Problem with log which are corrupted and need help with hitcount and FORWARD rules

Problem with log which are corrupted and need help with hitcount and FORWARD rules

[Azerty Ytreza]

Hello,

I have a two littles problem with iptables :

First :
*******
My logs are corrupted. Seem to be corrupted since I have installed LXC
but not 100% sure.
But working while a moment and I doesn't have made big change in my rules.

This an exemple of my logs :
***************************************
Oct 16 09:15:52 Linux kernel: 4234990]it:I=t1OT A=05:ad:d0:02:b7:ed:80
R=8..53 S=11.3.1 E=8TS00 RC00 T=1 D52 FPOOTPST22 P=03 IDW89 E=x0SNUG=
<4>[120376.277507] iptables: IN=eth1 OUT=
MAC=00:50:da:de:3d:02:00:23:eb:78:2e:da:08:00 SRC=182.55.136.87
DST=78.15.238.214 LEN=95 TOS=0x00 PREC=0x00 TTL=116 ID=27543 PROTO=UDP
SPT=443 DPT=50135 LEN=75
Oct 16 10:47:53 Linux kernel: [125896.982195] iptables: IN= OUT=eth1
SRC=78.15.238.214 DST=91.204.81.10 LEN=40 TOS=0x00 PREC=0x00 TTL=64
ID=0 DF PROTO=TCP SPT=60875 DPT=80 WINDOW=0 RES=0x00 RST URGP=0
Oct 16 10:55:06 Linux kernel: [126269.328174] iptables: IN= OUT=eh1
SR=11.3.1 S=1248.0LN4 O=x0PE=x0TL6 D0D RT=C P=36 P=0WNO= E=x0RTUG=
=66.2LN41TS00 RC00 T=4I= FPOOUPST577DT467LN41
Oct 16 11:06:19 Linux kernel: [127003.128125] iptables: IN=eth1 OUT=
MAC=00:50:da:de:3d:02:00:23:eb:78:2e:da:08:00 SRC=193.247.250.19
DST=78.15.238.214LEN=56 O=x0PE=x0TL4 D0D RT=D P=79 P=06 E=6
Oct 16 11:06:19 Linux kernel: [127003.364436] iptables: IN=eth1 OUT=
MAC=00:50:da:de:3d:02:00:23:eb:78:2e:da:08:00 SRC=193.247.250.19
DST=78.15.238.214 LEN=56 TOS=0x00 PREC=0x00 TTL=49 ID=0 DF PROTO=UDP
SPT=17390 DPT=50368 LEN=36
Oct 16 11:06:20 Linux kernel: [127004.587493] iptables: IN=eth1 OUT=
MAC=00:50:da:de:3d:02:00:23:eb:78:2e:da:08:00 SRC=193.247.250.19
DST=78.15.238.214 LEN=56 TOS=0x00 PREC=0x00 TTL=49 ID=0 DF PROTO=UDP
SPT=17390 DPT=50368 LEN=36
***************************************

So time of time the logs is 100% correct but a lot of times the log is
totally corrupted and almost unreadable :(
Someone have and idea ?

I load these modules at startup :
***************************************
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_tables
modprobe ipt_LOG
modprobe ipt_MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
***************************************

I use Debian Squeeze x86-64 and the kernel version is 2.6.32-5-amd64.
lxc version: 0.7.2

/var/log/message (corrupted)
/var/log/kernel.log (corrupted)

Second :
***********

I use these rules by the past for limit number of connections during
some seconds and block connections if they are too many attempt.

Old rules which work very well :
***************************************
iptables -A INPUT -i eth1 -p tcp --dport 443 -m state --state NEW -m
recent --set
iptables -A INPUT -i eth1 -p tcp --dport 443 -m state --state NEW -m
recent --update --seconds 60 --hitcount 10 -j DROP
#ptables -A INPUT -i eth1 -p tcp --dport 443 -m state --state
NEW,ESTABLISHED -j ACCEPT
***************************************

I have adapted this rules for a FORWARD rules and doesn't work :
***************************************
iptables -A INPUT -i eth1 -p udp -m udp --dport 443 -m state --state
NEW -m recent --set
iptables -A INPUT -i eth1 -p udp -m udp --dport 443 -m recent --update
--seconds 60 --hitcount 10 -j DROP
iptables -A FORWARD -i eth1 -p udp -m udp --dport 443 -m state --state
NEW,ESTABLISHED -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -p udp -m udp --dport 443 -j
DNAT --to-destination 192.168.1.2:443
***************************************

Someone can explain me why these rules doesn't block request when
hitcount is reached ?
I have try other method and put "hitcount" on the FORWARD rules
directly but it's not work, I have an error from iptables which
doesn't accept "--set" on a FORWARD request. I doesn't remember error
but it's probably not the good method.

