Unauthorized Activity Detection using IPTables

Unauthorized Activity Detection using IPTables

[Amit Kumar Gupta]

[-- Attachment #1.1: Type: text/plain, Size: 248 bytes --]

Hi,
 
 
I want to know how to detect unauthorized activities in firewall using
IPtables.
If any user tries for some unauthorized service, I should be able to log
it and drop it.
 
 
Please give suggestions.
 
Thanks & Regards.
 
Amit

[-- Attachment #1.2: Type: text/html, Size: 4561 bytes --]

[-- Attachment #2: Wipro_Disclaimer.txt --]
[-- Type: text/plain, Size: 514 bytes --]

**************************Disclaimer************************************************

Information contained in this E-MAIL being proprietary to Wipro Limited is 
'privileged' and 'confidential' and intended for use only by the individual
 or entity to which it is addressed. You are notified that any use, copying 
or dissemination of the information contained in the E-MAIL in any manner 
whatsoever is strictly prohibited.

***************************************************************************************

Re: Unauthorized Activity Detection using IPTables

[Maciej Soltysiak]

Hello,

If you construct your firewall like this:
- allow what's allow
- log and drop everything else.

You will have what you need.

you can use something like:
iptables -N logdrop
iptables -A logdrop -j LOG
iptables -A logdrop -j DROP

and at the end of your chains add:
iptables -A FORWARD -j logdrop

This is for FORWARD chain, change it to whatever you need.

Regards,
Maciej Soltysiak

RE: Unauthorized Activity Detection using IPTables

[Ranjeet Shetye]

[-- Attachment #1: Type: text/plain, Size: 1798 bytes --]

 
I read this and I went "WHOA!"
 
**************************Disclaimer************************************
************
 
Information contained in this E-MAIL being proprietary to Wipro Limited
is 
'privileged' and 'confidential' and intended for use only by the
individual
 or entity to which it is addressed. You are notified that any use,
copying 
or dissemination of the information contained in the E-MAIL in any
manner 
whatsoever is strictly prohibited.
 
************************************************************************
***************

I think I know the comprehensive answer to your query but going by your
disclaimer "any use ... of the information contained in the E-MAIL in
any manner 
whatsoever is strictly prohibited", I cant help you without breaking a
few dozen laws, I guess, unless Ashcroft has passed even more while I
was writing this email. :D
 
Your disclaimers would be appropriate for private emails but I would
suggest that if you are going to be in a public forum then you will
necessarily have to change your disclaimers if you want people to be
able to come forward and help you!
 
take care,
Ranjeet Shetye
Senior Software Engineer
Zultys Technologies
771 Vaqueros Avenue
Sunnyvale  CA  94085
USA
Ranjeet.Shetye@Zultys.com
http://www.zultys.com/
 
-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Amit Kumar
Gupta
Sent: Friday, December 13, 2002 6:44 AM
To: netfilter@lists.netfilter.org
Subject: Unauthorized Activity Detection using IPTables


Hi,
 
 
I want to know how to detect unauthorized activities in firewall using
IPtables.
If any user tries for some unauthorized service, I should be able to log
it and drop it.
 
 
Please give suggestions.
 
Thanks & Regards.
 
Amit

[-- Attachment #2: Type: text/html, Size: 8042 bytes --]

RE: Unauthorized Activity Detection using IPTables

[Vagner Machado]

[-- Attachment #1: Type: text/plain, Size: 563 bytes --]

See  <http://www.psionic.com/products/portsentry.html>
http://www.psionic.com/products/portsentry.html
-----Original Message-----
From: Amit Kumar Gupta [mailto:amitkumar.gupta@wipro.com] 
Sent: sexta-feira, 13 de dezembro de 2002 11:44
To: netfilter@lists.netfilter.org
Subject: Unauthorized Activity Detection using IPTables


Hi,
 
 
I want to know how to detect unauthorized activities in firewall using
IPtables.
If any user tries for some unauthorized service, I should be able to log it
and drop it.
 
 
Please give suggestions.
 
Thanks & Regards.
 
Amit

[-- Attachment #2: Type: text/html, Size: 5827 bytes --]