2

I checked in the Tails documentation and I saw nothing about the firewall. Is there a firewall like iptables in Tails?

Thanks

2 Answers 2

3

Have a look at the Network Filter documentation.

.... This is solved by blocking all outbound Internet traffic except Tor (and I2P when enabled), and explicitly configuring all applications to use one of these.

config/chroot local-includes/etc/ferm/ferm.conf (uses ferm to build an iptables ruleset)

5
  • So if I well understand, everything is already pre-configured.
    – clara987
    Apr 29, 2016 at 10:38
  • So if I understand well, everything is already pre-configured. All outbound Internet traffic is blocked except Tor. I've got nothing to do except if I want to change some rules. Is that it?
    – clara987
    Apr 29, 2016 at 10:45
  • That's correct, yes. Apr 29, 2016 at 11:05
  • Thanks for the network filter link. Tails documentation states “Tails short description talks of sending through Tor outgoing connections to the Internet. Indeed: traffic to the local LAN (RFC1918 addresses) is wide open as well as the loopback traffic obviously” I think it means that we need to build are own network to prevent any incoming data.
    – Silver
    Jun 2, 2016 at 4:32
  • This is incorrect, incoming traffic is dropped even for the LAN addresses. It can make outbound connections to the LAN with the except of port 53 to stop accidental DNS leaks. Local loopback traffic also is not "wide open", infact the amnesia user is only able to access a small set of whitelisted ports on the local loopback interface. see: git-tails.immerda.ch/tails/plain/config/chroot_local-includes/…
    – cacahuatl
    Jun 2, 2016 at 23:23
0

This command should work to take a look at the firewall

sudo iptables -L -v

Also I add an interface specific drop command before the loopback command to prevent an attack that I think may be possible against the loopback. These packets are called martian packets.

https://en.wikipedia.org/wiki/Martian_packet


Full output

amnesia@amnesia:~$ sudo iptables -L -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             state ESTABLISHED
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             state ESTABLISHED
    0     0 ACCEPT     icmp --  any    lo      anywhere             anywhere             state RELATED
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9050 flags:FIN,SYN,RST,ACK/SYN owner UID match root
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9050 flags:FIN,SYN,RST,ACK/SYN owner UID match proxy
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9050 flags:FIN,SYN,RST,ACK/SYN owner UID match nobody
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp flags:FIN,SYN,RST,ACK/SYN multiport dports 9050,9061,9062,9150 owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9062 flags:FIN,SYN,RST,ACK/SYN owner UID match htp
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9062 flags:FIN,SYN,RST,ACK/SYN owner UID match tails-iuk-get-target-file
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9062 flags:FIN,SYN,RST,ACK/SYN owner UID match tails-upgrade-frontend
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9051 owner UID match tor-launcher
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9051 owner UID match root
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9052 owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9040 owner UID match amnesia
    0     0 ACCEPT     udp  --  any    lo      anywhere             localhost            udp dpt:domain owner UID match amnesia
    0     0 ACCEPT     udp  --  any    lo      anywhere             localhost            udp dpt:mdns owner UID match amnesia
    0     0 ACCEPT     udp  --  any    lo      anywhere             127.0.0.2            udp dpt:domain owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             127.0.0.2            tcp dpt:domain flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:4101 flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:ipp flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:6136 flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    !lo     anywhere             anywhere             owner UID match clearnet
    0     0 ACCEPT     udp  --  any    !lo     anywhere             anywhere             owner UID match clearnet udp dpt:domain
    0     0 lan        all  --  any    any     anywhere             10.0.0.0/8          
    0     0 lan        all  --  any    any     anywhere             172.16.0.0/12       
    0     0 lan        all  --  any    any     anywhere             192.168.0.0/16      
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             owner UID match debian-tor tcp flags:FIN,SYN,RST,ACK/SYN state NEW
    0     0 LOG        all  --  any    any     anywhere             anywhere             LOG level debug uid prefix "Dropped outbound packet: "
    0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable

Chain lan (3 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     tcp  --  any    any     anywhere             anywhere             tcp dpt:domain reject-with icmp-port-unreachable
    0     0 REJECT     udp  --  any    any     anywhere             anywhere             udp dpt:domain reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     anywhere             anywhere             owner UID match i2psvc reject-with icmp-port-unreachable
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere   
1
  • I think you'll find the default policy is already set to drop. Where do you think the exception that would allow martian packets exists?
    – cacahuatl
    Sep 20, 2016 at 14:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .