Securing system using IPTable firewall

• A firewall cannot prevent users or attackers with modems from dialing in to or out of the internal network, thus bypassing the firewall and its protection completely.
• Firewalls cannot enforce your password policy or prevent misuse of passwords. Your password policy is crucial in this area because it outlines acceptable conduct and sets the ramifications of noncompliance.
• Firewalls are ineffective against nontechnical security risks such as social engineering, as discussed in Chapter 1, “There Be Hackers Here.”
• Firewalls cannot stop internal users from accessing websites with malicious code, making user education critical.
• Firewalls cannot protect you from poor decisions.
• Firewalls cannot protect you when your security policy is too lax.

Possible security holes for a firewall –

Here are some common firewall vulnerabilities that need to be on the lookout for listed in order of typical significance/priority:

1. Password(s) are set to the default which creates every security problem imaginable, including accountability issues when network events occur.
2. Anyone on the Internet can access Microsoft SQL Server databases hosted internally which can lead to internal database access, especially when SQL Server has the default credentials or an otherwise weak password.
3. Firewall OS software is outdated and no longer supported which can facilitate known exploits including remote code execution and denial of service attacks and might not look good in the eyes of third-parties if a breach occurs and it’s made known that the system was outdated.
4. Anyone on the Internet can access the firewall via unencrypted HTTP connections, as these can be exploited by an outsider who’s on the same network segment such as an open/unencrypted wireless network.
5. Anti-spoofing controls are not enabled on the external interface which can facilitate denial of service and related attacks.
6. Rules exist without logging which can be especially problematic for critical systems/services.
7. Any protocol/service can connect between internal network segments which can lead to internal breaches and compliance violations, especially as it relates to PCI DSS cardholder data environments.
8. Anyone on the internal network can access the firewall via unencrypted telnet connections. These connections can be exploited by an internal user (or malware) if ARP poisoning is enabled via a tool such as the free password recovery program.
9. Any type of TCP or UDP service can exit the network which can enable the spreading of malware and spam and lead to acceptable usage and related policy violations.
10. Rules exist without any documentation which can create security management issues, especially when firewall admins leave the organization abruptly.

{`
Installing SSH server – 
Install ssh-server followed by this command:
#sudo apt-get install OpenSSH-server
Check the service is install and running properly:
#sudo service ssh status
`}

{`
Installing Web-server (Apache) –
Install Apache server followed by this command :
#sudo apt-get install apache2
To check the installation and package run the command :
#apache2 -v
`}

{`
Start and Enable the Apache service –
#sudo systemctl start apache2.service
#sudo systemctl enable apache2.service

Installing (Firewall) IPTables persistent – 
Installing an IP-Table firewall by following commands –
#sudo apt-get install iptables-persistent
`}

{`Here select IPv4 to < Yes >`}

{`
Select <No> to IPv6.
It will install the Firewall. Now make a static IP address and interface Id (ens39) entry in /etc/network/interfaces file. And to add any rules permanent to the IPTable, add the following line to the end of this file –
pre-up iptables-restore < /etc/iptables/rules.v4
Editing the interface file –
#sudo nano /etc/network/interfaces
`}

{`
Rejecting all Telnet connection – 
# sudo iptables -A INPUT -p tcp -dport telnet -j REJECT
`}

{`After adding rule a client is trying to connect and getting connection refuse massage– `}

{`
Allowing Telnet Remote Connect – 
# sudo iptables -A INPUT -p tcp -dport telnet -j ACCEPT
`}

{`After allowing, host is able to connect with telnet connection –`}

{`
Deny ping –
#sudo iptables -A INPUT -p icmp –icmp-type echo-request -j REJECT
`}

{`
Reject all traffic coming to MySQL server – 
#sudo iptables -A INPUT -p tcp –dport 3306 -j REJECT
`}

{`
Block incoming traffic connection to your IP address of your virtual machine –
#sudo iptables -A INPUT -i ens33 -s 192.168.1.1 -j REJECT
`}

{`After that SSH is denied –`}

{`
Allow traffic coming to port 80 (inbound) but reject traffic going out (outbound) through port 80 –
#sudo iptables -A INPUT  -p tcp -dport 80 -j ACCEPT
#sudo iptables -A OUTPUT  -p tcp -dport 80 -j ACCEPT
`}