Firewall qoidalari

netsh advfirewall, profillar, iptables zanjirlari INPUT/OUTPUT/FORWARD, qoida tartibi, default-deny

10-sinfKiberxavfsizlik6-hafta · 16-dars

Bugun nimalarni o'rganamiz?

Windows Defender Firewall

Profillar va netsh

iptables

Linux firewall

Default-deny va tartib

Xavfsiz sozlash

Takrorlash

Hamma narsani taqiqlab, faqat kerakli xizmatlarga ruxsat berish nima deyiladi?

Default-deny: eng xavfsiz yondashuv.

Windows Defender Firewall

Profillar va netsh

Qoida elementlari

Holat va qoida


netsh advfirewall show allprofiles state
netsh advfirewall firewall add rule name="Web80" dir=in action=allow protocol=TCP localport=80
netsh advfirewall firewall show rule name="Web80"
netsh advfirewall firewall delete rule name="Web80"

netsh buyruqlari administrator CMD da bajariladi. Faqat laboratoriya kompyuterida sinang; firewall ni uzoq o'chirib qo'ymang.

Mini-test

dir=in nimani bildiradi?

in — kiruvchi, out — chiquvchi.

iptables

Linux firewall

Zanjirlar

Asosiy qoidalar


sudo iptables -L -n -v --line-numbers
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

2–3-qatorlar: lokal (loopback) va allaqachon o'rnatilgan ulanishlarga ruxsat. Busiz ichki aloqa va javoblar to'xtab qoladi.

Mini-test

Qaysi zanjir shu kompyuterga kelayotgan paketlarni tekshiradi?

INPUT — kiruvchi trafik.

Default-deny va tartib

Xavfsiz sozlash

Xavfsiz tartib

Default-deny


sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -P INPUT DROP
sudo iptables -D INPUT 4
sudo iptables-save > rules.v4

Avval ruxsat, keyin -P INPUT DROP. Tajribani virtual mashinada qiling; xato bo'lsa sudo iptables -F va -P INPUT ACCEPT bilan qaytarasiz.

Mini-test

-P INPUT DROP dan oldin nima qilish shart (SSH orqali ishlasangiz)?

Aks holda ulanishingiz uziladi.

Windows va iptables

Windows Firewall

Grafik oyna yoki netsh, profillar bor

iptables

Buyruq qatori, zanjirlar va tartib muhim

Ikkalasi ham ALLOW/DENY mantiqida ishlaydi.

Atamalar. Bosing

Profil

bosing

Domain, Private yoki Public tarmoq rejimi

Zanjir

bosing

INPUT, OUTPUT yoki FORWARD qoidalar ro'yxati

DROP

bosing

Paketni jimgina tashlash

Policy

bosing

Zanjirning standart qoidasi

Qoida yaratish

1. Holatni ko'ring

Firewall yoqilganini tekshiring.

2. Qoida qo'shing

Port, yo'nalish, harakat.

3. Sinang

Brauzerda ochib ko'ring.

Windows va Linux

Vazifa	Windows (netsh)	Linux (iptables)
Holat	`show allprofiles state`	`-L -n -v`
Qoida qo'shish	`add rule ...`	`-A INPUT ...`
Qoida o'chirish	`delete rule`	`-D INPUT n`
Ruxsat	`action=allow`	`-j ACCEPT`
Taqiq	`action=block`	`-j DROP`

Pastga bosing: solishtirish

80-port qoidasi (Windows)

Administrator CMD ni oching.
add rule name="Web80" ... ni yozing.
show rule bilan tekshiring, so'ng delete rule bilan o'chiring.

Tartib xatosi


iptables -A INPUT -j DROP
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

Tartib xatosi


iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -j DROP

Firewall raqamlarda

ta profil: Domain, Private, Public

ta zanjir: INPUT, OUTPUT, FORWARD

hujum inson omiliga bog'liq (qo'llanma)

Firewall inson e'tiborsizligini almashtirmaydi.

Amaliy topshiriq 20 daqiqa

OsonProfillar: Windows Firewall ning 3 ta profilini sanang.

OsonZanjirni toping: Shu kompyuterga kelayotgan trafik qaysi zanjirga tushadi?

O'rta80-port: netsh bilan 80-port uchun kiruvchi qoida yozing.

O'rtaTartibni tuzating: Umumiy DROP birinchi turibdi. Nima bo'ladi?

QiyinDefault-deny: SSH va HTTP ga ruxsat beruvchi 3 qatorli iptables qoidasini yozing.

BonusHisobot: Qoidani yaratib, sinab, hisobot yozing.

Dars xulosasi

Windows

Profillar va netsh advfirewall.

Linux

iptables: zanjirlar, -A, -P, -j.

Xavfsizlik

Tartib, default-deny, SSH ni yo'qotmaslik.

Uyga vazifa: Firewall qoidalarini yaratish.

Keyingi dars: VPN arxitekturasi

Tunnellash va IPsec

6-hafta · 17-dars