path: root/lectures/07-os-network-security.org

#+title: OS Network Security
#+date: 2026-05-04 Mon
#+author: W. Kosior
#+email: wkosior@agh.edu.pl

* Linux Kernel Network Interfaces
- physical interfaces
  - ethernet
  - wlan
- virtual interfaces
  - bridges
  - virtual ethernet
- tun/tap
- other (e.g., VPN)
  - wireguard
  - ppp

* netfilter (iptables)
- 1999 (kernel 2.3.15)
  - superseded ipchains
    - that superseded ipfwadm (ipfirewall port)
- https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg

* *tables
- iptables
- ip6tables
- arptables
- ebtables

* =iptables= Command Example
#+begin_example
# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
#+end_example

* =iptables= Command Example, Cont.
#+begin_example
# iptables -A OUTPUT --proto udp --dport 53 --destination 192.168.1.1 -j ACCEPT
# iptables -t filter -A OUTPUT --proto tcp --dport 443 -j ACCEPT
# iptables -t filter -A OUTPUT --proto tcp --dport 587 -j ACCEPT
# iptables -t filter -A OUTPUT --proto tcp --dport 995 -j ACCEPT
# iptables -t filter -A OUTPUT --proto tcp --dport 993 -j ACCEPT
# iptables -t filter -P OUTPUT DROP
#+end_example

* =iptables= Command Example, Cont…
#+begin_example
# iptables  -L --numeric
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     udp  --  0.0.0.0/0            192.168.1.1          udp dpt:53
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:587
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:995
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:993
#+end_example

* iptables Structure
- rules
  - targets
- chains
  - default policies
- *tables*

* =filter= Table
- =INPUT=
- =OUTPUT=
- =FORWARD=
- "traditional" firewall operations

#+begin_example
                              ‍+---------+
in ---> routing decision ---> | FORWARD | -------------------‍+---> out
                |             ‍+---------+                    |
                |                                            |
                V                                            |
            ‍+-------+                          ‍+--------+    |
            | INPUT | ------> application ---> | OUTPUT | ---‍+
            ‍+-------+                          ‍+--------+
#+end_example

* Linux Kernel Packet Forwarding
#+begin_example
# echo 1 > /proc/sys/net/ipv4/ip_forward
#+end_example

#+begin_example
# sysctl -w net.ipv4.ip_forward=1
#+end_example

* Targets & Custom Chains
- standard targets
  - =ACCEPT=
  - =DROP=
  - =QUEUE=
  - user-defined chain
    - =--jump=
    - =--goto=
  - =RETURN= (for user-defined chains)
- target modules targets
  - =LOG=
  - =REJECT=
    - default: =icmp-port-unreachable=
    - =tcp-reset= (=RST/ACK=)

* =REJECT= & Custom Chain Example
#+begin_example
# iptables -N HTTPS-TRAFFIC
# iptables -A HTTPS-TRAFFIC --destination 1.2.3.4 -j ACCEPT
# iptables -A HTTPS-TRAFFIC --destination 5.6.7.8 -j ACCEPT
# iptables -A HTTPS-TRAFFIC --destination 9.10.11.12 -j ACCEPT
# iptables -A HTTPS-TRAFFIC --destination 13.14.15.16 -j ACCEPT
# iptables -A HTTPS-TRAFFIC --destination 17.18.19.20 -j ACCEPT
# iptables -A HTTPS-TRAFFIC --destination 21.22.23.24 -j ACCEPT
# iptables -A HTTPS-TRAFFIC --destination 25.26.27.28 -j ACCEPT
# iptables -A HTTPS-TRAFFIC --proto tcp -j REJECT --reject-with tcp-reset
# iptables -A OUTPUT --proto tcp --destination-port 443 -j HTTPS-TRAFFIC
# iptables -P OUTPUT DROP
#+end_example

* =REJECT= & Custom Chain Example, Cont.
#+begin_example
# iptables -L OUTPUT
Chain OUTPUT (policy DROP)
target     prot opt source               destination
HTTPS-TRAFFIC  tcp  --  anywhere             anywhere             tcp dpt:https
# iptables -L HTTPS-TRAFFIC
Chain HTTPS-TRAFFIC (1 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             1.2.3.4
ACCEPT     all  --  anywhere             5.6.7.8
ACCEPT     all  --  anywhere             9.10.11.12
ACCEPT     all  --  anywhere             13.14.15.16
ACCEPT     all  --  anywhere             17.18.19.20
ACCEPT     all  --  anywhere             21.22.23.24
ACCEPT     all  --  anywhere             25.26.27.28
ACCEPT     all  --  anywhere             29.30.31.32
REJECT     tcp  --  anywhere             anywhere             reject-with tcp-reset
#+end_example

* =nat= Table
- =PREROUTING=
- =OUTPUT=
- =POSTROUTING=
- *only first connection packet*

* Address Translation Targets
- =SNAT=
  - =OUTPUT= & =POSTROUTING=
- =MASQUERADE=
  - =OUTPUT= & =POSTROUTING=
- =DNAT=
  - =PREROUTING=

* Ordinary NAT Example (=MASQUERADE=), Cont.
#+begin_example
# iptables -t nat -A POSTROUTING --out-interface eth0 -j MASQUERADE
# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere
#+end_example

* Ordinary NAT Example (=MASQUERADE=), Cont.
#+begin_example
# iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -o eth0 -j MASQUERADE
#+end_example

