Unit 9: Firewalls and segmentation · Lesson 3 of 6 · 18 min
Fixing the rules
Write a corrected ruleset that matches the policy and produce a diff the change board can approve.
mission
- You are
- The analyst raising the change request.
- Situation
- The review found four problems: SSH open to everyone, 8443 and 3389 accepted without approval, and forwarding allowed.
- Goal
- Produce a fixed copy of the rules and a diff that shows exactly what changes.
- Hand in
- A diff with every change and the number of accept lines left.
The gatehouse after the fix
Copy, never edit in place
Work on a copy so the original stays as evidence and the diff is clean.
cp rules.nft ~/rules-fixed.nft && head -n 6 ~/rules-fixed.nft
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
ct state established,related accept
iif "lo" accept
tcp dport 22 accept
Apply the four fixes
sed deletes the two unapproved rules, limits SSH to the office and sets the forward policy to drop.
sed -i -e '/dport 3389/d' -e '/dport 8443/d' -e 's/^ tcp dport 22 accept/ ip saddr 10.10.0.0\/24 tcp dport 22 accept/' -e 's/hook forward priority 0; policy accept/hook forward priority 0; policy drop/' ~/rules-fixed.nft && diff rules.nft ~/rules-fixed.nft
6c6
< tcp dport 22 accept
---
> ip saddr 10.10.0.0/24 tcp dport 22 accept
8,9d7
< tcp dport 8443 accept
< tcp dport 3389 accept
14c12
< type filter hook forward priority 0; policy accept;
---
> type filter hook forward priority 0; policy drop;
you should see Four changes and nothing else.
defender tip On a real server, load the new rules with a timed rollback (for example nft -f from a script that restores the old file after two minutes unless you confirm). Locking yourself out of SSH is the classic firewall mistake.
Check what remains open
List the remaining doors one more time against the policy.
grep -n dport ~/rules-fixed.nft
6: ip saddr 10.10.0.0/24 tcp dport 22 accept
7: tcp dport { 80, 443 } accept
8: ip saddr 10.10.0.0/24 udp dport 161 accept
you should see Exactly what the policy says.
Before and after
tcp dport 22 accept
tcp dport { 80, 443 } accept
tcp dport 8443 accept
tcp dport 3389 accept
forward: policy acceptip saddr 10.10.0.0/24 tcp dport 22 accept
tcp dport { 80, 443 } accept
forward: policy dropCount the accept rules before you change them
Record the starting point so the change board can compare.
grep -c accept rules.nft
9
you should see Nine accept lines in the original ruleset.
What a defender takes away
- 1Fix on a copy and hand over a diff, not a description.
- 2Every remaining accept line should map to a line of the policy.
- 3Load firewall changes with a rollback timer.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.