RE: SMB auth and Iptables...

RE: SMB auth and Iptables...

[Steve Wakelin]

[-- Attachment #1: Type: text/plain, Size: 1026 bytes --]

Squid with NTLM authentication will provide this functionality

 

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Gustavo Castro
Puig
Sent: 29 July 2004 21:51
To: netfilter@lists.netfilter.org
Subject: SMB auth and Iptables...

 

Hi, guys:

 

    One customer asked me about the possibility of install in an
iptables based firewall some sort of solution (perhaps a proxy) it could
add/delete rules based on users login into a SMB(Samba/NT) server. He
want to grant or deny access to Internet (TCP/IP) based on authenticated
users, not the IP or MAC. It's not a bad idea, but I don't know if it
even exists... I've googled and found nothing about this kind of
solution. Anyway, I told him I could check it out, and... here I am. :-)

    Do you have any idea about a solution like this using iptables and
"something" else? 

    Any info will be highly appreciated.

    Thanks!

 

Cheers,

    Gustavo.


[-- Attachment #2: Type: text/html, Size: 4339 bytes --]

block port 137

[david]

[-- Attachment #1: Type: text/plain, Size: 412 bytes --]

Dear all,
How to block outgoing traffic over network that using port 137 udp, because my isp tell me that my network broadcast virus using port 137 udp, i want to make all traffic (port 137) do go outside my network, so i plan to blocking that traffic from my gateway.

I already try to do this rules, but not working :
#iptables -A FORWARD -p udp -s 0/0 --dport 137 -j DROP




Regards,
David Kandou

[-- Attachment #2: Type: text/html, Size: 1962 bytes --]

Re: block port 137

[Dhananjoy Chowdhury]

try dropping packets both with dport 137 and also with sport 137.



On Tue, 2004-08-03 at 10:37, david wrote:
> Dear all,
> How to block outgoing traffic over network that using port 137 udp,
> because my isp tell me that my network broadcast virus using port 137
> udp, i want to make all traffic (port 137) do go outside my network,
> so i plan to blocking that traffic from my gateway.
>  
> I already try to do this rules, but not working :
> #iptables -A FORWARD -p udp -s 0/0 --dport 137 -j DROP
>  
>  
>  
>  
> Regards,
> David Kandou

Re: block port 137

[Antony Stone]

On Tuesday 03 August 2004 6:07 am, david wrote:

> Dear all,
> How to block outgoing traffic over network that using port 137 udp

iptables -I FORWARD -p udp --dport 137 -j DROP

>, because my isp tell me that my network broadcast virus using port 137 udp,
> i want to make all traffic (port 137) do go outside my network, so i plan to
> blocking that traffic from my gateway.
>
> I already try to do this rules, but not working :
> #iptables -A FORWARD -p udp -s 0/0 --dport 137 -j DROP

1. Why are you allowing UDP 137 packets through your firewall anyway?   They 
must be matching *some* rule on your machine in order to get through at all - 
of course it could be a default ACCEPT policy rule (if it is then you should 
certainly change that).

2. The rule you have suggested uses "-A" to append to the end of the ruleset - 
what are the other rules which come before it?   Presumably one of those must 
be allowing the packets through...

Show us your ruleset, tell us how you're testing.

Regards,

Antony.

-- 
"I estimate there's a world market for about five computers."

 - Thomas J Watson, Chairman of IBM

                                                     Please reply to the list;
                                                           please don't CC me.

Re: block port 137

[Antony Stone]

On Tuesday 03 August 2004 7:04 am, Dhananjoy Chowdhury wrote:

> try dropping packets both with dport 137 and also with sport 137.

I disagree.

Try ACCEPTing the packets you *want* to go through the firewall, and DROP 
everything else.

Don't create individual rules to DROP the traffic you think you don't want 
(you will always forget something, or there will be a new problem next week 
which requires a new rule, etc).

Instead create individual rules to ACCEPT the traffic you need, and DROP 
anything which doesn't fit that description.

Regards,

Antony.

