- Show only linux commands only. Your company was acquired by Google corporation
ID: 3888828 • Letter: #
Question
- Show only linux commands only.
Your company was acquired by Google corporation. Now there is a site-to-site vpn connectivity is established however, it doesn’t work as expected. The management of both corporations decided to use Internet and to trust Google’s IP addresses and traffic associated with them to flow through your firewall. Obtain google.com IP addresses (at least two of them or for advanced use you can use their network, in other words you are allowed to use IP addresses range). Use nslookup to do so. The applications that should have access to your system are using both TPC and UDP protocols and they are using the following services, such as sftp, ftp, http, https. Also, there is one managerial IP address 146.115.22.177/255.255.255.255 which must have access to your system, in addition to services above, on port 22 TCP and UDP protocols, 389 TCP and UDP, 3101, 3128 TCP only. Develop the firewall rules to allow all those connections. Please describe each and all ports and their purpose.
Explanation / Answer
To get the ip address for google.com use following command:
nslookup google.com
I got following 2 ip addresses:
Address: 172.217.26.206
Address: 216.58.197.78
NOW FIRST WE DENY ALL CONNECTIONS AND LATER SPECIFY ONLY THOSE THAT WE WANT TO ALLOW:
iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP
No w we allow only specific connection through google.com ip addresses:
iptables -A INPUT -s 172.217.26.206 -j ACCEPT
iptables -A OUTPUT -s 172.217.26.206 -j ACCEPT
in a similar manner as above accept rules can be defined for all google.com ip addresses for sftp, ftp, http, https for tcp as well as udp.
As for the managerial ip address use below command to add port specific rules:
iptables -A INPUT --dport 22 -s 146.115.22.177/255.255.255.255 -j ACCEPT
iptables -A OUTPUT --dport 22 -s 146.115.22.177/255.255.255.255 -j ACCEPT
In a similar manner other specific ports can be added to the rule by spcifying their ports.
Finally use below command to save the table rules:
sudo /sbin/iptables-save
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.