Windows – Equivalent of IPTables

The most secure way to work with iptables is close everything and only open what you need. I'm kind of distracted, so I always try to be as lazy as possible, so I do not make mistakes which can lead the server to be unsecure.

I use this one, only a little bit of varible assignment must be done in order to make it work.

  #!/bin/bash +x

  # first author: marcos de vera
  # second: joan marc riera

  ip=/sbin/iptables
  mriera="xx.xx.xx.xx"
  nsancho="yy.yy.yy.yy"
  admins="$mriera $nsancho "
  sshers=""
  mysqlrs="zz.zz.zz.zz/23"
  snmprs="uu.uu.uu.uu"
  tcpservices="80 443 22"
  udpservices=""

  # Firewall script for servername

  echo -n ">> Applying iptables rules... "

  ## flushing...
  $ip -F
  $ip -X
  $ip -Z
  $ip -t nat -F

  # default: DROP!
  $ip -P INPUT DROP
  $ip -P OUTPUT DROP
  $ip -P FORWARD DROP

  # filtering...

  # localhost: free pass!
  $ip -A INPUT -i lo -j ACCEPT
  $ip -A OUTPUT -o lo -j ACCEPT

  # administration ips: free pass!
  for admin in $admins ; do
      $ip -A INPUT -s $admin -j ACCEPT
      $ip -A OUTPUT -d $admin -j ACCEPT
  done

  # allow ssh access to sshers
  for ssher in $sshers ; do
      $ip -A INPUT -s $ssher -p tcp -m tcp --dport 22 -j ACCEPT
      $ip -A OUTPUT -d $ssher -p tcp -m tcp --sport 22 -j ACCEPT
  done

  # allow access to mysql port to iReport on sugar

  for mysql in $mysqlrs ; do
      $ip -A INPUT -s $mysql -p tcp -m tcp --dport 3306 -j ACCEPT
      $ip -A OUTPUT -d $mysql -p tcp -m tcp --sport 3306 -j ACCEPT
      $ip -A INPUT -s $mysql -p udp -m udp --dport 3306 -j ACCEPT
      $ip -A OUTPUT -d $mysql -p udp -m udp --sport 3306 -j ACCEPT
  done


  # allowed services
  for service in $tcpservices ; do
      $ip -A INPUT -p tcp -m tcp --dport $service -j ACCEPT
      $ip -A OUTPUT -p tcp -m tcp --sport $service -m state --state RELATED,ESTABLISHED -j ACCEPT
  done
  for service in $udpservices ; do
      $ip -A INPUT -p udp -m udp --dport $service -j ACCEPT
      $ip -A OUTPUT -p udp -m udp --sport $service -m state --state RELATED,ESTABLISHED -j ACCEPT
  done

  $ip -A INPUT -j LOG --log-level 4
  # VAS and VGP
  #88 tcp udp
  #389 tcp ldap queries , udp ldap ping
  #464 tcp upd kerberos
  #3268 tcp global catalog access
  for dc in ip.ip.ip.ip ; do # our dc servers for some ldap auth
      vas=88
      $ip -A INPUT -s $dc -p tcp -m tcp --dport $vas -j ACCEPT
      $ip -A OUTPUT -d $dc -p tcp -m tcp --dport $vas -j ACCEPT
      $ip -A INPUT -s $dc -p udp -m udp --dport $vas -j ACCEPT
      $ip -A OUTPUT -d $dc -p udp -m udp --dport $vas -j ACCEPT
      ldap=389
      $ip -A INPUT -s $dc -p tcp -m tcp --dport $ldap -j ACCEPT
      $ip -A OUTPUT -d $dc -p tcp -m tcp --dport $ldap -j ACCEPT
      $ip -A INPUT -s $dc -p udp -m udp --dport $ldap -j ACCEPT
      $ip -A OUTPUT -d $dc -p udp -m udp --dport $ldap -j ACCEPT
      kpasswd=464
      $ip -A INPUT -s $dc -p tcp -m tcp --dport $kpasswd -j ACCEPT
      $ip -A OUTPUT -d $dc -p tcp -m tcp --dport $kpasswd -j ACCEPT
      $ip -A INPUT -s $dc -p udp -m udp --dport $kpasswd -j ACCEPT
      $ip -A OUTPUT -d $dc -p udp -m udp --dport $kpasswd -j ACCEPT
      gca=3268
      $ip -A INPUT -s $dc -p tcp -m tcp --dport $gca -j ACCEPT
      $ip -A OUTPUT -d $dc -p tcp -m tcp --dport $gca -j ACCEPT
      vgp=445
      $ip -A INPUT -s $dc -p tcp -m tcp --dport $vgp -j ACCEPT
      $ip -A OUTPUT -d $dc -p tcp -m tcp --dport $vgp -j ACCEPT
  done