> On Tue, 2004-08-03 at 10:37, david wrote:
> > Dear all,
> > How to block outgoing traffic over network that using port 137 udp,
> > because my isp tell me that my network broadcast virus using port 137
> > udp, i want to make all traffic (port 137) do go outside my network,
> > so i plan to blocking that traffic from my gateway.
> >
> > I already try to do this rules, but not working :
> > #iptables -A FORWARD -p udp -s 0/0 --dport 137 -j DROP
> >
> >
> >
> >
> > Regards,
> > David Kandou

-- 
If builders made buildings the way programmers write programs, then the first 
woodpecker to come along would destroy civilisation.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: block port 137

[Dhananjoy Chowdhury]

On Tue, 2004-08-03 at 11:47, Antony Stone wrote:
> On Tuesday 03 August 2004 7:04 am, Dhananjoy Chowdhury wrote:
> 
> > try dropping packets both with dport 137 and also with sport 137.
> 
> I disagree.
> 
> Try ACCEPTing the packets you *want* to go through the firewall, and DROP 
> everything else.
> 
> Don't create individual rules to DROP the traffic you think you don't want 
> (you will always forget something, or there will be a new problem next week 
> which requires a new rule, etc).
> 
> Instead create individual rules to ACCEPT the traffic you need, and DROP 
> anything which doesn't fit that description.
> 
> Regards,
> 
> Antony.

Your terminology is very much true but David has already applied  the
rule
#iptables -A FORWARD -p udp -s 0/0 --dport 137 -j DROP
but then also he isn't able to stop output traffic through port 137.
So in this scenario he should appply the above rule for both --sport 
and --dport.
#iptables -I FORWARD -p udp -s 0/0 --dport 137 -j DROP
#iptables -I FORWARD -p udp -s 0/0 --sport 137 -j DROP

Regards,
Dhananjoy




> 
> > On Tue, 2004-08-03 at 10:37, david wrote:
> > > Dear all,
> > > How to block outgoing traffic over network that using port 137 udp,
> > > because my isp tell me that my network broadcast virus using port 137
> > > udp, i want to make all traffic (port 137) do go outside my network,
> > > so i plan to blocking that traffic from my gateway.
> > >
> > > I already try to do this rules, but not working :
> > > #iptables -A FORWARD -p udp -s 0/0 --dport 137 -j DROP
> > >
> > >
> > >
> > >
> > > Regards,
> > > David Kandou

Re: block port 137

[Antony Stone]

On Tuesday 03 August 2004 8:33 am, Dhananjoy Chowdhury wrote:

> On Tue, 2004-08-03 at 11:47, Antony Stone wrote:
> >
> > I disagree.
> >
> > Try ACCEPTing the packets you *want* to go through the firewall, and DROP
> > everything else.
>
> Your terminology is very much true but David has already applied  the
> rule
> #iptables -A FORWARD -p udp -s 0/0 --dport 137 -j DROP

That is not the same rule as "iptables -I FORWARD......"

I suspect he has a rule somewhere in the ruleset which is allowing the packets 
(perhaps based on source address?), which adding a rule at the end will not 
solve.   Putting the DROP rule at the top of the ruleset makes a big 
difference.

If the problem is packets to random destination ports, *from* UDP port 137, 
then it doesn't sound like what the ISP originally complained about, and 
what's the threat anyway (since destination port is what matters in terms of 
vulnerabilities and exploits)?

Regards,

Antony.

-- 
If the human brain were so simple that we could understand it,
we'd be so simple that we couldn't.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: block port 137

[Frank Gruellich]

* Dhananjoy Chowdhury <dhananjoy@nucleussoftware.com>  3. Aug 04:
> On Tue, 2004-08-03 at 11:47, Antony Stone wrote:
> > On Tuesday 03 August 2004 7:04 am, Dhananjoy Chowdhury wrote:
> > > try dropping packets both with dport 137 and also with sport 137.
> > I disagree.

Me too.

> Your terminology is very much true but David has already applied  the
> rule
> #iptables -A FORWARD -p udp -s 0/0 --dport 137 -j DROP
> but then also he isn't able to stop output traffic through port 137.
> So in this scenario he should appply the above rule for both --sport 
> and --dport.
> #iptables -I FORWARD -p udp -s 0/0 --dport 137 -j DROP
> #iptables -I FORWARD -p udp -s 0/0 --sport 137 -j DROP

Well, from my point of view he should add to these rules:
# iptables -P FORWARD DROP
# iptables -F FORWARD

Then he should fix his network by imaging compromised hosts for further
analysis, flatting them and installing them from trusted sources.  Later
he should look for an appropriate L.A.R.T. for the users of the machines
and maybe go online again.

YMMV,
 regards, Frank.
-- 
Sigmentation fault

Re: block port 137

[Zoup]

On Monday 02 August 2004 21:07, david Wrote:
> Dear all,
> How to block outgoing traffic over network that using port 137 udp, because
> my isp tell me that my network broadcast virus using port 137 udp, i want
> to make all traffic (port 137) do go outside my network, so i plan to
> blocking that traffic from my gateway.
>
> I already try to do this rules, but not working :
> #iptables -A FORWARD -p udp -s 0/0 --dport 137 -j DROP
>
>
>
>
> Regards,
> David Kandou


you also have to use 
iptables -A FORWARD -p udp --sport 137 -j DROP 

-- 
The cost of living hasn't affected its popularity.

