Blocking source ports after REDIRECT

Blocking source ports after REDIRECT

[Trevor Turton]

I am running an untrusted web/app server and mail server on a Linux 
server, and choose to run then as non-root.  The apps must therefore use 
ports other than the well-known privileged ones.  I have set up iptables 
to redirect client requests addressed to the well-known ports to the 
ports that these apps open, e.g.
 25 -> 8025
 80 -> 8080
110 -> 8110
This works fine.  Out of obsessive neatness rather than for any good 
technical reason I would like to block direct access to the apps through 
their non-privileged (8xxx) ports.  When I insert a filter command to do 
this, it blocks the redirected traffic as well.  Does anyone have a 
suggestion for me?  The commands are listed below, with the one that 
breaks connectivity commented out with ##

Regards
Trevor Turton

#!/bin/bash
###############################################################################
# This script redirects various well-known services to local 
unprivileged ports
# and block the other privileged ports.
# 2004-04-13 Trevor Turton
###############################################################################
#
# turn on IP forwarding:
#
echo 1 > /proc/sys/net/ipv4/ip_forward
#
# redirect well-known services' ports to local unprivileged ports
#
/sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 25  -j 
REDIRECT --to-ports 8025
/sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 80  -j 
REDIRECT --to-ports 8080
/sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 110 -j 
REDIRECT --to-ports 8110
/sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 443 -j 
REDIRECT --to-ports 8443
#
# accept traffic addressed to the serviced tcp ports
#
/sbin/iptables -A INPUT -p tcp --dport 22  -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 25  -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 80  -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 110 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 443 -j ACCEPT
#
# filter out traffic to remaining privileged tcp ports
#
/sbin/iptables -A INPUT -p tcp -i eth0 --dport 0:1023 -j DROP
## the following command blocks -eth0 --dport 25,80,110,443 as well!!
## /sbin/iptables -A INPUT -p tcp -i eth0 --dport 8000:8443 -j DROP
#
# accept traffic to serviced udp port (dns)
#
/sbin/iptables -A INPUT -p udp --dport 53  -j ACCEPT
#
# filter out traffic to remaining privileged udp ports
#
/sbin/iptables -A INPUT -p udp -i eth0 --dport 0:1023 -j DROP

Re: Blocking source ports after REDIRECT

[Andrew Schulman]

> I am running an untrusted web/app server and mail server on a Linux 
> server, and choose to run then as non-root.  The apps must therefore use 
> ports other than the well-known privileged ones.  I have set up iptables 
> to redirect client requests addressed to the well-known ports to the 
> ports that these apps open, e.g.
>  25 -> 8025
>  80 -> 8080
> 110 -> 8110
> This works fine.  Out of obsessive neatness rather than for any good 
> technical reason I would like to block direct access to the apps through 
> their non-privileged (8xxx) ports.  When I insert a filter command to do 
> this, it blocks the redirected traffic as well.  Does anyone have a 
> suggestion for me?  The commands are listed below, with the one that 
> breaks connectivity commented out with ##
> 
> Regards
> Trevor Turton
> 
> #!/bin/bash
> ###############################################################################
> # This script redirects various well-known services to local 
> unprivileged ports
> # and block the other privileged ports.
> # 2004-04-13 Trevor Turton
> ###############################################################################
> #
> # turn on IP forwarding:
> #
> echo 1 > /proc/sys/net/ipv4/ip_forward
> #
> # redirect well-known services' ports to local unprivileged ports
> #
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 25  -j 
> REDIRECT --to-ports 8025
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 80  -j 
> REDIRECT --to-ports 8080
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 110 -j 
> REDIRECT --to-ports 8110
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 443 -j 
> REDIRECT --to-ports 8443
> #
> # accept traffic addressed to the serviced tcp ports
> #
> /sbin/iptables -A INPUT -p tcp --dport 22  -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 25  -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 80  -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 110 -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 443 -j ACCEPT
> #
> # filter out traffic to remaining privileged tcp ports
> #
> /sbin/iptables -A INPUT -p tcp -i eth0 --dport 0:1023 -j DROP
> ## the following command blocks -eth0 --dport 25,80,110,443 as well!!
> ## /sbin/iptables -A INPUT -p tcp -i eth0 --dport 8000:8443 -j DROP
> #
> # accept traffic to serviced udp port (dns)
> #
> /sbin/iptables -A INPUT -p udp --dport 53  -j ACCEPT
> #
> # filter out traffic to remaining privileged udp ports
> #
> /sbin/iptables -A INPUT -p udp -i eth0 --dport 0:1023 -j DROP

See if this makes sense:

Your port REDIRECTion happens in the PREROUTING table, _before_ the 
packets reach the INPUT table.  See the diagram at 
http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-
6.html.  So your INPUT rules never match: by the time a packet addressed 
to, say, port 110 arrives there, its destination port has already been 
changed to 8110.  So the ACCEPT rule on port 110 doesn't match.  Instead 
the packet falls through to your DROP rule, where it gets clobbered.

Re: Blocking source ports after REDIRECT

[Antony Stone]

On Wednesday 14 April 2004 5:42 pm, Trevor Turton wrote:

> I am running an untrusted web/app server and mail server on a Linux
> server, and choose to run then as non-root.  The apps must therefore use
> ports other than the well-known privileged ones.

You can't start them as root, bind to a privileged port, then drop privilege 
to run the remainder of the app as a standard user?

> I have set up iptables
> to redirect client requests addressed to the well-known ports to the
> ports that these apps open, e.g.
>  25 -> 8025
>  80 -> 8080
> 110 -> 8110
> This works fine.

Fair enough - an alternative way to do it.

> Out of obsessive neatness rather than for any good
> technical reason I would like to block direct access to the apps through
> their non-privileged (8xxx) ports.  When I insert a filter command to do
> this, it blocks the redirected traffic as well.

> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 25  -j
> REDIRECT --to-ports 8025
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 80  -j
> REDIRECT --to-ports 8080
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 110 -j
> REDIRECT --to-ports 8110
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 443 -j
> REDIRECT --to-ports 8443
> #
> # accept traffic addressed to the serviced tcp ports
> #
> /sbin/iptables -A INPUT -p tcp --dport 22  -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 25  -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 80  -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 110 -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 443 -j ACCEPT

There is absolutely no reason to have the above rules, since your apps are not 
listening on those ports!   Port 25 just got redirected to 8025, 80 -> 8080, 
110 -> 8110, and 443 -> 8443.   Remember that PREROUTING happens before 
INPUT, so the INPUT chain only sees the destination addresses/ports after 
they've been changed.

> #
> # filter out traffic to remaining privileged tcp ports
> #
> /sbin/iptables -A INPUT -p tcp -i eth0 --dport 0:1023 -j DROP
> ## the following command blocks -eth0 --dport 25,80,110,443 as well!!
> ## /sbin/iptables -A INPUT -p tcp -i eth0 --dport 8000:8443 -j DROP

Yes, sure, because you're now blocking the packets which just got translated 
from the low port numbers :)

What you need to do is either:

1. DROP the packets sent to the high port numbers in PREROUTING (not a 
recommendation I would normally make, but there are always exceptions!)

or

2. DNAT the high port numbers to something you don't care about, and then DROP 
those in INPUT.

eg:

1. iptables -A PREROUTING -t nat -p tcp -i eth0 --dport 8025  -j DROP 
iptables -A PREROUTING -t nat -p tcp -i eth0 --dport 8080  -j DROP 
etc.

or 

2. iptables -A PREROUTING -t nat -p tcp -i eth0 --dport 8025 -j REDIRECT --to 
65535
iptables -A PREROUTING -t nat -p tcp -i eth0 --dport 8080 -j REDIRECT --to 
65535
etc.
iptables -A INPUT -p tcp -i eth0 --dport 65535 -j DROP

Regards,

Antony.

-- 
"There is no reason for any individual to have a computer in their home."

 - Ken Olsen, President of Digital Equipment Corporation (DEC, later consumed 
by Compaq, later consumed by HP)

                                                     Please reply to the list;
                                                           please don't CC me.