  # allow the machine to browse the internet
  $ip -A INPUT -p tcp -m tcp --sport 80 -m state --state RELATED,ESTABLISHED -j ACCEPT
  $ip -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
  $ip -A INPUT -p tcp -m tcp --sport 443 -m state --state RELATED,ESTABLISHED -j ACCEPT
  $ip -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT

  $ip -A INPUT -p tcp -m tcp --sport 8080 -m state --state RELATED,ESTABLISHED -j ACCEPT
  $ip -A OUTPUT -p tcp -m tcp --dport 8080 -j ACCEPT


  # don't forget the dns...
  $ip -A INPUT -p udp -m udp --sport 53 -j ACCEPT
  $ip -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
  $ip -A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
  $ip -A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT

  # ... neither the ntp... (hora.rediris.es)
  #$ip -A INPUT -s 130.206.3.166 -p udp -m udp --dport 123 -j ACCEPT
  #$ip -A OUTPUT -d 130.206.3.166 -p udp -m udp --sport 123 -j ACCEPT

  $ip -A INPUT -p udp -m udp --dport 123 -j ACCEPT
  $ip -A OUTPUT -p udp -m udp --sport 123 -j ACCEPT


  # and last but not least, the snmp access
  for monitor in $snmprs ; do
      $ip -A INPUT -s $monitor -p tcp -m tcp --sport 161 -j ACCEPT   # monitoring service
      $ip -A OUTPUT -d $monitor -p tcp -m tcp --dport 161 -j ACCEPT  # monitoring service
  end
  # outgoing SMTP
  $ip -A INPUT -p tcp -m tcp --sport 25 -j ACCEPT
  $ip -A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT


  # temporary backup if we change from DROP to ACCEPT policies
  $ip -A INPUT -p tcp -m tcp --dport 1:1024 -j DROP
  $ip -A INPUT -p udp -m udp --dport 1:1024 -j DROP


  echo "OK. Check rules with iptables -L -n"

  # end :)

I've been using it for some time , and any kind of modification will be very appreciated if it makes it easier to administrate.

Based on my own experience and what I encountered while Googling, here are some things to try:

1. Did you check that it works correctly?

Changes to hosts should take effect immediately, but Windows caches name resolution data so for some time the old records may be used. Open a command line (Windows+R, cmd, Enter) and type:

ipconfig /flushdns

To drop the old data. To check if it works, use (assuming you have an ipv4 entry in your hosts for www.example.com, or an ipv6 entry in your hosts for ipv6.example.com):

ping -4 www.example.com -n 1
ping -6 www.example.com -n 1

And see if it uses the correct IP. If yes, your hosts file is fine and the problem is elsewhere.

Also, you can reset the NetBios cache with (open the console as an admin or it will fail):

nbtstat -R

You can check the current data in the DNS cache with:

ipconfig /displaydns | more

NB: nslookup does not look at the hosts file. See NSLOOKUP and NBLOOKUP give one IP address; PING finds another

2. Basics

• Is your hosts file named correctly? It should be hosts and not host, etc.
• Is the extension correct? It should have no extension (hosts not hosts.txt) - be careful if you have configured windows to hide known extensions, check the properties to be sure: The correct hosts file's type will show up as just "File".
• Did you follow the correct syntax? Did you accidentally prefix lines with a hash (#) which indicates comments?
• Did you take care of all variants (www.example.com and example.com - safest to just add both)?

3. Whitespace

The format for each line is IP address, then a horizontal tab (escape code \t, ASCII HT, hex 0x09) or a single space (hex 0x20), then the host name, ie. www.example.com, then finally a carriage return followed by a line feed, (escape codes \r\n, ASCII CRLF, hex 0x0d 0x0a).

Sample entries, using Unicode control pictures to indicate control characters. (Don't copy and paste these into your hosts file!)

192.0.2.1␉www.example.com␍␊
2001:db8:8:4::2␉ipv6.example.com␍␊

The individual bytes may be viewed in Notepad++ with the hex editor plugin. Notepad++ will also show special characters (View -> Show Symbol) so you can easily inspect the number and kind of whitespace characters.