Re: block port 137

[david]

Dear Antony,
I agree with you, i must block all traffic and accept one-by-one rules that
i want, but the problem is i don't know how to do this ...., btw.. this in
my rules

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 202.46.146.161
iptables -t nat -A PREROUTING -p tcp -i eth0 -d 202.46.146.164 --dport
110 -j DNAT --to 172.16.128.50
iptables -t nat -A PREROUTING -p tcp -i eth0 -d 202.46.146.164 --dport 25 -j
DNAT --to 172.16.128.50
iptables -t nat -A PREROUTING -p tcp -i eth0 -d 202.46.146.165 --dport 25 -j
DNAT --to 172.16.128.125
iptables -t nat -A PREROUTING -p tcp -i eth0 -d 202.46.146.165 --dport
110 -j DNAT --to 172.16.128.125
iptables -t nat -A PREROUTING -p tcp -i eth0 -d 202.46.146.166 --dport 80 -j
DNAT --to 172.16.131.6
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i eth0 -d 202.46.146.167 --dport 21 -j
DNAT --to 172.16.128.79bie
iptables -t nat -A PREROUTING -p tcp -i eth0 -d 202.46.146.168 --dport 21 -j
DNAT --to 172.16.131.29

iptables -A FORWARD -p udp -s 0/0 --dport 137 -j DROP

I know this rules is very weak.... can you help me to make my firewall
strongger......

Thank's a lot

David Kandou
Newbie

----- Original Message ----- 
From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
To: <netfilter@lists.netfilter.org>
Sent: Tuesday, August 03, 2004 1:17 PM
Subject: Re: block port 137


> On Tuesday 03 August 2004 7:04 am, Dhananjoy Chowdhury wrote:
>
> > try dropping packets both with dport 137 and also with sport 137.
>
> I disagree.
>
> Try ACCEPTing the packets you *want* to go through the firewall, and DROP
> everything else.
>
> Don't create individual rules to DROP the traffic you think you don't want
> (you will always forget something, or there will be a new problem next
week
> which requires a new rule, etc).
>
> Instead create individual rules to ACCEPT the traffic you need, and DROP
> anything which doesn't fit that description.
>
> Regards,
>
> Antony.
>
> > On Tue, 2004-08-03 at 10:37, david wrote:
> > > Dear all,
> > > How to block outgoing traffic over network that using port 137 udp,
> > > because my isp tell me that my network broadcast virus using port 137
> > > udp, i want to make all traffic (port 137) do go outside my network,
> > > so i plan to blocking that traffic from my gateway.
> > >
> > > I already try to do this rules, but not working :
> > > #iptables -A FORWARD -p udp -s 0/0 --dport 137 -j DROP
> > >
> > >
> > >
> > >
> > > Regards,
> > > David Kandou
>
> -- 
> If builders made buildings the way programmers write programs, then the
first
> woodpecker to come along would destroy civilisation.
>
>                                                      Please reply to the
list;
>                                                            please don't CC
me.
>
>
>

Re: block port 137

[Antony Stone]

On Wednesday 04 August 2004 4:00 am, david wrote:

> Dear Antony,
> I agree with you, i must block all traffic and accept one-by-one rules that
> i want, but the problem is i don't know how to do this

1. Here's the basic idea:

iptables -P FORWARD DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $INTIF -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i $INTIF -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -i $INTIF -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -j LOG

These rules mean "DROP any packets which I don't have a rule to ACCEPT, then 
ACCEPT all packets except the first of any connection, then ACCEPT the first 
packets for web browsing and DNS, then LOG any other packets which try to get 
through."

2. The important part of the above ruleset, for someone like you who is not 
quite sure what rules to use to ACCEPT the packets you want (and you don't 
want to default DROP any packets by omission), is the final LOG rule.

That rule will tell you what packets are trying to get through the ruleset, 
but haven't been ACCEPTed by one of the previous rules - and you may want to 
add a rule to specifically ACCEPT some of them.   Of course, you may *not* 
want to accept some of them either, so you're happy for those to continue 
being DROPped.   In that case (packets you know that you don't want), the 
next refinement of the ruleset is:

3. Add some specific DROP rules just before the final LOG rule, so that the 
packets you know about and do not want get DROPped without being logged.

