RE: anti-dos

RE: anti-dos

[Fritz Mesedilla]

I forgot to ask.
I am putting this before the rest of my rules, right? Will this allow legit transaction to get through?

Thanks.


Cheers,

fritz <www.mesedilla.com>
---
+ Basta Ikaw Lord




-----Original Message-----
From: Ray Leach [mailto:raymondl@knowledgefactory.co.za]
Sent: Wednesday, January 28, 2004 4:14 PM
To: Netfilter Mailing List (E-mail)
Subject: Re: anti-dos


On Wed, 2004-01-28 at 09:18, Fritz Mesedilla wrote:
> in preparation to sco's feb 1. dos attack, is there any special iptables rules that i can use to avoid dos attacks?
> all i have right now is i blocked all ports then opened the mail and internet.
> 
> what else can i do for rules?
> 
You can use the limit support to limit packet rates:

### syn-flood chain
$IPTABLES -N syn-flood
$IPTABLES -A syn-flood -i $IFACE_INET -m limit --limit 75/s
--limit-burst 100 -j RETURN
$IPTABLES -A syn-flood -i $IFACE_DMZ -m limit --limit 75/s --limit-burst
100 -j RETURN
$IPTABLES -A syn-flood -i $IFACE_INT -j RETURN
$IPTABLES -A syn-flood -j LOG --log-prefix "SYN-FLOOD: "
$IPTABLES -A syn-flood -j DROP

$IPTABLES -A INPUT -i $IFACE_INT -p tcp --syn -j syn-flood
$IPTABLES -A INPUT -i $IFACE_DMZ -p tcp --syn -j syn-flood
$IPTABLES -A INPUT -i $IFACE_INET -p tcp --syn -j syn-flood


> thanks.
> 
> 
> Cheers,
> 
> fritz <www.mesedilla.com>
> ---
> + Basta Ikaw Lord
> 
> 
> 
> 
> ----------------------------------------------------------------------
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the sender immediately by e-mail and delete this e-mail from your
> system. Please note that any views or opinions presented in this
> email are solely those of the author and do not necessarily represent
> those of the company. Finally, the recipient should check this email
> and any attachments for the presence of viruses. The company accepts
> no liability for any damage caused by any virus transmitted by this
> email. 
> 
> Overture Media, Inc.
> Direct Line: (632) 635-4785
> Trunkline:   (632) 631-8971 Local 146
> Fax: (632) 637-2206
> Level 1 Summit Media Offices, Robinsons Galleria EDSA Cor. Ortigas Ave., Quezon City 1100
-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

----------------------------------------------------------------------
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender immediately by e-mail and delete this e-mail from your
system. Please note that any views or opinions presented in this
email are solely those of the author and do not necessarily represent
those of the company. Finally, the recipient should check this email
and any attachments for the presence of viruses. The company accepts
no liability for any damage caused by any virus transmitted by this
email. 

Overture Media, Inc.
Direct Line: (632) 635-4785
Trunkline:   (632) 631-8971 Local 146
Fax: (632) 637-2206
Level 1 Summit Media Offices, Robinsons Galleria EDSA Cor. Ortigas Ave., Quezon City 1100

RE: anti-dos

[Ray Leach]

[-- Attachment #1: Type: text/plain, Size: 2901 bytes --]

