PREROUTING AND SECURITY

[Guillaume Devoyon <guillaume.devoyon@integro-networks.com>]

hello,

on the firewall at my office, i do preroutings tasks in order to forward ports.
In order to do that, i use the following rule :

/sbin/iptables -t nat -A PREROUTING -s $CLIENT_PUBLIC_IP -p tcp -i $EXTERNAL_INTERFACE\
 --dport 80 -j DNAT --to $INTERNAL_MACHINE:80

As you can see, I use the "-s" option  to allow only  one person to use my forwarding port.

Yesterday, I had an attack on the firewall .
I had this in my /var/log/messages :


Jun 27 14:44:39 cofw01 kernel: FIREWALL_80IN=eth0 OUT= MAC=00:30:48:51:08:f0:00:20:6f:11:34:7b:08:00 SRC=xxx.xxx.xxx.xxx DST=192.168.1.2 LEN=48 TOS=0x00 PREC=0x00 TTL=115 ID=47214 DF PROTO=TCP SPT=3033 DPT=80 WINDOW=8192 RES=0x00 SYN URGP=0 
Jun 27 14:51:49 cofw01 kernel: eth0: card reports no resources.
Jun 27 14:51:49 cofw01 last message repeated 15 times
Jun 27 14:51:49 cofw01 kernel: eth0: Too much work at interrupt, status=0x4050.
Jun 27 14:51:49 cofw01 kernel: eth0: card reports no resources.
Jun 27 14:51:49 cofw01 last message repeated 19 times
Jun 27 14:51:49 cofw01 kernel: eth0: Too much work at interrupt, status=0x4050.
Jun 27 14:51:49 cofw01 kernel: eth0: card reports no resources.
Jun 27 14:51:49 cofw01 kernel: eth0: Too much work at interrupt, status=0x4050.
Jun 27 14:51:49 cofw01 kernel: eth0: Too much work at interrupt, status=0x4050.
Jun 27 14:51:49 cofw01 kernel: eth0: card reports no resources.
Jun 27 14:51:49 cofw01 last message repeated 8 times
Jun 27 14:51:49 cofw01 kernel: eth0: Too much work at interrupt, status=0x4050

so i saw that xxx.xxx.xxx.xxx had attacked my firewall.

After this i had to reboot my firewall

1) how is it possible that my firewall switched of my eth0 card ? 
   Is it because I do a log of this translation rule ? (made my system heavy if there are many connections ?)
   Is it because for others rules i do an reject instead of an drop ?

Next, I had a look at my apache server behind the firewall, and I found the following messages in my /var/log/messages

Jun 27 14:51:24 coupf01 kernel: eth0: card reports no resources.
Jun 27 14:51:24 coupf01 kernel: eth0: Too much work at interrupt, status=0x4050.


whow !!
the attack had also touched my server behind the firewall..
How is it possible ? I put an "-s" option in my prerouting..
Is it enough or should I put an drop rule for others connections? (other than my client : -s $CLIENT_PUBLIC_IP)


Guillaume Devoyon