I have made a lot of research, I have found an article with LXC bug
because log are centralized and not separated by container. There is a
little patch for that but it's really that ? Because I have separate
iptables log with a comment and log from my host is corrupted too not
only logs from container :(

Thank you in advance for your help !

Best Regards,
David

Re: Problem with log which are corrupted and need help with hitcount and FORWARD rules

[Andrew Beverley]

On Sat, 2011-10-22 at 10:43 +0200, Azerty Ytreza wrote:
> I use these rules by the past for limit number of connections during
> some seconds and block connections if they are too many attempt.
> 
> Old rules which work very well :
> ***************************************
> iptables -A INPUT -i eth1 -p tcp --dport 443 -m state --state NEW -m
> recent --set
> iptables -A INPUT -i eth1 -p tcp --dport 443 -m state --state NEW -m
> recent --update --seconds 60 --hitcount 10 -j DROP
> #ptables -A INPUT -i eth1 -p tcp --dport 443 -m state --state
> NEW,ESTABLISHED -j ACCEPT
> ***************************************
> 
> I have adapted this rules for a FORWARD rules and doesn't work :

What exactly are you trying to achieve? If you're changing to a FORWARD
rule then I assume that you are trying to adapt your rules in order to
block connections destined for a remote server, rather than the local
host?

> ***************************************
> iptables -A INPUT -i eth1 -p udp -m udp --dport 443 -m state --state
> NEW -m recent --set
> iptables -A INPUT -i eth1 -p udp -m udp --dport 443 -m recent --update
> --seconds 60 --hitcount 10 -j DROP

Do you really mean UDP?

> iptables -A FORWARD -i eth1 -p udp -m udp --dport 443 -m state --state
> NEW,ESTABLISHED -j ACCEPT

You've got a mixture of INPUT and FORWARD. Is that what you want?
Remember that packets will never transverse both the INPUT and FORWARD
chains.

> iptables -t nat -A PREROUTING -i eth1 -p udp -m udp --dport 443 -j
> DNAT --to-destination 192.168.1.2:443
> ***************************************
> 
> Someone can explain me why these rules doesn't block request when
> hitcount is reached ?
> I have try other method and put "hitcount" on the FORWARD rules
> directly but it's not work, I have an error from iptables which
> doesn't accept "--set" on a FORWARD request. I doesn't remember error
> but it's probably not the good method.
> 

Re: Problem with log which are corrupted and need help with hitcount and FORWARD rules

[Andrew Beverley]

On Sat, 2011-10-22 at 16:14 +0200, Azerty Ytreza wrote:
> "What exactly are you trying to achieve? If you're changing to a FORWARD
> rule then I assume that you are trying to adapt your rules in order to
> block connections destined for a remote server, rather than the local
> host?"
> 
> I want to limit the number of connections which passtrough the host.

Okay, in which case you do want FORWARD.

> Yes, I can block that on the remote server but I prefer on the local
> if it's possible.

Do you really mean "local" (in which case you want OUTPUT) or do you
just mean on your gateway/firewall server that all the traffic passes
through?

> 
> "Do you really mean UDP?"
> 
> No, it's an error sorry. I have copy/paste other rules and adapt rules
> but forget to change udp to tcp.

Okay, so it's working now?

> "You've got a mixture of INPUT and FORWARD. Is that what you want?
> Remember that packets will never transverse both the INPUT and FORWARD
> chains."
> 
> The port 443 is blocked by default it's for that which I open and
> after redirect. If I made only a FORWARD it's open directly the port
> without INPUT rules ?

It depends where you're blocking it. What's the default FORWARD rule?
ACCEPT?

The bottom line is that you need all your rules in FORWARD *or* INPUT. A
picture paints a thousand words:

http://jengelh.medozas.de/images/nf-packet-flow.png

Or for a simpler (out of date) version:

http://www.docum.org/docum.org/kptd/

> 
> 
> Thank you for your response !

No problem, but please put your responses in-line to the original email
rather than copying and pasting to the top! Oh, and copy the list as
well.

Andy

Re: Problem with log which are corrupted and need help with hitcount and FORWARD rules

[Azerty Ytreza]

Just mean gateway/firewall server that all the traffic passes through.

