* Re: Blocking source ports after REDIRECT
2004-04-14 16:42 Blocking source ports after REDIRECT Trevor Turton
@ 2004-04-14 17:03 ` Andrew Schulman
2004-04-14 17:04 ` Antony Stone
1 sibling, 0 replies; 3+ messages in thread
From: Andrew Schulman @ 2004-04-14 17:03 UTC (permalink / raw)
To: netfilter-wool9L35kiczKOhml7GhPkB+6BGkLq7r
> I am running an untrusted web/app server and mail server on a Linux
> server, and choose to run then as non-root. The apps must therefore use
> ports other than the well-known privileged ones. I have set up iptables
> to redirect client requests addressed to the well-known ports to the
> ports that these apps open, e.g.
> 25 -> 8025
> 80 -> 8080
> 110 -> 8110
> This works fine. Out of obsessive neatness rather than for any good
> technical reason I would like to block direct access to the apps through
> their non-privileged (8xxx) ports. When I insert a filter command to do
> this, it blocks the redirected traffic as well. Does anyone have a
> suggestion for me? The commands are listed below, with the one that
> breaks connectivity commented out with ##
>
> Regards
> Trevor Turton
>
> #!/bin/bash
> ###############################################################################
> # This script redirects various well-known services to local
> unprivileged ports
> # and block the other privileged ports.
> # 2004-04-13 Trevor Turton
> ###############################################################################
> #
> # turn on IP forwarding:
> #
> echo 1 > /proc/sys/net/ipv4/ip_forward
> #
> # redirect well-known services' ports to local unprivileged ports
> #
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 25 -j
> REDIRECT --to-ports 8025
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 80 -j
> REDIRECT --to-ports 8080
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 110 -j
> REDIRECT --to-ports 8110
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 443 -j
> REDIRECT --to-ports 8443
> #
> # accept traffic addressed to the serviced tcp ports
> #
> /sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 25 -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 110 -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 443 -j ACCEPT
> #
> # filter out traffic to remaining privileged tcp ports
> #
> /sbin/iptables -A INPUT -p tcp -i eth0 --dport 0:1023 -j DROP
> ## the following command blocks -eth0 --dport 25,80,110,443 as well!!
> ## /sbin/iptables -A INPUT -p tcp -i eth0 --dport 8000:8443 -j DROP
> #
> # accept traffic to serviced udp port (dns)
> #
> /sbin/iptables -A INPUT -p udp --dport 53 -j ACCEPT
> #
> # filter out traffic to remaining privileged udp ports
> #
> /sbin/iptables -A INPUT -p udp -i eth0 --dport 0:1023 -j DROP
See if this makes sense:
Your port REDIRECTion happens in the PREROUTING table, _before_ the
packets reach the INPUT table. See the diagram at
http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-
6.html. So your INPUT rules never match: by the time a packet addressed
to, say, port 110 arrives there, its destination port has already been
changed to 8110. So the ACCEPT rule on port 110 doesn't match. Instead
the packet falls through to your DROP rule, where it gets clobbered.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Blocking source ports after REDIRECT
2004-04-14 16:42 Blocking source ports after REDIRECT Trevor Turton
2004-04-14 17:03 ` Andrew Schulman
@ 2004-04-14 17:04 ` Antony Stone
1 sibling, 0 replies; 3+ messages in thread
From: Antony Stone @ 2004-04-14 17:04 UTC (permalink / raw)
To: netfilter
On Wednesday 14 April 2004 5:42 pm, Trevor Turton wrote:
> I am running an untrusted web/app server and mail server on a Linux
> server, and choose to run then as non-root. The apps must therefore use
> ports other than the well-known privileged ones.
You can't start them as root, bind to a privileged port, then drop privilege
to run the remainder of the app as a standard user?
> I have set up iptables
> to redirect client requests addressed to the well-known ports to the
> ports that these apps open, e.g.
> 25 -> 8025
> 80 -> 8080
> 110 -> 8110
> This works fine.
Fair enough - an alternative way to do it.
> Out of obsessive neatness rather than for any good
> technical reason I would like to block direct access to the apps through
> their non-privileged (8xxx) ports. When I insert a filter command to do
> this, it blocks the redirected traffic as well.
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 25 -j
> REDIRECT --to-ports 8025
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 80 -j
> REDIRECT --to-ports 8080
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 110 -j
> REDIRECT --to-ports 8110
> /sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 443 -j
> REDIRECT --to-ports 8443
> #
> # accept traffic addressed to the serviced tcp ports
> #
> /sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 25 -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 110 -j ACCEPT
> /sbin/iptables -A INPUT -p tcp --dport 443 -j ACCEPT
There is absolutely no reason to have the above rules, since your apps are not
listening on those ports! Port 25 just got redirected to 8025, 80 -> 8080,
110 -> 8110, and 443 -> 8443. Remember that PREROUTING happens before
INPUT, so the INPUT chain only sees the destination addresses/ports after
they've been changed.
> #
> # filter out traffic to remaining privileged tcp ports
> #
> /sbin/iptables -A INPUT -p tcp -i eth0 --dport 0:1023 -j DROP
> ## the following command blocks -eth0 --dport 25,80,110,443 as well!!
> ## /sbin/iptables -A INPUT -p tcp -i eth0 --dport 8000:8443 -j DROP
Yes, sure, because you're now blocking the packets which just got translated
from the low port numbers :)
What you need to do is either:
1. DROP the packets sent to the high port numbers in PREROUTING (not a
recommendation I would normally make, but there are always exceptions!)
or
2. DNAT the high port numbers to something you don't care about, and then DROP
those in INPUT.
eg:
1. iptables -A PREROUTING -t nat -p tcp -i eth0 --dport 8025 -j DROP
iptables -A PREROUTING -t nat -p tcp -i eth0 --dport 8080 -j DROP
etc.
or
2. iptables -A PREROUTING -t nat -p tcp -i eth0 --dport 8025 -j REDIRECT --to
65535
iptables -A PREROUTING -t nat -p tcp -i eth0 --dport 8080 -j REDIRECT --to
65535
etc.
iptables -A INPUT -p tcp -i eth0 --dport 65535 -j DROP
Regards,
Antony.
--
"There is no reason for any individual to have a computer in their home."
- Ken Olsen, President of Digital Equipment Corporation (DEC, later consumed
by Compaq, later consumed by HP)
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 3+ messages in thread