On Thu, 2004-01-29 at 05:34, Fritz Mesedilla wrote:
> I forgot to ask.
> I am putting this before the rest of my rules, right? Will this allow legit transaction to get through?
> 
Yes, the rules to redirect to the syn-flood chain must be the first
rules of each chain.
> Thanks.
> 
> 
> Cheers,
> 
> fritz <www.mesedilla.com>
> ---
> + Basta Ikaw Lord
> 
> 
> 
> 
> -----Original Message-----
> From: Ray Leach [mailto:raymondl@knowledgefactory.co.za]
> Sent: Wednesday, January 28, 2004 4:14 PM
> To: Netfilter Mailing List (E-mail)
> Subject: Re: anti-dos
> 
> 
> On Wed, 2004-01-28 at 09:18, Fritz Mesedilla wrote:
> > in preparation to sco's feb 1. dos attack, is there any special iptables rules that i can use to avoid dos attacks?
> > all i have right now is i blocked all ports then opened the mail and internet.
> > 
> > what else can i do for rules?
> > 
> You can use the limit support to limit packet rates:
> 
> ### syn-flood chain
> $IPTABLES -N syn-flood
> $IPTABLES -A syn-flood -i $IFACE_INET -m limit --limit 75/s
> --limit-burst 100 -j RETURN
> $IPTABLES -A syn-flood -i $IFACE_DMZ -m limit --limit 75/s --limit-burst
> 100 -j RETURN
> $IPTABLES -A syn-flood -i $IFACE_INT -j RETURN
> $IPTABLES -A syn-flood -j LOG --log-prefix "SYN-FLOOD: "
> $IPTABLES -A syn-flood -j DROP
> 
> $IPTABLES -A INPUT -i $IFACE_INT -p tcp --syn -j syn-flood
> $IPTABLES -A INPUT -i $IFACE_DMZ -p tcp --syn -j syn-flood
> $IPTABLES -A INPUT -i $IFACE_INET -p tcp --syn -j syn-flood
> 
> 
> > thanks.
> > 
> > 
> > Cheers,
> > 
> > fritz <www.mesedilla.com>
> > ---
> > + Basta Ikaw Lord
> > 
> > 
> > 
> > 
> > ----------------------------------------------------------------------
> > This email and any files transmitted with it are confidential and
> > intended solely for the use of the individual or entity to whom they
> > are addressed. If you have received this email in error please notify
> > the sender immediately by e-mail and delete this e-mail from your
> > system. Please note that any views or opinions presented in this
> > email are solely those of the author and do not necessarily represent
> > those of the company. Finally, the recipient should check this email
> > and any attachments for the presence of viruses. The company accepts
> > no liability for any damage caused by any virus transmitted by this
> > email. 
> > 
> > Overture Media, Inc.
> > Direct Line: (632) 635-4785
> > Trunkline:   (632) 631-8971 Local 146
> > Fax: (632) 637-2206
> > Level 1 Summit Media Offices, Robinsons Galleria EDSA Cor. Ortigas Ave., Quezon City 1100
-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

RE: anti-dos

[Fritz Mesedilla]

Ray,
Thank you for the rules.
I'll be testing it out now.

Thanks again.

Cheers,

fritz <www.mesedilla.com>
---
+ Basta Ikaw Lord




-----Original Message-----
From: Ray Leach [mailto:raymondl@knowledgefactory.co.za]
Sent: Wednesday, January 28, 2004 4:14 PM
To: Netfilter Mailing List (E-mail)
Subject: Re: anti-dos


On Wed, 2004-01-28 at 09:18, Fritz Mesedilla wrote:
> in preparation to sco's feb 1. dos attack, is there any special iptables rules that i can use to avoid dos attacks?
> all i have right now is i blocked all ports then opened the mail and internet.
> 
> what else can i do for rules?
> 
You can use the limit support to limit packet rates:

### syn-flood chain
$IPTABLES -N syn-flood
$IPTABLES -A syn-flood -i $IFACE_INET -m limit --limit 75/s
--limit-burst 100 -j RETURN
$IPTABLES -A syn-flood -i $IFACE_DMZ -m limit --limit 75/s --limit-burst
100 -j RETURN
$IPTABLES -A syn-flood -i $IFACE_INT -j RETURN
$IPTABLES -A syn-flood -j LOG --log-prefix "SYN-FLOOD: "
$IPTABLES -A syn-flood -j DROP

