== <u>'''Configuring a Virtual Private Network (VPN) =='''</u>

== Investigation 2: Networking Tweaks ==

'''[http://en.wikipedia.org/wiki/Iptables Iptables] is the built-in firewall for LINUX'''consisting of a '''list of rules''' (or '''"tables of policies"'''). If data matches a specified <u>policy</u>, it must “jump” to an existing '''condition'''. Simple conditions include '''ACCEPT''', '''REJECT''', '''DROP''' and '''LOG''' but there are also more complex conditions that can be applied and there is even the option to create your own conditions.

'''INPUT:'''<br>Data is checked against the INPUT chain to see if it is <u>allowed into</u> the PC.<br><br>'''OUTPUT:'''<br>Data is checked against the OUTPUT chain to see if it is <u>allowed to go outside</u> of the PC.<br><br>'''FORWARD:'''<br>PC is acting as a router it does not actually send or receive data, it <u>FORWARDS</u> data from one machine to another.  <span style="font-family:courier; font-weight:bold;font-size:1.2em;"><u>Here is an Example:</u></span>  <span style="font-family:courier; font-weight:bold;font-size:1.5em;">iptables -I OUTPUT -p tcp -s0/0 -d 0/0 --dport 80 -j DROP</span>  Which can be read like this: ''Insert a rule into the iptables OUTPUT chain that will match any tcp packet, with any a source address, any destination address, and a deistination port of 80. Any packet that matches will be dropped.''  '''Let's break down the <u>command displayed above</u> to see how it works:'''   {|cellpadding="15" width="60%" 

iptables | | <span style="font-I OUTPUT family:courier; font-p tcp weight:bold">-s0/0 -d 0I</0 --dport 80 -j DROPspan>

Which can be read like | | tells iptables to INSERT this: Insert a rule line into the iptables OUTPUT chain that policy. This means it will match any tcp packet, with any be the first line in the policy. If we used a source address, any destination address, <span style="font-family:courier; font-weight:bold">-A</span> switch it would have appended the line and a deistination port it would be the last line of 80the policy. Any packet If you are writing complex iptables rules where multiple matches can occur, it is important that matches the lines go in the right order. If you follow the -I with a number, the new rule will be dropped.inserted at that location in the chain (for example, <code>-I 3 OUTPUT</code> will insert the rule into the 3rd position in the OUTPUT chain, moving the existing rules down as necessary (the old rule #3 will become the new rule #4, for example)

The |width="75" | '''-Ip tcp''' switch tells iptables to INSERT this line into the OUTPUT policy. This means it will be the first line in the policy. If we used a -A switch it would have appended the line and it would be the last line of the policy. If you are writing complex iptables rules where multiple matches can occur, it is important that the lines go in the right order. If you follow the -I with a number, the new rule will be inserted at that location in the chain (for example, <code>-I 3 OUTPUT</code> will insert the rule into the 3rd position in the OUTPUT chain, moving the existing rules down as necessary (the old rule #3 will become the new rule #4, for example).

The '''-p tcp''' switch | | tells iptables to only match TCP packets. Alternately, the protocol could be set to '''udp''', '''icmp''', or '''all.'''

The '''|-s0/0''' switch specifies the source IP address. 0/0 means a source address of “anywhere.” this has been put into the lab because your ip address will change because it is dynamically assigned. You can change this value if you want to the IP address that has been specifically assigned to your PC.valign="top"

The | |'''-d0s0/0''' switch specifies the destination address. It makes sense that this address is set to “anywhere” because if we want to block all requests to the WWW, we will never know the specific IP address of web server that is trying to be accessed.

The switch '''--dport 80''' tells iptables to look at | |specifies the destination port in source IP address. 0/0 means a source address of “anywhere.” this has been put into the packet and see if lab because your ip address will change because it is equal to 80dynamically assigned. Alternately, You can change this value if you can filter based on source addresses using want to the <code>--sport</code> switch.IP address that has been specifically assigned to your PC

'''|-j''' means jump to a particular target – Basic targets are ACCEPT, DROP, REJECT, and LOG. The available targets depend on which table contains the chain.valign="top"

| |'''-d0/0''' | |specifies the destination address. It makes sense that this address is set to “anywhere” because if we want to block all requests to the WWW, we will never know the specific IP address of web server that is trying to be accessed  |- valign="top" | |'''--dport 80''' | |tells iptables to look at the destination port in the packet and see if it is equal to 80. Alternately, you can filter based on source addresses using the <code>--sport</code> switch  |- valign="top" | |'''-j''' | |means when condition is met, then jump to a particular target – Basic targets are '''ACCEPT''', '''DROP''', '''REJECT''', and '''LOG'''. The available targets depend on which table contains the chain  |- valign="top" | |'''DROP'''  | |means drop the packet – make it disappear - and do not continue processing rules. '''REJECT''' is similar, but causes an error packet to be sent back to the source host. '''ACCEPT''' causes the packet to be processed. '''LOG''' causes an entry to be made in the system logs showing that the packet was processed. Note that the LOG target is the only one that does not stop rule-checking in the chain - so you can log a packet with one rule, and then use a later rule in the chain to DROP, REJECT, or ACCEPT it.  |}