The final outcome of this is a ruleset which:
a) ACCEPTs the packets you know you want
b) DROPs the packets you know you don't want
c) LOGs any other packets you haven't thought about or weren't expecting

As you can see, you can build such a ruleset gradually - if you don't want to 
disrupt communications through the firewall as you do it, just leave the 
default policy on ACCEPT as you add the specific ACCEPT rules, and then once 
you have no more wanted packets being DROPped, you can set the policy to DROP 
and concentrate on cutting down what gets LOGged.

I do recommend studying one of the netfilter tutorials such as Oskar 
Andreasson's at http://iptables-tutorial.frozentux.net so that you get a 
better understanding of how packets make their way through netfilter, and 
also what packets are necessary for correct and efficient operation of a 
network (some of them may be non-obvious, such as TCP DNS in my mini-ruleset 
above, or certain types of ICMP packets etc).

Regards,

Antony.

-- 
Anyone that's normal doesn't really achieve much.

 - Mark Blair, Australian rocket engineer

                                                     Please reply to the list;
                                                           please don't CC me.

Re: block port 137

[Frank Gruellich]

Hello,

please don't toppost[1].

* david <david@suarapembaruan.co.id>  4. Aug 04:
> Dear Antony,

I'm not Antony.

> I agree with you, i must block all traffic and accept one-by-one rules that
> i want, but the problem is i don't know how to do this ....,

Okay, then do so.  Take a piece of paper, sketch you topology with every
network and add special hosts, like the mailserver at 172.16.128.50.
Then ask yourself: what should go from the internet to your subnet and
reverse.

This is you starting point (I sort it a bit, and please don't wrap
commands):

> iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 202.46.146.161
> iptables -t nat -A PREROUTING -p tcp -i eth0 -d 202.46.146.164 --dport 25  -j DNAT --to 172.16.128.50
> iptables -t nat -A PREROUTING -p tcp -i eth0 -d 202.46.146.164 --dport 110 -j DNAT --to 172.16.128.50
> iptables -t nat -A PREROUTING -p tcp -i eth0 -d 202.46.146.165 --dport 25  -j DNAT --to 172.16.128.125
> iptables -t nat -A PREROUTING -p tcp -i eth0 -d 202.46.146.165 --dport 110 -j DNAT --to 172.16.128.125
> iptables -t nat -A PREROUTING -p tcp -i eth0 -d 202.46.146.166 --dport 80  -j DNAT --to 172.16.131.6
> iptables -t nat -A PREROUTING -p tcp -i eth0 -d 202.46.146.167 --dport 21  -j DNAT --to 172.16.128.79bie
> iptables -t nat -A PREROUTING -p tcp -i eth0 -d 202.46.146.168 --dport 21  -j DNAT --to 172.16.131.29
> 
> iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
> iptables -A FORWARD -p udp -s 0/0 --dport 137 -j DROP

# Set you default policy in FORWARD to DROP and flush it:
iptables -P FORWARD DROP
iptables -F FORWARD
# No allow everything you expect to pass you paketfilter.  I think you
# expect to pass all following pakets of an ACCEPTed stream:
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
# Now add everyting you need.  I can see, that you need mail-stuff vom
# outside to inside:
for $ip in 172.16.128.50 172.16.128.125
do for $port in 25 110
   do iptables -A FORWARD -i eth0 -p tcp -d $ip --sport 1024:65535 --dport $port -m state --state NEW -j ACCEPT
      iptables -A FORWARD -i eth0 -p tcp -d $ip --sport 1024:65535 --dport $port -m state --state NEW -j ACCEPT
   done
done
# same for http on .131.6 and ftp on .128.79 and .131.29
iptables -A FORWARD -i eth0 -p tcp -d 172.16.131.6  --sport 1024:65535 --dport 80 -m state --state NEW -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp -d 172.16.128.79 --sport 1024:65535 --dport 21 -m state --state NEW -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp -d 172.16.131.29 --sport 1024:65535 --dport 21 -m state --state NEW -j ACCEPT
# That's everything of your incomming traffic.  I can guess something
# about you outgoing:
iptables -A FORWARD -o eth0 -p tcp  --sport 1024:65535 --dport 21 -m state --state NEW -j ACCEPT
iptables -A FORWARD -o eth0 -p tcp  --sport 1024:65535 --dport 53 -m state --state NEW -j ACCEPT
iptables -A FORWARD -o eth0 -p udp  --sport 1024:65535 --dport 53 -m state --state NEW -j ACCEPT
iptables -A FORWARD -o eth0 -p tcp  --sport 1024:65535 --dport 80 -m state --state NEW -j ACCEPT
iptables -A FORWARD -o eth0 -p icmp -j ACCEPT
# This should satisfy you users: surfing and downloading.  I think, you
# mailservers are responsible for mails from users.  But they have to
# deliver the mails:
iptables -A FORWARD -i eth1 -p tcp -s 172.16.128.50  --sport 1024:65535 --dport 25 -m state --state NEW -j ACCEPT
iptables -A FORWARD -i eth1 -p tcp -s 172.16.128.125 --sport 1024:65535 --dport 25 -m state --state NEW -j ACCEPT
# Did you forgot something?  I don't know, you don't know, so let's log
# everything you may have forgot:
iptables -A FORWARD -j LOG --logprefix='FORWARD (unknown): '
# Check you logfiles and decide if you want to allow the logged traffic.
# Now be a good guy and make you machine rfc-compliant
iptables -A FORWARD -p tcp -j REJECT --reject-with tcp-reset
iptables -A FORWARD -p udp -j REJECT --reject-with icmp-host-prohibited