$IPTABLES -A INPUT -i $IFACE_INT -p tcp --syn -j syn-flood
$IPTABLES -A INPUT -i $IFACE_DMZ -p tcp --syn -j syn-flood
$IPTABLES -A INPUT -i $IFACE_INET -p tcp --syn -j syn-flood


> thanks.
> 
> 
> Cheers,
> 
> fritz <www.mesedilla.com>
> ---
> + Basta Ikaw Lord
> 
> 
> 
> 
> ----------------------------------------------------------------------
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the sender immediately by e-mail and delete this e-mail from your
> system. Please note that any views or opinions presented in this
> email are solely those of the author and do not necessarily represent
> those of the company. Finally, the recipient should check this email
> and any attachments for the presence of viruses. The company accepts
> no liability for any damage caused by any virus transmitted by this
> email. 
> 
> Overture Media, Inc.
> Direct Line: (632) 635-4785
> Trunkline:   (632) 631-8971 Local 146
> Fax: (632) 637-2206
> Level 1 Summit Media Offices, Robinsons Galleria EDSA Cor. Ortigas Ave., Quezon City 1100
-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

----------------------------------------------------------------------
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender immediately by e-mail and delete this e-mail from your
system. Please note that any views or opinions presented in this
email are solely those of the author and do not necessarily represent
those of the company. Finally, the recipient should check this email
and any attachments for the presence of viruses. The company accepts
no liability for any damage caused by any virus transmitted by this
email. 

Overture Media, Inc.
Direct Line: (632) 635-4785
Trunkline:   (632) 631-8971 Local 146
Fax: (632) 637-2206
Level 1 Summit Media Offices, Robinsons Galleria EDSA Cor. Ortigas Ave., Quezon City 1100

anti-dos

[Fritz Mesedilla]

in preparation to sco's feb 1. dos attack, is there any special iptables rules that i can use to avoid dos attacks?
all i have right now is i blocked all ports then opened the mail and internet.

what else can i do for rules?

thanks.


Cheers,

fritz <www.mesedilla.com>
---
+ Basta Ikaw Lord




----------------------------------------------------------------------
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender immediately by e-mail and delete this e-mail from your
system. Please note that any views or opinions presented in this
email are solely those of the author and do not necessarily represent
those of the company. Finally, the recipient should check this email
and any attachments for the presence of viruses. The company accepts
no liability for any damage caused by any virus transmitted by this
email. 

Overture Media, Inc.
Direct Line: (632) 635-4785
Trunkline:   (632) 631-8971 Local 146
Fax: (632) 637-2206
Level 1 Summit Media Offices, Robinsons Galleria EDSA Cor. Ortigas Ave., Quezon City 1100

Re: anti-dos

[Ray Leach]

[-- Attachment #1: Type: text/plain, Size: 2208 bytes --]

On Wed, 2004-01-28 at 09:18, Fritz Mesedilla wrote:
> in preparation to sco's feb 1. dos attack, is there any special iptables rules that i can use to avoid dos attacks?
> all i have right now is i blocked all ports then opened the mail and internet.
> 
> what else can i do for rules?
> 
You can use the limit support to limit packet rates:

### syn-flood chain
$IPTABLES -N syn-flood
$IPTABLES -A syn-flood -i $IFACE_INET -m limit --limit 75/s
--limit-burst 100 -j RETURN
$IPTABLES -A syn-flood -i $IFACE_DMZ -m limit --limit 75/s --limit-burst
100 -j RETURN
$IPTABLES -A syn-flood -i $IFACE_INT -j RETURN
$IPTABLES -A syn-flood -j LOG --log-prefix "SYN-FLOOD: "
$IPTABLES -A syn-flood -j DROP

$IPTABLES -A INPUT -i $IFACE_INT -p tcp --syn -j syn-flood
$IPTABLES -A INPUT -i $IFACE_DMZ -p tcp --syn -j syn-flood
$IPTABLES -A INPUT -i $IFACE_INET -p tcp --syn -j syn-flood


