Firewall with Tails

Question

I checked in the Tails documentation and I saw nothing about the firewall. Is there a firewall like iptables in Tails?

Thanks

Answer 1

Have a look at the Network Filter documentation.

.... This is solved by blocking all outbound Internet traffic except Tor (and I2P when enabled), and explicitly configuring all applications to use one of these.

config/chroot local-includes/etc/ferm/ferm.conf (uses ferm to build an iptables ruleset)

Answer 2

This command should work to take a look at the firewall

sudo iptables -L -v

Also I add an interface specific drop command before the loopback command to prevent an attack that I think may be possible against the loopback. These packets are called martian packets.

https://en.wikipedia.org/wiki/Martian_packet

---

Full output

amnesia@amnesia:~$ sudo iptables -L -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             state ESTABLISHED
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             state ESTABLISHED
    0     0 ACCEPT     icmp --  any    lo      anywhere             anywhere             state RELATED
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9050 flags:FIN,SYN,RST,ACK/SYN owner UID match root
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9050 flags:FIN,SYN,RST,ACK/SYN owner UID match proxy
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9050 flags:FIN,SYN,RST,ACK/SYN owner UID match nobody
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp flags:FIN,SYN,RST,ACK/SYN multiport dports 9050,9061,9062,9150 owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9062 flags:FIN,SYN,RST,ACK/SYN owner UID match htp
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9062 flags:FIN,SYN,RST,ACK/SYN owner UID match tails-iuk-get-target-file
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9062 flags:FIN,SYN,RST,ACK/SYN owner UID match tails-upgrade-frontend
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9051 owner UID match tor-launcher
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9051 owner UID match root
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9052 owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9040 owner UID match amnesia
    0     0 ACCEPT     udp  --  any    lo      anywhere             localhost            udp dpt:domain owner UID match amnesia
    0     0 ACCEPT     udp  --  any    lo      anywhere             localhost            udp dpt:mdns owner UID match amnesia
    0     0 ACCEPT     udp  --  any    lo      anywhere             127.0.0.2            udp dpt:domain owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             127.0.0.2            tcp dpt:domain flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:4101 flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:ipp flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:6136 flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    !lo     anywhere             anywhere             owner UID match clearnet
    0     0 ACCEPT     udp  --  any    !lo     anywhere             anywhere             owner UID match clearnet udp dpt:domain
    0     0 lan        all  --  any    any     anywhere             10.0.0.0/8          
    0     0 lan        all  --  any    any     anywhere             172.16.0.0/12       
    0     0 lan        all  --  any    any     anywhere             192.168.0.0/16      
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             owner UID match debian-tor tcp flags:FIN,SYN,RST,ACK/SYN state NEW
    0     0 LOG        all  --  any    any     anywhere             anywhere             LOG level debug uid prefix "Dropped outbound packet: "
    0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable

Chain lan (3 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     tcp  --  any    any     anywhere             anywhere             tcp dpt:domain reject-with icmp-port-unreachable
    0     0 REJECT     udp  --  any    any     anywhere             anywhere             udp dpt:domain reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     anywhere             anywhere             owner UID match i2psvc reject-with icmp-port-unreachable
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere