Dynamicly Updating Rules

Dynamicly Updating Rules

[Lee Leahu]

Is there a way to dynamically add and remove rules to an iptables live configuration?

For example:

I have a server and a workstion.  the workstation is locked down tightly.  I would like for
when i ssh to a remote server, that iptables automatically opens the ident port on the workstation
to that remote server, and after a connection is made, to automatically close it back up again.

Is this possible???

-- 
Lee Leahu
Internet Technologies Specialist
RICIS, Inc.

email--> lee@ricis.com
voice--> 708-444-2690
fax--> 708-444-2697

Re: Dynamicly Updating Rules

[Doug Monroe]

Lee Leahu wrote:
> 
> Is there a way to dynamically add and remove rules to an iptables live configuration?
> 
> For example:
> 
> I have a server and a workstion.  the workstation is locked down tightly.  I would like for
> when i ssh to a remote server, that iptables automatically opens the ident port on the workstation
> to that remote server, and after a connection is made, to automatically close it back up again.
> 
> Is this possible???

I suppose you could write a "wrapper" around the workstation ssh client that
does -I (insert), -A (append), -D (delete) as needed.

Re: Dynamically Updating Rules

[Antony Stone]

On Thursday 27 June 2002 7:31 pm, Lee Leahu wrote:

> Is there a way to dynamically add and remove rules to an iptables live
> configuration?
>
> For example:
>
> I have a server and a workstion.  the workstation is locked down tightly. 
> I would like for when i ssh to a remote server, that iptables automatically
> opens the ident port on the workstation to that remote server, and after a
> connection is made, to automatically close it back up again.
>
> Is this possible???

You can create a script to add or remove rules whenever you like - the trick 
is working out how to call the script.

If the daemon / service / application you're using doesn't easily support the 
idea of calling a script when a connection comes in, you could perhaps log 
the appropriate events (either with netfilter, or the daemon), either to a 
log file which a background job is continually scanning, or pipe them to a 
process which parses and handles the log entries as they come in ?

You could even do something like run snort on the machine, and trigger on 
certain events, or monitor the conntection tracking table and respond to new 
connections which appear ?

No doubt there are plenty of other ways of doing what you want.

 

Antony

Re: Dynamicly Updating Rules

[Patrick Schaaf]

> I would like for when i ssh to a remote server, that iptables automatically
> opens the ident port on the workstation to that remote server, and after a
> connection is made, to automatically close it back up again.
> Is this possible???

That is exactly what the "conntracking and NAT helpers" are doing for
protocols like FTP, where they permit a data connection when they see
a PORT command within the control connection.

You have to program this yourself, as an in-kernel module. You can take
existing helpers for reference. If you want to go that way, and you have
specific questions, best subscribe to the netfilter-devel mailing list.

best regards
  Patrick

(btw, I reformatted your lines to be under 80 characters long. Please do that
yourself in the future)

RE: Dynamicly Updating Rules

[Joe Patterson]

I came up with an interesting method for doing this recently.  I haven't
tried it out yet, and it may or may not work for you, but the general method
would be something like:

$IPT -A INPUT -p tcp --tcp-flags ALL SYN,ACK -m state --state ESTABLISHED -m
recent --name validconn --set

$IPT -A INPUT -m recent --name validconn -rcheck --seconds 20 -p tcp --dport
113 -j REJECT --reject-with tcp-reset

with rules specifically for what you want being something more like:

$IPT -A INPUT -p tcp --tcp-flags ALL SYN,ACK -m state --state ESTABLISHED -m
recent --name validconn --set -p tcp --sport 22 -s $SERVER_IP

$IPT -A INPUT -m recent --name validconn -rcheck --seconds 20 -p tcp --dport
113 -j ACCEPT

It's not exactly what you're asking for, but it's fairly close.  Whenever
you make a tcp connection to port 22 on the server, it'll open up port 113
from that server for the next 20 seconds.  (20 seconds was chosen randomly,
put whatever value you want there.)

If you try it and it works, let me know.

-Joe

> -----Original Message-----
> From: netfilter-admin@lists.samba.org
> [mailto:netfilter-admin@lists.samba.org]On Behalf Of Lee Leahu
> Sent: Thursday, June 27, 2002 2:31 PM
> To: netfilter@lists.samba.org
> Subject: Dynamicly Updating Rules
>
>
> Is there a way to dynamically add and remove rules to an iptables
> live configuration?
>
> For example:
>
> I have a server and a workstion.  the workstation is locked down
> tightly.  I would like for
> when i ssh to a remote server, that iptables automatically opens
> the ident port on the workstation
> to that remote server, and after a connection is made, to
> automatically close it back up again.
>
> Is this possible???
>
> --
> Lee Leahu
> Internet Technologies Specialist
> RICIS, Inc.
>
> email--> lee@ricis.com
> voice--> 708-444-2690
> fax--> 708-444-2697
>
>
>
>