FrançaisGet started

Packet filtering

The filtering rule, the first matching rule, the default policy, stateless and stateful filtering, and the input, output and forward chains.

  • 27 cards
  • 5 topics
  • Free
Study this deck

The outline, topic by topic

Each topic is weighted the way the exam weighs it.

  1. Concepts
  2. Questions
  3. Sort and link
  4. On the diagram
  5. Scenarios

A few cards from the deck

  • Packet filtering: what is it?

    Show the answer

    A decision made packet by packet from the source address, destination address, protocol and port: the packet passes or is destroyed.

    The filter reads the IP and transport headers, not the application content: a “port 80” rule lets through anything that shows up on that port.

  • A client 10.0.0.8 opens a TCP connection to port 22 of this server. What happens to the first packet (SYN)?

    ```bash
    iptables -P INPUT DROP
    iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT
    iptables -A INPUT -p tcp --dport 80 -j ACCEPT
    iptables -A INPUT -p tcp --dport 443 -j ACCEPT
    `

    • It is destroyed by the default policy
    • It is accepted by the port 22 rule
    • It is accepted by the established connections rule
    • It is refused, and the client gets an error message at once
    Show the answer

    It is destroyed by the default policy

    The port 22 rule requires a source in 192.168.1.0/24, which 10.0.0.8 is not; the connection is not established yet; the other rules target other ports. No rule matches: the DROP policy destroys the packet silently, sending nothing back (it is REJECT that answers with an error).

  • In a list of rules, the … matching rule is the one that applies; a packet that no rule catches gets the … policy.

    Show the answer

    In a list of rules, the first matching rule is the one that applies; a packet that no rule catches gets the default policy.

    With the DROP policy an empty list closes everything; with ACCEPT it lets everything through.

  • Access control list: what is it?

    Show the answer

    An ordered series of rules evaluated from top to bottom: the first one that matches the packet decides, the following ones are not read.

    Order is therefore part of the rule: a broad rule placed too high hides every specific rule that follows it.

Study this deck