* Connection Tracking
#+begin_example
# iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
#+end_example

- protocol + source addr + source port + destination addr + destination port
- =nat= table → first connection packet
- other tables → all packets

* =mangle= Table
- =INPUT=
- =OUTPUT=
- =FORWARD=
- =PREROUTING=
- =POSTROUTING=
- packet header changes
- marks
  - =MARK=
  - =CONNMARK=
  - =SEC*MARK=

* NAT with Exposed Service Example
#+begin_example
# iptables -t nat -A POSTROUTING --out-interface eth0 -j MASQUERADE
# iptables -t nat -A PREROUTING --proto tcp --destination 12.34.56.78 \
>     --dport 587 -j DNAT --to-destination 192.168.7.205:25
# iptables -t mangle -A PREROUTING --in-interface \!eth0  --proto tcp \
>     --destination 12.34.56.78 --dport 587 -j MARK --set-mark 0x400
# iptables -t nat -A POSTROUTING --proto tcp -m mark --mark 0x400 -j MASQUERADE
#+end_example

* NAT with Exposed Service Example, Cont.
#+begin_example
# iptables -t mangle -L | sed 's/ \{8\}/  /g;s/ \{5\}/  /g'
Chain PREROUTING (policy ACCEPT)
target  prot opt source      destination
MARK    tcp  --  anywhere    12.34.56.78    tcp dpt:submission MARK set 0x400

Chain INPUT (policy ACCEPT)
target  prot opt source      destination

Chain FORWARD (policy ACCEPT)
target  prot opt source      destination

Chain OUTPUT (policy ACCEPT)
target  prot opt source      destination

Chain POSTROUTING (policy ACCEPT)
target  prot opt source      destination
#+end_example

* NAT with Exposed Service Example, Cont…
#+begin_example
# iptables -t nat -L | sed 's/\t/        /g;s/  \+/  /g;'
Chain PREROUTING (policy ACCEPT)
target  prot opt source  destination
DNAT  tcp  --  anywhere  12.34.56.78  tcp dpt:submission to:192.168.7.205:25

Chain INPUT (policy ACCEPT)
target  prot opt source  destination

Chain OUTPUT (policy ACCEPT)
target  prot opt source  destination

Chain POSTROUTING (policy ACCEPT)
target  prot opt source  destination
MASQUERADE  all  --  anywhere  anywhere
MASQUERADE  tcp  --  anywhere  anywhere  mark match 0x400
#+end_example

* =raw= Table
- =OUTPUT=
- =REROUTING=
- disabling conntrack

* =security= Table
- =INPUT=
- =OUTPUT=
- =FORWARD=
- specicific marks
  - =SECMARK= & =CONNSECMARK=
  - SELinux
  - initially through =mangle= only

* Packet Couting
#+begin_example
sudo iptables -vL
Chain INPUT (policy ACCEPT 7025 packets, 4955K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 4625 packets, 648K bytes)
 pkts bytes target     prot opt in     out     source               destination
#+end_example

* iptables Rate Limiting Example
#+begin_example
# iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
# iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --update \
>     --seconds 120 --hitcount 10 -j DROP
#+end_example

/from: https://www.baeldung.com/linux/iptables-packet-rate-limit/

* iptables Persistence
- iptables-save
- iptables-restore
  - guaranteed atomic

* nftables
- 2014 (kernel TODO)
- VM (like BPF)
- hooks
  - https://people.netfilter.org/pablo/nf-hooks.png

* nftables differences
- no builtin tables
- no builtin chains
- user-created chains attached to *hooks*
- =iptables-legacy=, =iptables-nft=

* Firewalls & NAT in Other OSes
- Packet Filter (BSDs & macOS)
  - originated: OpenBSD
  - superseded ipfw
- IP Filter (Solaris family)
- Windows Firewall

/note: FreeBSD TCP/IP stack as base for macOS & Windows NT/

* DNS
- DHCP/static
- =/etc/resolv.conf=
- resolvers
- DoT, DoH
  - move power from ISP to Google/Cloudflare 🤔
- DNSSEC
  - typical setup: verification by resolver only
  - DANE (with SMTP)
- mDNS

* dnsmasq
- DHCP+TFTP+DNS
- caching
- *filtering/redirections*

* Proxy Setup Approaches
- application-specific (e.g., GUI)
- environment variables
- =LD_PRELOAD=
  - e.g. proxychains tool
  - applications w/out proxy support
  - *NOT* a security measure (bypassable)
- firewall redirection
- eBPF

* TLS & Operating System
- certs supplied by
  - OS
  - adminitrator
  - application (e.g., Mozilla certs)
- kTLS
  - not really relevant here but let's know this exists

* HTTPS proxies
- implementations in dedicated firewall/router hw
  - e.g., FortiGate
- ordinary software
  - e.g., mitmproxy
- policy: all traffic goes through proxy
  - enforcement: block of other traffic (firewall)

* Selected VPN technologies
- IPSec
- PPTP
- *OpenVPN*
- *WireGuard*

* OpenVPN
- TLS
- authentication
  - x.509
  - shared secret
  - login/password
- =tun=​/​=tap=
- TCP/UDP

* WireGuard
- 2020 (kernel 5.6)
  - 2015 (patched kernel)
- in-kernel
  - later: cross-platform clients
- custom protocol
  - public keys (aka SSH)
  - PFS
  - optional additional shared secret
- =wg= interface
- UDP