> thanks.
> 
> 
> Cheers,
> 
> fritz <www.mesedilla.com>
> ---
> + Basta Ikaw Lord
> 
> 
> 
> 
> ----------------------------------------------------------------------
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the sender immediately by e-mail and delete this e-mail from your
> system. Please note that any views or opinions presented in this
> email are solely those of the author and do not necessarily represent
> those of the company. Finally, the recipient should check this email
> and any attachments for the presence of viruses. The company accepts
> no liability for any damage caused by any virus transmitted by this
> email. 
> 
> Overture Media, Inc.
> Direct Line: (632) 635-4785
> Trunkline:   (632) 631-8971 Local 146
> Fax: (632) 637-2206
> Level 1 Summit Media Offices, Robinsons Galleria EDSA Cor. Ortigas Ave., Quezon City 1100
-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: anti-dos

[Axel Heinrici]

Hi

On Wednesday 28 January 2004 09:14, Ray Leach wrote:
>
> You can use the limit support to limit packet rates:
>
> ### syn-flood chain
> $IPTABLES -N syn-flood
> $IPTABLES -A syn-flood -i $IFACE_INET -m limit --limit 75/s
> --limit-burst 100 -j RETURN
> $IPTABLES -A syn-flood -i $IFACE_DMZ -m limit --limit 75/s
> --limit-burst 100 -j RETURN
> $IPTABLES -A syn-flood -i $IFACE_INT -j RETURN
> $IPTABLES -A syn-flood -j LOG --log-prefix "SYN-FLOOD: "
> $IPTABLES -A syn-flood -j DROP
>
> $IPTABLES -A INPUT -i $IFACE_INT -p tcp --syn -j syn-flood
> $IPTABLES -A INPUT -i $IFACE_DMZ -p tcp --syn -j syn-flood
> $IPTABLES -A INPUT -i $IFACE_INET -p tcp --syn -j syn-flood
>
I have a questions on this. As I interpret the rules any packet with is 
not catched by the two limit-rules is targeted to LOG. 
Due to the huge number of possible SYN-Packets in a dos-attack this does 
not seem useful to me. Shouldn't there be a "-m --limit 
10/minute" in the log-rule?

with kind regards
	Axel

Re: anti-dos

[Ray Leach]

[-- Attachment #1: Type: text/plain, Size: 1612 bytes --]

On Wed, 2004-01-28 at 12:08, Axel Heinrici wrote:
> Hi
> 
> On Wednesday 28 January 2004 09:14, Ray Leach wrote:
> >
> > You can use the limit support to limit packet rates:
> >
> > ### syn-flood chain
> > $IPTABLES -N syn-flood
> > $IPTABLES -A syn-flood -i $IFACE_INET -m limit --limit 75/s
> > --limit-burst 100 -j RETURN
> > $IPTABLES -A syn-flood -i $IFACE_DMZ -m limit --limit 75/s
> > --limit-burst 100 -j RETURN
> > $IPTABLES -A syn-flood -i $IFACE_INT -j RETURN
> > $IPTABLES -A syn-flood -j LOG --log-prefix "SYN-FLOOD: "
> > $IPTABLES -A syn-flood -j DROP
> >
> > $IPTABLES -A INPUT -i $IFACE_INT -p tcp --syn -j syn-flood
> > $IPTABLES -A INPUT -i $IFACE_DMZ -p tcp --syn -j syn-flood
> > $IPTABLES -A INPUT -i $IFACE_INET -p tcp --syn -j syn-flood
> >
> I have a questions on this. As I interpret the rules any packet with is 
> not catched by the two limit-rules is targeted to LOG. 
> Due to the huge number of possible SYN-Packets in a dos-attack this does 
> not seem useful to me. Shouldn't there be a "-m --limit 
> 10/minute" in the log-rule?
The LOG rule is so I can trace where the DOS came from. The limit of
75/s is assuming that our 512K line is capable of receiving that many
packets per second (if it isn't, then we better start looking for new
hardware).