This would be my basic layout.  You should tweak it as needed.  Some
further tips:  RTFM <URL:http://iptables-tutorial.frozentux.net/>; use
userdefined chains (eg. you could split your FORWARD into an incomming
and an outgoing chain); use -j LOG and tail -f $logfile to determine
unknown traffic; tcpdumps are usefull too.

HTH,
 regards, Frank.
-- 
Sigmentation fault

Re: block port 137

[david]

Thank's a lot.

Rgds,
David
----- Original Message ----- 
From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
To: <netfilter@lists.netfilter.org>
Sent: Wednesday, August 04, 2004 2:03 PM
Subject: Re: block port 137


> On Wednesday 04 August 2004 4:00 am, david wrote:
>
> > Dear Antony,
> > I agree with you, i must block all traffic and accept one-by-one rules
that
> > i want, but the problem is i don't know how to do this
>
> 1. Here's the basic idea:
>
> iptables -P FORWARD DROP
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A FORWARD -i $INTIF -p tcp --dport 80 -j ACCEPT
> iptables -A FORWARD -i $INTIF -p udp --dport 53 -j ACCEPT
> iptables -A FORWARD -i $INTIF -p tcp --dport 53 -j ACCEPT
> iptables -A FORWARD -j LOG
>
> These rules mean "DROP any packets which I don't have a rule to ACCEPT,
then
> ACCEPT all packets except the first of any connection, then ACCEPT the
first
> packets for web browsing and DNS, then LOG any other packets which try to
get
> through."
>
> 2. The important part of the above ruleset, for someone like you who is
not
> quite sure what rules to use to ACCEPT the packets you want (and you don't
> want to default DROP any packets by omission), is the final LOG rule.
>
> That rule will tell you what packets are trying to get through the
ruleset,
> but haven't been ACCEPTed by one of the previous rules - and you may want
to
> add a rule to specifically ACCEPT some of them.   Of course, you may *not*
> want to accept some of them either, so you're happy for those to continue
> being DROPped.   In that case (packets you know that you don't want), the
> next refinement of the ruleset is:
>
> 3. Add some specific DROP rules just before the final LOG rule, so that
the
> packets you know about and do not want get DROPped without being logged.
>
> The final outcome of this is a ruleset which:
> a) ACCEPTs the packets you know you want
> b) DROPs the packets you know you don't want
> c) LOGs any other packets you haven't thought about or weren't expecting
>
> As you can see, you can build such a ruleset gradually - if you don't want
to
> disrupt communications through the firewall as you do it, just leave the
> default policy on ACCEPT as you add the specific ACCEPT rules, and then
once
> you have no more wanted packets being DROPped, you can set the policy to
DROP
> and concentrate on cutting down what gets LOGged.
>
> I do recommend studying one of the netfilter tutorials such as Oskar
> Andreasson's at http://iptables-tutorial.frozentux.net so that you get a
> better understanding of how packets make their way through netfilter, and
> also what packets are necessary for correct and efficient operation of a
> network (some of them may be non-obvious, such as TCP DNS in my
mini-ruleset
> above, or certain types of ICMP packets etc).
>
> Regards,
>
> Antony.
>
> -- 
> Anyone that's normal doesn't really achieve much.
>
>  - Mark Blair, Australian rocket engineer
>
>                                                      Please reply to the
list;
>                                                            please don't CC
me.
>
>
>