If you copied and pasted hosts entries from somewhere, you may end up with multiple spaces. In theory hosts supports multiple spaces separating the two columns, but it's another thing to try if nothing else works.

To be on the safe side, make sure all lines in your hosts file either use tabs or spaces, not both.

Lastly, terminate the file with a blank line.

4. Registry Key

There is a registry key specifying the location of the hosts file. Supposedly, Windows doesn't actually support putting the hosts file in other locations, but you might want to check. The key is:

\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DataBasePath

The entry should be:

%SystemRoot%\System32\drivers\etc

Or, in a Command Prompt window, type:

reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters -v DataBasePath

which should display something similar to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
DataBasePath    REG_EXPAND_SZ    %SystemRoot%\System32\drivers\etc

5. Permissions

Sometimes there are issues with permissions on the file, the file attributes, and similar things. To recreate the file with default permissions:

1. Create a new text file on your desktop.
2. Copy and paste the contents of your current hosts file into this file in Notepad.
3. Save the new text file and rename it to hosts.
4. Copy (do not move) the file to your %SystemRoot%\System32\drivers\etc directory, and overwrite the old file.

Last point is important: Copying works, moving doesn't.

The local Users account must be able to read the hosts file. To make sure (in Windows 7):

1. Navigate to %SystemRoot%\System32\drivers\etc in Windows Explorer.
2. If you can't see the hosts file, ensure you can see hidden and system files.
3. Right-click on the hosts file and select Properties from the context menu.
4. In the hosts Properties window, click on the Security tab.
5. Examine the list of names in the Group or user names: box. If %COMPUTERNAME%\Users is present, click on it to view permissions.
6. If Users is not present, or is present but does not have Read permission, click Edit....
7. If Users is not present, click Add..., type Users, click Check Names, and click OK or press Enter.
8. Select Users, and ensure Read & execute is checked in the Allow column. Click OK. If a Windows Security alert box pops up, choose Yes to continue.
9. Click OK to close the hosts Properties window.
10. Go up to section 1 of this answer and follow the directions to check if it's working now.

Or, in a Command Prompt window, type:

icacls %SystemRoot%\System32\drivers\etc\hosts

which should display something like:

C:\WINDOWS\System32\drivers\etc\hosts NT AUTHORITY\SYSTEM:(F)
                                      NT AUTHORITY\SYSTEM:(I)(F)
                                      BUILTIN\Administrators:(I)(F)
                                      BUILTIN\Users:(I)(RX)
                                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                                      APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)

You should see an (R) after BUILTIN\Users.

6. Encoding

The hosts file should encoded in ANSI or UTF-8 without BOM. You can do this with File -> Save As.

7. Proxies

If you have a proxy configured, it may bypass the hosts file. The solution is to not use the proxy, or configure it to not do this.

To check, go to your Internet Explorer -> Internet Options -> Connections -> LAN settings. If everything is blank and "Automatically detect settings" is checked, you aren't using a proxy.

If you rely on a proxy to access the web and therefore don't want to disable it, you can add exceptions by going to Internet Explorer -> Internet Options -> Connections -> LAN settings -> Proxy Server / Advanced. Then add your exceptions to the Exceptions text box. e.g. localhost;127.0.0.1;*.dev

8. DNS address

(This may also resolve proxy issues.)

Go to your network connections properties, then TCP/IP settings, and change the first DNS server to 127.0.0.1 (localhost). The second should probably be your actual DNS's IP.

This is not necessary for the hosts file to work, but it may help in your case if something is configured strangely.

9. .local addresses

If you are using a .local domain entry in the form of myhost.local and it gets ignored please try the following:

x.x.x.x myhost.local www.myhost.local

even if the www.myhost.local does not exist. Windows somehow does not append its workgroup or localdomain.

10. Line / count limits

(added to this answer to make it visible as it's been mentioned a few times)

Windows hosts file seems to have a line or host limit. If you have more than 150 characters on a line or more than 8 hosts entries for an IP create a new line

e.g. instead of:

1.2.3.4 host1.com host2.com host3.com host4.com host5.com host6.com host7.com host8.com host9.com 

Try this:

1.2.3.4 host1.com host2.com host3.com host4.com host5.com
1.2.3.4 host6.com host7.com host8.com host9.com