iptables help please

iptables help please

[Velvet Pixel]

Since upgrading my install from CentOS 5.1 to 5.2 and I am getting lots 
of errors in messages that look like they are iptables related.

If anybody could help comment on my iptables rules to let me know if I 
have them set up incorrectly I would appreciate it :)

This is on an OpenVZ VPS at a remote data center and not a box on my 
lan.

Run chain banished Always
Accept If input interface is lo
Accept If protocol is TCP and TCP flags ACK (of ACK) are set
Accept If state of connection is ESTABLISHED
Accept If state of connection is RELATED
Accept If protocol is TCP and source port is 53
Accept If protocol is UDP and source port is 53
Accept If protocol is ICMP and ICMP type is echo-reply
Accept If protocol is ICMP and ICMP type is destination-unreachable
Accept If protocol is ICMP and ICMP type is source-quench
Accept If protocol is ICMP and ICMP type is time-exceeded
Accept If protocol is ICMP and ICMP type is parameter-problem
Accept If protocol is ICMP and ICMP type is echo-request
Drop If protocol is TCP and destination port is ftp
Accept If protocol is TCP and source is xx.xx.xx.xx and destination 
port is ssh
Drop If protocol is TCP and destination port is ssh
Accept If protocol is TCP and destination port is 25
Accept If protocol is TCP and destination port is 80
Accept If protocol is TCP and source is xx.xx.xx.xx and destination 
port is 110
Drop If protocol is TCP and destination port is 110
Accept If protocol is TCP and destination port is 113
Accept If protocol is TCP and source is xx.xx.xx.xx and destination 
port is 143
Drop If protocol is TCP and destination port is 143
Accept If protocol is TCP and destination port is 443
Drop If protocol is TCP and destination port is 465
Accept If protocol is TCP and source is xx.xx.xx.xx and destination 
port is 10000:10010
Drop If protocol is TCP and destination port is 10000:10010
Accept If protocol is TCP and source is xx.xx.xx.xx and destination 
port is 20000
Drop If protocol is TCP and destination port is 20000
Accept If source is 127.0.0.1
Accept If input interface is venet0

The xx.xx.xx.xx is my static IP for my home office.
The chain banished is IPs of crackers that were repeatedly trying to 
get in my system and their source IPs are set to deny.


The type of error I am seeing is:
Jul 10 16:42:12 vps kernel: IN= OUT=venet0 SRC=IP.IP.IP.IP 
DST=zz.zz.zz.zz LEN=1452 TOS=0x08 PREC=0x00 TTL=64 ID=4361 DF PROTO=TCP 
SPT=22 DPT=63628 WINDOW=644 RES=0x00 ACK URGP=0

zz.zz.zz.zz=any ip accessing the server
IP.IP.IP.IP=IP of the server

My messages file is usually 44B and now in one day it is over 60MB!!! 
with thousands of those messages being logged so I need help :)

Thanks,
Cameron

RE: iptables help please

[Ukeme Noah]

Howdy,

From my understanding, a message like "RES=0X00 ACK SYN URGP=0" would
indicate a reply to a syn packet. Considering the source port is 22, I would
suspect unauthorized access attempts on your server. On that note, I'd
strongly advise, [if you've not already done so] that you use the PKI
authentication mechanism and configure the SSH server to close any
connection attempt to your server that fails to use this mechanism.

Warm Regards
Ukeme Noah

-----Original Message-----
From: netfilter-owner@vger.kernel.org
[mailto:netfilter-owner@vger.kernel.org] On Behalf Of Velvet Pixel
Sent: Friday, July 11, 2008 7:17 PM
To: netfilter@vger.kernel.org
Subject: iptables help please

Since upgrading my install from CentOS 5.1 to 5.2 and I am getting lots 
of errors in messages that look like they are iptables related.

If anybody could help comment on my iptables rules to let me know if I 
have them set up incorrectly I would appreciate it :)

This is on an OpenVZ VPS at a remote data center and not a box on my 
lan.

Run chain banished Always
Accept If input interface is lo
Accept If protocol is TCP and TCP flags ACK (of ACK) are set
Accept If state of connection is ESTABLISHED
Accept If state of connection is RELATED
Accept If protocol is TCP and source port is 53
Accept If protocol is UDP and source port is 53
Accept If protocol is ICMP and ICMP type is echo-reply
Accept If protocol is ICMP and ICMP type is destination-unreachable
Accept If protocol is ICMP and ICMP type is source-quench
Accept If protocol is ICMP and ICMP type is time-exceeded
Accept If protocol is ICMP and ICMP type is parameter-problem
Accept If protocol is ICMP and ICMP type is echo-request
Drop If protocol is TCP and destination port is ftp
Accept If protocol is TCP and source is xx.xx.xx.xx and destination 
port is ssh
Drop If protocol is TCP and destination port is ssh
Accept If protocol is TCP and destination port is 25
Accept If protocol is TCP and destination port is 80
Accept If protocol is TCP and source is xx.xx.xx.xx and destination 
port is 110
Drop If protocol is TCP and destination port is 110
Accept If protocol is TCP and destination port is 113
Accept If protocol is TCP and source is xx.xx.xx.xx and destination 
port is 143
Drop If protocol is TCP and destination port is 143
Accept If protocol is TCP and destination port is 443
Drop If protocol is TCP and destination port is 465
Accept If protocol is TCP and source is xx.xx.xx.xx and destination 
port is 10000:10010
Drop If protocol is TCP and destination port is 10000:10010
Accept If protocol is TCP and source is xx.xx.xx.xx and destination 
port is 20000
Drop If protocol is TCP and destination port is 20000
Accept If source is 127.0.0.1
Accept If input interface is venet0

The xx.xx.xx.xx is my static IP for my home office.
The chain banished is IPs of crackers that were repeatedly trying to 
get in my system and their source IPs are set to deny.


