Configure the Ferm firewall, an iptables frontend on your Linux server

What is the Ferm firewall and what’s it for?

Ferm (For Easy Rule Making) is a frontend of iptables, because of this, beneath, it’s truly utilizing iptables to permit or deny visitors, nevertheless it permits us to configure the firewall in a really superior means with out having to be taught the syntax of iptables or make totally different scripts utilizing iptables, however we are going to do it immediately with Ferm. This instrument is able to studying the guidelines from a configuration file that we’re going to outline, and later it is going to “name” iptables so as to add the totally different guidelines one after the other, inserting them in actual time into the kernel.

Ferm’s purpose is to supply system and community directors with an simple method to learn and write all the firewall guidelines, decreasing the activity of getting to jot down one rule after one other, so we are able to spend extra time growing and optimizing the guidelines, to make them as environment friendly as attainable. Ferm makes use of a quite simple however fairly superior configuration language, we are able to use variables, features, arrays and even blocks. Other very attention-grabbing choices of Ferm is that it’ll permit us to incorporate different configuration information in a listing, and it’ll deal with importing and making use of all these guidelines mechanically.

Ferm continues to be an iptables frontend, subsequently, after we use this instrument, we are going to all the time have the ability to immediately edit and configure the firewall utilizing the iptables instructions. In reality, Ferm is ready to import the present iptables guidelines and mechanically put them in the configuration file, to later edit or broaden them.

One of the hottest iptables frontend is ufw, extensively utilized by system and community directors to simply and shortly configure their firewalls.

Installation and commissioning of Ferm

Ferm set up is absolutely easy, it’s at present in most repositories of the totally different Linux-based distributions, in our case we’ve used the newest model of Debian to carry out all the checks that we’re going to train you. To set up this program, which is an iptables frontend, we should execute the following command:

sudo apt set up ferm

Once we execute this command, we must always see one thing like this, the place we will probably be proven the extra packages that we’ve to put in, mainly we’ve to put in Perl to have the ability to run this program accurately.

The Ferm installer will inform us that it’ll load the firewall guidelines throughout startup from the /and so on/ferm/ferm.conf path, that’s, the whole lot on this file will mechanically be handed to iptables to permit or deny visitors community. The default configuration of this firewall permits us to have entry by SSH remotely by means of port 22, in case you don’t have SSH configured on this port, then you’ll have to edit the default values ​​and click on on “no” in order that it doesn’t begin, in any other case you’ll lose connectivity.

Once we’ve chosen sure or no, apt will end putting in all the extra packages that we have to make this program work.

Once put in, we are able to go to the / and so on / ferm / path and we are going to see each the configuration file referred to as ferm.conf, in addition to a listing referred to as ferm.d the place we are able to incorporate our ferm configuration information to import them, this permits us have larger modularity.

Ferm already comes by default with an inventory of guidelines that we are able to take away at any time, however this may assist us take care of the syntax of this iptables frontend, subsequently, will probably be fairly useful. If we have a look at the syntax, we are going to see that it’s just like nftables, however it’s based mostly on iptables.

In the following screenshot you possibly can see how the domains the place it will be configured (iptables or ip6tables), the tables and the chains, in addition to the guidelines that we’ve inside the totally different chains are declared.

We may see that we’ve a number of guidelines by default:

• In the INPUT chain, the coverage is DROP, localhost visitors is allowed, ICMP visitors is allowed and the connection is allowed by way of IPsec and likewise by way of SSH with the default ports. Regarding the standing of the connections, invalid connections are DROPED, and the established and associated ones are allowed, however the new ones usually are not allowed, besides these particularly outlined.

In the OUTPUT chain it’s outlined that the coverage is to just accept the whole lot, and the state of the connection permits these established and associated. In the FORWARD chain, visitors is denied by coverage, invalid connections are particularly blocked however established and associated connections are allowed.

Next, you possibly can see this configuration file in textual content format:

# -*- shell-script -*-
#
# Configuration file for ferm(1).
#
area (ip ip6) {
desk filter {
chain INPUT {
coverage DROP;

# connection monitoring
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;

# permit native packet
interface lo ACCEPT;

# reply to ping
proto icmp ACCEPT;

# permit IPsec
proto udp dport 500 ACCEPT;
@if @eq($DOMAIN, ip) {
proto (esp ah) ACCEPT;
} @else {
proto (esp) ACCEPT;
}

# permit SSH connections
proto tcp dport ssh ACCEPT;
}
chain OUTPUT {
coverage ACCEPT;

# connection monitoring
#mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
}
chain FORWARD {
coverage DROP;

# connection monitoring
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
}
}
}

@embrace ferm.d/;

The most attention-grabbing half is the “@embrace ferm.d /” that we’ve in the closing half, because of this it is going to import all the configuration information that we’ve in that listing in query.

