iptables problem with rules

iptables problem with rules

[ganesh kumar godavari]

hello group,
  i am graduate student at colorado university. i am
  working on setting up a testbed for studying the
  Denial Of Service kinds of attacks. i am using IDS
  tool snort to detect any intrusion.  once i get the
  information that there is an attack i want to limit
  the # of packets based on the type of protocol used
  in the attack(say limit icmp packets if its a icmp
  ping flooding) one way to acheive QOS inspite of a
  DOS attack is to limit the # of packets comming in
  from the attacker.

  i have used iptables rules like

#Syn-flood protection:
  iptables -A FORWARD -s a.b.c.d -p tcp --syn -m
  limit --limit 1/s -j ACCEPT

  #port scan protection:
  iptables -A FORWARD  -s a.b.c.d -p tcp --tcp-flags
  SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

# Ping of death:

  iptables -A FORWARD  -s a.b.c.d -p icmp
  --icmp-type echo-request -m limit --limit 1/s -j
  ACCEPT


the rule doesn't help to stop the packets

i tried the following rule it helps me to stop the ping flood 
attack

  iptables -A INPUT  -s 128.198.60.195 -p icmp
  --icmp-type echo-request -m limit --limit 1/s -j
  ACCEPT
  iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

  iptables -A INPUT -s a.b.c.d -p tcp --syn -m
  limit --limit 1/s -j ACCEPT

  iptables -A INPUT -s a.b.c.d -p tcp --syn -j DROP

  iptables -A INPUT  -s a.b.c.d -p tcp --tcp-flags
  SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

  iptables -A INPUT  -s a.b.c.d -p tcp --tcp-flags
  SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT


i am able to succesfully limit the ping traffic but when i do the 
same with syn flood/port scan using nmap it doesn't limit the # of 
packets

can anyone tell me whats wrong with the rules.

thanks for your time

Thanks
ganesh



_________________________________________________________
There is always a better job for you at Monsterindia.com.
Go now http://monsterindia.com/rediffin/

Re: iptables problem with rules

[Antony Stone]

On Friday 28 June 2002 7:04 pm, ganesh kumar godavari wrote:

> hello group,

>   i want to limit
>   the # of packets based on the type of protocol used
>
>   i have used iptables rules like
>
> #Syn-flood protection:
>   iptables -A FORWARD -s a.b.c.d -p tcp --syn -m
>   limit --limit 1/s -j ACCEPT
>
> the rule doesn't help to stop the packets
>
> i tried the following rule it helps me to stop the ping flood
> attack
>
>   iptables -A INPUT  -s 128.198.60.195 -p icmp
>   --icmp-type echo-request -m limit --limit 1/s -j
>   ACCEPT
>   iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

I am confused about whether you are trying to stop packets coming in to the 
machine running netfilter (ie you are putting the rules in the INPUT chain) 
or whether you are trying to stop packets going through the netfilter machine 
to another host (ie you are putting the rules in the FORWARD chain).

Please can you clarify your network setup ?

 

Antony.