No doesn't work ... The port is blocked when I try these rules (copy
of the INPUT rules) :

iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
NEW -m recent --set
iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
NEW -m recent --update --seconds 600 --hitcount 1 -j DROP
iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
NEW,ESTABLISHED -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 443 -j
DNAT --to-destination 192.168.1.2:443

If I try that, the port is always open and hitcount doesn't work :

iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
NEW -m recent --set
iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
NEW -m recent --update --seconds 600 --hitcount 1 -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 443 -j
DNAT --to-destination 192.168.1.2:443

Thank you for the picture ! It's very interesting :)

And sorry but I have never user mailing list. I don't known how it's
work exactly :(
I put in copy this time :)


Thank you for your help !

On 10/22/11, Andrew Beverley <andy@andybev.com> wrote:
> On Sat, 2011-10-22 at 16:14 +0200, Azerty Ytreza wrote:
>> "What exactly are you trying to achieve? If you're changing to a FORWARD
>> rule then I assume that you are trying to adapt your rules in order to
>> block connections destined for a remote server, rather than the local
>> host?"
>>
>> I want to limit the number of connections which passtrough the host.
>
> Okay, in which case you do want FORWARD.
>
>> Yes, I can block that on the remote server but I prefer on the local
>> if it's possible.
>
> Do you really mean "local" (in which case you want OUTPUT) or do you
> just mean on your gateway/firewall server that all the traffic passes
> through?
>
>>
>> "Do you really mean UDP?"
>>
>> No, it's an error sorry. I have copy/paste other rules and adapt rules
>> but forget to change udp to tcp.
>
> Okay, so it's working now?
>
>> "You've got a mixture of INPUT and FORWARD. Is that what you want?
>> Remember that packets will never transverse both the INPUT and FORWARD
>> chains."
>>
>> The port 443 is blocked by default it's for that which I open and
>> after redirect. If I made only a FORWARD it's open directly the port
>> without INPUT rules ?
>
> It depends where you're blocking it. What's the default FORWARD rule?
> ACCEPT?
>
> The bottom line is that you need all your rules in FORWARD *or* INPUT. A
> picture paints a thousand words:
>
> http://jengelh.medozas.de/images/nf-packet-flow.png
>
> Or for a simpler (out of date) version:
>
> http://www.docum.org/docum.org/kptd/
>
>>
>>
>> Thank you for your response !
>
> No problem, but please put your responses in-line to the original email
> rather than copying and pasting to the top! Oh, and copy the list as
> well.
>
> Andy
>
>
>

Re: Problem with log which are corrupted and need help with hitcount and FORWARD rules

[Andrew Beverley]

On Sat, 2011-10-22 at 17:11 +0200, Azerty Ytreza wrote:
> Just mean gateway/firewall server that all the traffic passes through.
> 
> No doesn't work ... The port is blocked when I try these rules (copy
> of the INPUT rules) :
> 
> iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
> NEW -m recent --set
> iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
> NEW -m recent --update --seconds 600 --hitcount 1 -j DROP

You've got a hitcount of 1. Don't you mean 10 as you had in your first
set of rules?

> And sorry but I have never user mailing list. I don't known how it's
> work exactly :(

No problem, but please don't put your reply at the top. Put it either
within or at the bottom of the quoted email, just like I have for this
email. It makes it easier for other people to follow the conversation if
they've joined late or are reading it in the archives :)

Andy

Re: Problem with log which are corrupted and need help with hitcount and FORWARD rules

[Azerty Ytreza]

**********************************************************************************************
> Just mean gateway/firewall server that all the traffic passes through.
>
> No doesn't work ... The port is blocked when I try these rules (copy
> of the INPUT rules) :
>
> iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
> NEW -m recent --set
> iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
> NEW -m recent --update --seconds 600 --hitcount 1 -j DROP

You've got a hitcount of 1. Don't you mean 10 as you had in your first
set of rules?

> And sorry but I have never user mailing list. I don't known how it's
> work exactly :(

No problem, but please don't put your reply at the top. Put it either
within or at the bottom of the quoted email, just like I have for this
email. It makes it easier for other people to follow the conversation if
they've joined late or are reading it in the archives :)
**********************************************************************************************

Yes it's for test. The first time should work, the second request
should be blocked for 600sec.
But never block the connection so doesn't work :(

I doesnt choose... I receive an email and reply ...


