Use iptables to implement packet filtering and configure network address translation (NAT)

I'll start with the second part of this objective as it is the more concretely defined.
In my case, I will be using two vlans instead of two actual interfaces for reasons that would take, way, way too long to explain.
I have a bunch of servers on network 10.168.20.0 and they want to communicate with servers on network 10.10.11.0. In this configuration, 10.168.20.0 could be thought of as my local network and 10.10.11.0 as the internet.

The gateway server has eth1.11 with ip address 10.10.11.16 and eth1.10 with ip address 10.168.20.227. If you are wondering what the .11 and .10 mean, well, they are tagged (VLan) traffic, have a look here for some details. In a more standard configuration you would probably use eth0 for local and eth1 for internet, so change commands below accordingly.

On the gateway server, we need to modify the iptables rules as follows:

1. iptables -t nat -I POSTROUTING -o eth1.11 -j MASQUERADE
2. iptables -I FORWARD -i eth1.10 -o eth1.11 -j ACCEPT --comment "accept everything on the way out"
3. iptables -I FORWARD -o eth1.10 -i eth1.11 -m state --state RELATED,ESTABLISHED -j ACCEPT -m comment --comment "accept related or established on the way back"
4. service iptables save

The first rule modifies the packets so that they are returned to the the original server.
The second rule will forward any traffic coming from eth1.10, i.e. the local network to eth1.11, ie. the "internet".  You don't need the comments, obviously.
Finally, the third rule will forward the packages on their way back from the internet to the local network, note that no new connections will be forwarded, to prevent connections being forwarded that were not initiated from a server in the local network.

You now need to allow the gateway to forward ip packets and this can be done by modifying the /etc/sysctl.conf file. Look for this line net.ipv4.ip_forward = 0 and change its value to net.ipv4.ip_forward = 1

Issue the following command to reload the sysctl.conf file:

sysctl -p

You can check that the changes have taken place with:

sysctl net.ipv4.ip_forward

Your server is ready, you just need to make sure that the default gateway is set to this server in the clients, see my previous post for details on how to do this.

NAT done and dusted, lets have a look at packet filtering. This is such an open ended objective that it is hard to see what is been asked of the candidate, I have touched on iptables in a previous post, so I'll be brief here.
Say you want to prevent an ip addresses from accessing your server, in case they are trying a rudimentary DOS attack

iptables -I INPUT -p tcp --dport 80 -s 10.168.20.225 -j REJECT

You can block a whole network, just change the -s parameter to say, 10.168.20.0/24. You can use a similar rule to allow access from particular ip addresses or networks (make sure that there are no spaces between the ip addresses or networks) :

 iptables -I INPUT -p tcp --dport 80 -s 10.168.20.225,10.168.20.226 -j ACCEPT

Similarly, you could create a single rule for several services (say http, https):

 iptables -I INPUT -p tcp -m multiport --dports 80,443  -j ACCEPT

As you can imagine, this barely touches the surface of what iptables can do, but it gives you an idea.

Configure firewall settings using system-config-firewall or iptables

Since advanced iptables settings (routing, NATing) are covered in the RHCE exam, I assume that this objective relates to allowing services through the firewall.
If you have been following this blog, and who hasn't?, then you'll already be somewhat familiar with the iptables command, but I'll expand here a little bit on some of the commands, however first let's have a look at system-config-firewall.
This is the main screen:

Once you have allowed the services you want through the firewall, click Apply.

Note that this will essentially overwrite the current iptables configuration. If you are only using system-config-firewall then this is of no concern to you, so go ahead and press yes.

As with most GUI tools, it is fairly simple to use and there is not much to be said here, so let's turn our attention to iptables.

The iptables command is very powerful and can do a lot of things and thus it can be fairly complex, but my reading of this objective is that only the basics are needed, so let's get started:

iptables -F

this will clear your iptables configuration, which will allow any traffic through, you can check that the firewall rules are empty with this command:

iptables -nvL

Now, let's block all traffic:

iptables -I INPUT -j DROP

Needeless to say that you should not perform this command remotely, as it will block your remote connection. You can use REJECT instead of DROP, where the former replies to client and the latter doesn't, check the iptables manual for longer and better explanation.

Let's allow ssh connections:

iptables -I INPUT -p tcp --dport ssh  -j ACCEPT

Note, that if you use -I iptables will insert the line to the top of the chain, if you want to add it to the bottom of the chain you can use -A instead.

Note that the above will only allow ssh traffic for connections that have been established to this server and not from this server to another server. The reason for this is best explained with the ouput of the netstat -ant command:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State
tcp        0      0  0.0.0.0:22                              0.0.0.0:*                       LISTEN
tcp        0      0 10.168.20.221:22            10.168.20.227:34492         ESTABLISHED
tcp         0 0     10.168.20.221:44334        10.168.20.225:22            ESTABLISHED

You can see that the local server (10.168.20.221) is listening to any address on port 22 and you can also see that a connection has been established to the local server on port 22 from 10.168.20.227 on port 34492. The line below shows the opposite, a connection has been established from port 44334 on the local server to 10.168.20.225 on port 22. This is essentially how network sockets work, the service listens on a pre-established port, 22 in this case, and the actual connection takes place in one of the ephemeral ports, remember that each connection needs a socket, so that if you connected to port 22, then nobody else would be able to connect to that socket and thus no more connections to the server, not very useful, right? So what can you do, just add a rule like this:

iptables -I INPUT -p tcp -m state --state  RELATED,ESTABLISHED -j ACCEPT

Note that in order for a connection to be established in needs to be initiated from the client and thus should not present any risks if your server has not been compromised.

A better rule would use the source port and input interfaces flag --sport and -i respectively, so that only SSH connections are allowed, like this:

iptables -I INPUT -i eth0 -p tcp --sport 22 -m state --state  RELATED,ESTABLISHED -j ACCEPT

Remember that you need to save the rules as otherwise they will be lost after a reboot, a new way of saving them not discussed before:

service iptables save 

I have already provided examples of rules for web and ftp servers in previous posts. A couple more commands to finish, the first one is how to delete rules.

iptables -D chainname rulenumber

and the second one is how to zero the counters, this can be helpful with troubleshooting sometimes:

iptables -Z chainname