> 
> with kind regards
> 	Axel
-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: anti-dos

[Nilesh]

Sir,
 
Will you help on this i have installed Iptables
firewall on my mail server with two eth cards eth0
for internet and eth1 for lan 
how can i protect from the attacks on 1st feb 
please help me can i use same rules  if yes 
$IFACE_INET --????
$IFACE_DMZ ---???
can u tell me about this 

waiting for reply 

--- Ray Leach <raymondl@knowledgefactory.co.za> wrote:
> On Wed, 2004-01-28 at 12:08, Axel Heinrici wrote:
> > Hi
> > 
> > On Wednesday 28 January 2004 09:14, Ray Leach
> wrote:
> > >
> > > You can use the limit support to limit packet
> rates:
> > >
> > > ### syn-flood chain
> > > $IPTABLES -N syn-flood
> > > $IPTABLES -A syn-flood -i $IFACE_INET -m limit
> --limit 75/s
> > > --limit-burst 100 -j RETURN
> > > $IPTABLES -A syn-flood -i $IFACE_DMZ -m limit
> --limit 75/s
> > > --limit-burst 100 -j RETURN
> > > $IPTABLES -A syn-flood -i $IFACE_INT -j RETURN
> > > $IPTABLES -A syn-flood -j LOG --log-prefix
> "SYN-FLOOD: "
> > > $IPTABLES -A syn-flood -j DROP
> > >
> > > $IPTABLES -A INPUT -i $IFACE_INT -p tcp --syn -j
> syn-flood
> > > $IPTABLES -A INPUT -i $IFACE_DMZ -p tcp --syn -j
> syn-flood
> > > $IPTABLES -A INPUT -i $IFACE_INET -p tcp --syn
> -j syn-flood
> > >
> > I have a questions on this. As I interpret the
> rules any packet with is 
> > not catched by the two limit-rules is targeted to
> LOG. 
> > Due to the huge number of possible SYN-Packets in
> a dos-attack this does 
> > not seem useful to me. Shouldn't there be a "-m
> --limit 
> > 10/minute" in the log-rule?
> The LOG rule is so I can trace where the DOS came
> from. The limit of
> 75/s is assuming that our 512K line is capable of
> receiving that many
> packets per second (if it isn't, then we better
> start looking for new
> hardware).
> 
> 
> > 
> > with kind regards
> > 	Axel
> -- 
> --
> Raymond Leach <raymondl@knowledgefactory.co.za>
> Network Support Specialist
> http://www.knowledgefactory.co.za
> "lynx -source http://www.rchq.co.za/raymondl.asc |
> gpg --import"
> Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE
> 8757 EE47 F06F FB28
> --
> 

> ATTACHMENT part 2 application/pgp-signature
name=signature.asc



__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free web site building tool. Try it!
http://webhosting.yahoo.com/ps/sb/

RE: anti-dos

[Rob Sterenborg]

> Will you help on this i have installed Iptables
> firewall on my mail server with two eth cards eth0
> for internet and eth1 for lan 
> how can i protect from the attacks on 1st feb 
> please help me can i use same rules  if yes 
> $IFACE_INET --????
> $IFACE_DMZ ---???
> can u tell me about this 

The attacks come from MS workstations that are infected by the virus, not
from servers - if all is well.
Assuming for the virus to succesfully start the attack, it has to have
direct access (like NAT) to the internet (thus assuming that these viruses
are not able to find out IE's proxy settings and use it..)

So, do you use a proxy server or NAT for your clients to access the internet
?

If my assumption above is true (I think it is, please correct me if I'm
wrong) and your clients can only use the proxy server then you don't need
any rules as the virus can't reach the internet directly anyway. The attack
will then stop at your default gateway.


Gr,
Rob