2

I checked in the Tails documentation and I saw nothing about the firewall. Is there a firewall like iptables in Tails?

Thanks

3

Have a look at the Network Filter documentation.

.... This is solved by blocking all outbound Internet traffic except Tor (and I2P when enabled), and explicitly configuring all applications to use one of these.

config/chroot local-includes/etc/ferm/ferm.conf (uses ferm to build an iptables ruleset)

  • So if I well understand, everything is already pre-configured. – clara987 Apr 29 '16 at 10:38
  • So if I understand well, everything is already pre-configured. All outbound Internet traffic is blocked except Tor. I've got nothing to do except if I want to change some rules. Is that it? – clara987 Apr 29 '16 at 10:45
  • That's correct, yes. – Richard Horrocks Apr 29 '16 at 11:05
  • Thanks for the network filter link. Tails documentation states “Tails short description talks of sending through Tor outgoing connections to the Internet. Indeed: traffic to the local LAN (RFC1918 addresses) is wide open as well as the loopback traffic obviously” I think it means that we need to build are own network to prevent any incoming data. – Silver Jun 2 '16 at 4:32
  • This is incorrect, incoming traffic is dropped even for the LAN addresses. It can make outbound connections to the LAN with the except of port 53 to stop accidental DNS leaks. Local loopback traffic also is not "wide open", infact the amnesia user is only able to access a small set of whitelisted ports on the local loopback interface. see: git-tails.immerda.ch/tails/plain/config/chroot_local-includes/… – cacahuatl Jun 2 '16 at 23:23
0

This command should work to take a look at the firewall

sudo iptables -L -v

Also I add an interface specific drop command before the loopback command to prevent an attack that I think may be possible against the loopback. These packets are called martian packets.

https://en.wikipedia.org/wiki/Martian_packet


Full output

amnesia@amnesia:~$ sudo iptables -L -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             state ESTABLISHED
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             state ESTABLISHED
    0     0 ACCEPT     icmp --  any    lo      anywhere             anywhere             state RELATED
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9050 flags:FIN,SYN,RST,ACK/SYN owner UID match root
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9050 flags:FIN,SYN,RST,ACK/SYN owner UID match proxy
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9050 flags:FIN,SYN,RST,ACK/SYN owner UID match nobody
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp flags:FIN,SYN,RST,ACK/SYN multiport dports 9050,9061,9062,9150 owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9062 flags:FIN,SYN,RST,ACK/SYN owner UID match htp
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9062 flags:FIN,SYN,RST,ACK/SYN owner UID match tails-iuk-get-target-file
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9062 flags:FIN,SYN,RST,ACK/SYN owner UID match tails-upgrade-frontend
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9051 owner UID match tor-launcher
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9051 owner UID match root
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9052 owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:9040 owner UID match amnesia
    0     0 ACCEPT     udp  --  any    lo      anywhere             localhost            udp dpt:domain owner UID match amnesia
    0     0 ACCEPT     udp  --  any    lo      anywhere             localhost            udp dpt:mdns owner UID match amnesia
    0     0 ACCEPT     udp  --  any    lo      anywhere             127.0.0.2            udp dpt:domain owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             127.0.0.2            tcp dpt:domain flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:4101 flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:ipp flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    lo      anywhere             localhost            tcp dpt:6136 flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
    0     0 ACCEPT     tcp  --  any    !lo     anywhere             anywhere             owner UID match clearnet
    0     0 ACCEPT     udp  --  any    !lo     anywhere             anywhere             owner UID match clearnet udp dpt:domain
    0     0 lan        all  --  any    any     anywhere             10.0.0.0/8          
    0     0 lan        all  --  any    any     anywhere             172.16.0.0/12       
    0     0 lan        all  --  any    any     anywhere             192.168.0.0/16      
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             owner UID match debian-tor tcp flags:FIN,SYN,RST,ACK/SYN state NEW
    0     0 LOG        all  --  any    any     anywhere             anywhere             LOG level debug uid prefix "Dropped outbound packet: "
    0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable

Chain lan (3 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     tcp  --  any    any     anywhere             anywhere             tcp dpt:domain reject-with icmp-port-unreachable
    0     0 REJECT     udp  --  any    any     anywhere             anywhere             udp dpt:domain reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     anywhere             anywhere             owner UID match i2psvc reject-with icmp-port-unreachable
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere   
  • I think you'll find the default policy is already set to drop. Where do you think the exception that would allow martian packets exists? – cacahuatl Sep 20 '16 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.