On 10/22/11, Andrew Beverley <andy@andybev.com> wrote:
> On Sat, 2011-10-22 at 17:11 +0200, Azerty Ytreza wrote:
>> Just mean gateway/firewall server that all the traffic passes through.
>>
>> No doesn't work ... The port is blocked when I try these rules (copy
>> of the INPUT rules) :
>>
>> iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
>> NEW -m recent --set
>> iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
>> NEW -m recent --update --seconds 600 --hitcount 1 -j DROP
>
> You've got a hitcount of 1. Don't you mean 10 as you had in your first
> set of rules?
>
>> And sorry but I have never user mailing list. I don't known how it's
>> work exactly :(
>
> No problem, but please don't put your reply at the top. Put it either
> within or at the bottom of the quoted email, just like I have for this
> email. It makes it easier for other people to follow the conversation if
> they've joined late or are reading it in the archives :)
>
> Andy
>
>
>

Re: Problem with log which are corrupted and need help with hitcount and FORWARD rules

[Andrew Beverley]

On Sat, 2011-10-22 at 17:33 +0200, Azerty Ytreza wrote:
> **********************************************************************************************
> > Just mean gateway/firewall server that all the traffic passes through.
> >
> > No doesn't work ... The port is blocked when I try these rules (copy
> > of the INPUT rules) :
> >
> > iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
> > NEW -m recent --set
> > iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
> > NEW -m recent --update --seconds 600 --hitcount 1 -j DROP
> 
> You've got a hitcount of 1. Don't you mean 10 as you had in your first
> set of rules?

> Yes it's for test. The first time should work, the second request
> should be blocked for 600sec.

Hitcount matches when the number of packets is greater than or *equal*,
so defining a number of "1" will always match.

Also, hitcount refers to number of packets, so you'll need a rule in
there to only apply the DROP to NEW connections, otherwise you'll block
a successful connection as soon as that number of packets has been sent.

This website is quite good:

http://thiemonagel.de/2006/02/preventing-brute-force-attacks-using-iptables-recent-matching/

Although you'll have to change INPUT to FORWARD.

Andy

Re: Problem with log which are corrupted and need help with hitcount and FORWARD rules

[Andrew Beverley]

On Sat, 2011-10-22 at 18:21 +0200, Azerty Ytreza wrote:
> > Hitcount matches when the number of packets is greater than or *equal*,
> > so defining a number of "1" will always match.
> 
> I have try to increase that but it's the same thing.
> iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
> NEW -m recent --update --seconds 600 --hitcount 10 -j DROP
> 
> >
> > Also, hitcount refers to number of packets, so you'll need a rule in
> > there to only apply the DROP to NEW connections, otherwise you'll block
> > a successful connection as soon as that number of packets has been sent.
> 
> Yes, I have modified this rules by removing "NEW" but the port is
> always blocked :(
> iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
> RELATED,ESTABLISHED -j ACCEPT

Can you re-post all the rules please so that we can have a look at them?

> > This website is quite good:
> >
> > http://thiemonagel.de/2006/02/preventing-brute-force-attacks-using-iptables-recent-matching/
> >
> > Although you'll have to change INPUT to FORWARD.
> >
> 
> This website use blacklist and name but it's the same no in my rules ?

"Probably", although I've not looked closely. If you really have written
equivalent rules then it should work okay. If you can re-post all your
rules then we can check.

Andy

P.S. You forgot to copy the list again!

Re: Problem with log which are corrupted and need help with hitcount and FORWARD rules

[Azerty Ytreza]

>> > Hitcount matches when the number of packets is greater than or *equal*,
>> > so defining a number of "1" will always match.
>>
>> I have try to increase that but it's the same thing.
>> iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
>> NEW -m recent --update --seconds 600 --hitcount 10 -j DROP
>>
>> >
>> > Also, hitcount refers to number of packets, so you'll need a rule in
>> > there to only apply the DROP to NEW connections, otherwise you'll block
>> > a successful connection as soon as that number of packets has been sent.
>>
>> Yes, I have modified this rules by removing "NEW" but the port is
>> always blocked :(
>> iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 443 -m state --state
>> RELATED,ESTABLISHED -j ACCEPT
>
> Can you re-post all the rules please so that we can have a look at them?

It's OK ! I have founded my error ...
Thank you for your help !

My big mistake it's with the INPUT rule followed by a FORWARD :(
I doesn't know that FORWARD open the port without INPUT.

Else the error was here : iptables -A FORWARD -i eth1 -p tcp -m tcp
--dport 443 -m state --state **NEW,**RELATED,ESTABLISHED -j ACCEPT


Else you have an idea for my corrupted log ?
It's probably linked to LXC but there is a way for check where come
the problem ?

>> > This website is quite good:
>> >
>> > http://thiemonagel.de/2006/02/preventing-brute-force-attacks-using-iptables-recent-matching/
>> >
>> > Although you'll have to change INPUT to FORWARD.
>> >
>>
>> This website use blacklist and name but it's the same no in my rules ?
>
> "Probably", although I've not looked closely. If you really have written
> equivalent rules then it should work okay. If you can re-post all your
> rules then we can check.
>
> Andy
>
>
>