The type of error I am seeing is:
Jul 10 16:42:12 vps kernel: IN= OUT=venet0 SRC=IP.IP.IP.IP 
DST=zz.zz.zz.zz LEN=1452 TOS=0x08 PREC=0x00 TTL=64 ID=4361 DF PROTO=TCP 
SPT=22 DPT=63628 WINDOW=644 RES=0x00 ACK URGP=0

zz.zz.zz.zz=any ip accessing the server
IP.IP.IP.IP=IP of the server

My messages file is usually 44B and now in one day it is over 60MB!!! 
with thousands of those messages being logged so I need help :)

Thanks,
Cameron

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: iptables help please

[Velvet Pixel]

Hi Ukeme,

Thanks for your help.

Turns out it was a log packet rule that I had for OUTPUT and FORWARD 
that for some reason were not logging before the upgrade and were 
definitely logging after the upgrade! I removed the log rules and my 
log files are back to normal.

I have all SSH traffic allowed only to my home office static IP. Is 
that not safe?
That packet log you saw happened to be traffic from me :)

Is PKI Auth better because no password is being broadcast?

Thanks!
Cameron Smith

On Jul 11, 2008, at 9:32 PM, Ukeme Noah wrote:

> Howdy,
>
> From my understanding, a message like "RES=0X00 ACK SYN URGP=0" would
> indicate a reply to a syn packet. Considering the source port is 22, I 
> would
> suspect unauthorized access attempts on your server. On that note, I'd
> strongly advise, [if you've not already done so] that you use the PKI
> authentication mechanism and configure the SSH server to close any
> connection attempt to your server that fails to use this mechanism.
>
> Warm Regards
> Ukeme Noah
>
> -----Original Message-----
> From: netfilter-owner@vger.kernel.org
> [mailto:netfilter-owner@vger.kernel.org] On Behalf Of Velvet Pixel
> Sent: Friday, July 11, 2008 7:17 PM
> To: netfilter@vger.kernel.org
> Subject: iptables help please
>
> Since upgrading my install from CentOS 5.1 to 5.2 and I am getting lots
> of errors in messages that look like they are iptables related.
>
> If anybody could help comment on my iptables rules to let me know if I
> have them set up incorrectly I would appreciate it :)
>
> This is on an OpenVZ VPS at a remote data center and not a box on my
> lan.
>
> Run chain banished Always
> Accept If input interface is lo
> Accept If protocol is TCP and TCP flags ACK (of ACK) are set
> Accept If state of connection is ESTABLISHED
> Accept If state of connection is RELATED
> Accept If protocol is TCP and source port is 53
> Accept If protocol is UDP and source port is 53
> Accept If protocol is ICMP and ICMP type is echo-reply
> Accept If protocol is ICMP and ICMP type is destination-unreachable
> Accept If protocol is ICMP and ICMP type is source-quench
> Accept If protocol is ICMP and ICMP type is time-exceeded
> Accept If protocol is ICMP and ICMP type is parameter-problem
> Accept If protocol is ICMP and ICMP type is echo-request
> Drop If protocol is TCP and destination port is ftp
> Accept If protocol is TCP and source is xx.xx.xx.xx and destination
> port is ssh
> Drop If protocol is TCP and destination port is ssh
> Accept If protocol is TCP and destination port is 25
> Accept If protocol is TCP and destination port is 80
> Accept If protocol is TCP and source is xx.xx.xx.xx and destination
> port is 110
> Drop If protocol is TCP and destination port is 110
> Accept If protocol is TCP and destination port is 113
> Accept If protocol is TCP and source is xx.xx.xx.xx and destination
> port is 143
> Drop If protocol is TCP and destination port is 143
> Accept If protocol is TCP and destination port is 443
> Drop If protocol is TCP and destination port is 465
> Accept If protocol is TCP and source is xx.xx.xx.xx and destination
> port is 10000:10010
> Drop If protocol is TCP and destination port is 10000:10010
> Accept If protocol is TCP and source is xx.xx.xx.xx and destination
> port is 20000
> Drop If protocol is TCP and destination port is 20000
> Accept If source is 127.0.0.1
> Accept If input interface is venet0
>
> The xx.xx.xx.xx is my static IP for my home office.
> The chain banished is IPs of crackers that were repeatedly trying to
> get in my system and their source IPs are set to deny.
>
>
> The type of error I am seeing is:
> Jul 10 16:42:12 vps kernel: IN= OUT=venet0 SRC=IP.IP.IP.IP
> DST=zz.zz.zz.zz LEN=1452 TOS=0x08 PREC=0x00 TTL=64 ID=4361 DF PROTO=TCP
> SPT=22 DPT=63628 WINDOW=644 RES=0x00 ACK URGP=0
>
> zz.zz.zz.zz=any ip accessing the server
> IP.IP.IP.IP=IP of the server
>
> My messages file is usually 44B and now in one day it is over 60MB!!!
> with thousands of those messages being logged so I need help :)
>
> Thanks,
> Cameron
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>