This Ferm firewall under makes use of iptables, subsequently, if we execute the following command:

iptables -L

We can see the present state of iptables with all the guidelines that it has integrated into the firewall:

Once we’ve seen the default Ferm configuration, we’re going to see totally different configuration examples that we are able to do.

Ferm Basic Configuration

Ferm’s syntax may be very easy and versatile, however we should be taught it to make an accurate configuration. We advocate you access the official Ferm manual the place you’ll find all the particulars about the syntax to make use of and the way the totally different guidelines must be declared in the configuration file, due to this official handbook we will configure this firewall with out many issues.

The very first thing to bear in mind is that every one Ferm guidelines start and finish with braces, and the guidelines finish with a semicolon, subsequently, it’s a well-known syntax in programming. Other attention-grabbing options are that line breaks are ignored, and you’ll put feedback wherever by placing “#” to the finish of the line.

Regarding the syntax of iptables and ferm, we’ve some variations:

• To outline enter interface: interface (if)
• To outline exit interface: outerface (of)
• To outline an origin: saddr
• To outline a vacation spot: daddr
• To outline a protocol: proto
• Port of origin: sport
• Destination port: dport
• Load a module: mod
• Jump to a customized rule: soar

In Ferm there are not any instructions akin to -A, -I, -C, -R or -D, since the whole lot is written in a configuration file, the similar occurs with the instructions so as to add a brand new string, rename it or delete it, now right here disappears utterly. Other options are that ferm means that you can inherit totally different guidelines for use inside different guidelines, nesting in the configuration file.

Once we all know roughly what the syntax is like, we’re going to see some examples evaluating it with iptables, in all of them we are going to work on the «filter» desk in the «INPUT» chain.

iptables -P INPUT ACCEPT
iptables -A INPUT -p tcp -j ACCEPT

In ferm this could be written as follows (including the coverage of the OUTPUT and FORWARD chain from the filter desk):

area ip {
desk filter {
chain INPUT {
coverage DROP;
proto tcp ACCEPT;
}
chain OUTPUT {
coverage ACCEPT;
}
chain FORWARD {
coverage DROP;
}
}
}

Ferm permits us to outline the similar guidelines in the INPUT and OUTPUT simply and shortly, with out the must repeat the guidelines time and again. For instance, we could say that now we wish to settle for the TCP protocol each in the INPUT chain and in the OUTPUT chain, this in iptables could be as follows:

iptables -A INPUT -p tcp -j ACCEPT
iptables -A OUTPUT -p tcp -j ACCEPT
iptables -A INPUT -p udp -j ACCEPT
iptables -A OUTPUT -p udp -j ACCEPT

With Ferm it is so simple as doing the following:

area ip {
desk filter {
chain (INPUT OUTPUT) {
proto (udp tcp) ACCEPT;
}
}

As you possibly can see, it’s a lot sooner and simpler to use this similar rule to each the INPUT and the OUTPUT.

This firewall additionally incorporates very attention-grabbing features, for instance, we are able to test if a variable or perform is outlined, we are able to test if two values ​​are the similar or totally different, deny a Boolean worth, resolve domains immediately from Ferm, concatenate parameters and an extended checklist of features .

Ferm additionally means that you can “load” the iptables modules to make use of them, and configure the firewall in an superior means, for instance, we’ve the following:

mod connlimit connlimit-above four connlimit-mask 24 REJECT;

That we are able to put all through the complete configuration file.

To apply the guidelines launched in Ferm, we should execute the following command:

ferm -i -t 10 /and so on/ferm/ferm.conf

Import iptables guidelines into Ferm

Ferm permits us to simply and shortly import the iptables guidelines that we at present have in execution, in a Ferm file for later modification. To have the ability to do that, we are going to merely need to have the iptables guidelines loaded in reminiscence (at present in use) and execute this command:

import-ferm > /and so on/ferm/ferm.d/reglas-iptables.conf

When we run it, we are able to see the iptables guidelines immediately in Ferm’s syntax.

If you wish to rework the iptables guidelines that you’ve in a textual content file to Ferm, you possibly can execute the following command:

import-ferm origen de las reglas de iptables > /and so on/ferm/ferm.d/reglas-iptables.conf

As you’ve seen, ferm is a superb iptables frontend that may permit us to configure it in an superior means, with out having to be taught the syntax of iptables and arrange the guidelines accurately in a configuration file. However, in our opinion, we imagine that configuring a bash script with all the iptables guidelines accurately doesn’t require any frontend or extra software program, though it could be helpful for some folks. We should do not forget that Nftables already incorporates the risk of configuring the guidelines immediately in a configuration file, and never solely interactively by means of console instructions.