are in place be checking the ip-tables.
#		This can be done by using the three commands below. Their outputs are also shown below.
#	6.	Similar with STEP 2, curl the App servers again thru the specified port from botht LBR and Jump server.
#		This time, only the LBR host should succeed.

-----------------------------------------------------------------------------------------------------------------

III.	STEPS - BREAKDOWN

#	1.	SSH into the jump server, Loadbalancer, App server 1, App server 2, and App server 3 and switch 
#		to root (You cannot switch to root on LB).

			sudo su -
			******	

			sshpass -p '******' ssh -o StrictHostKeyChecking=no  loki@172.16.238.14

			sshpass -p  '******' ssh -o StrictHostKeyChecking=no tony@172.16.238.10
			sudo su -
			******

			sshpass -p  '******' ssh -o StrictHostKeyChecking=no steve@172.16.238.11
			sudo su -
			******

			sshpass -p  '******' ssh -o StrictHostKeyChecking=no banner@172.16.238.12
			sudo su -
			******

#	2.	On both the Load Balancer and the Jump server, try to curl all the App servers using the specified port.
#		Both should be able to curl the App servers.

			curl stapp01:5004 
			curl stapp02:5004 
			curl stapp03:5004 

#	3.	On each App Server, install the iptables-services.
#		Enable, starts, and verify status afterwards.

			sudo yum install -y iptables-services

			systemctl enable iptables
			systemctl start iptables
			systemctl status iptables

#	4.	Put in the necessary rules to allow traffic only from the LBR host from the specified port.
#		Traffic coming from sources other than the LBR HOST thru the specified port should be denied.
#		Ensure the rules will persist even after system reboots.

			iptables -R INPUT 5 -p tcp --destination-port 5004 -s 172.16.238.14 -j ACCEPT
			iptables -A INPUT -p tcp --destination-port 5004 -j DROP
			
			service iptables save

#	5.	Verify that the rules are in place be checking the ip-tables.
#		This can be done by using the three commands below. Their outputs are also shown below.

			rpm -qc iptables-services

				/etc/sysconfig/ip6tables
				/etc/sysconfig/iptables

			sudo /sbin/iptables-save

				# Generated by iptables-save v1.4.21 on Sun Sep 13 13:15:00 2020
				*nat
				:PREROUTING ACCEPT [27:2880]
				:INPUT ACCEPT [7:356]
				:OUTPUT ACCEPT [308:19366]
				:POSTROUTING ACCEPT [456:29083]
				:DOCKER_OUTPUT - [0:0]
				:DOCKER_POSTROUTING - [0:0]
				-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
				-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
				-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:34710
				-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:52247
				-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 34710 -j SNAT --to-source :53
				-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 52247 -j SNAT --to-source :53
				COMMIT
				# Completed on Sun Sep 13 13:15:00 2020
				# Generated by iptables-save v1.4.21 on Sun Sep 13 13:15:00 2020
				*filter
				:INPUT ACCEPT [0:0]
				:FORWARD ACCEPT [0:0]
				:OUTPUT ACCEPT [25:3344]
				-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
				-A INPUT -p icmp -j ACCEPT
				-A INPUT -i lo -j ACCEPT
				-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
				-A INPUT -s 172.16.238.14/32 -p tcp -m tcp --dport 5004 -j ACCEPT
				-A INPUT -p tcp -m tcp --dport 5004 -j DROP
				-A FORWARD -j REJECT --reject-with icmp-host-prohibited
				COMMIT
				# Completed on Sun Sep 13 13:15:00 2020

			iptables -L

				Chain INPUT (policy ACCEPT)
				target     prot opt source               destination
				ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
				ACCEPT     icmp --  anywhere             anywhere
				ACCEPT     all  --  anywhere             anywhere
				ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
				ACCEPT     tcp  --  stlb01               anywhere             tcp dpt:avt-profile-1
				DROP       tcp  --  anywhere             anywhere             tcp dpt:avt-profile-1

				Chain FORWARD (policy ACCEPT)
				target     prot opt source               destination
				REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

				Chain OUTPUT (policy ACCEPT)
				target     prot opt source               destination


#	6.	Similar with STEP 2, curl the App servers again thru the specified port from botht LBR and Jump server.
#		This time, only the LBR host should succeed.

			curl stapp01:5004 
			curl stapp02:5004 
			curl stapp03:5004 


-----------------------------------------------------------------------------------------------------------------


############################################################################################################

    #######      ###   ###		#######		 #######	#########	  #######	   #######		###	  ###	
   #### ####	 ###   ###	   #### ####	#### ####	#########	 #### ####	  #### ####		###	  ###
   ###	 ###	 ###   ###	   ###	 ###	###	  ###	###			 ###   ###	  ###   ###		###	  ###
   ###			 ###   ###	   ###			###			###			 ###		  ###			###	  ###
    #######		 ###   ###	   ###   		###			########	  #######	   #######		###	  ###
     #######     ###   ###	   ###			###			########	   #######	    #######		###	  ###
		 ###     ###   ###	   ###			###			###				   ###			###		###	  ###
   ###	 ###     ###   ###	   ###	 ###	###	  ###	###			 ###   ###	  ###   ###
   #########     #########	   #### ####	#### ####	#########	 #########	  #########		###	  ###
	#######       #######		#######		 #######	#########	  #######	   #######		###	  ###
			
############################################################################################################


