From: "ganesh kumar godavari" <gkgodava@rediffmail.com>
To: netfilter@lists.samba.org
Subject: need help in rate limiting tcp-syn !!
Date: 29 Jun 2002 20:56:19 -0000 [thread overview]
Message-ID: <20020629205619.20469.qmail@webmail6.rediffmail.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 2797 bytes --]
hello group,
i have attached my shell code to limit the ping-icmp and
tcp-syn and tcp-portscan protection. i need some help in this
matter.
i am not able to limit the incoming tcp-syn packet and port scan
packets done using nmap.
i used nmap -sS -O -P0 -p1-15 <host name> for port scanning, nmap
-sS -O -P0 <host name> for syn flooding.
can anyone tell me what is wrong!!. i am successfully able to
limit the ping flood (ping -f <hostname>) from bib.cs.edu.
but when i repeat the experiment with tcp-syn flood and tcp port
scan. i am not able to limit.
logically the rules look fine for me. but i am not able to do some
rate limiting.
Thanks a mil
--
ganesh
#!/bin/sh
# This is the location of the iptables command
IPTABLES="/sbin/iptables"
EXTIF="eth0"
INTIF="eth1"
# Overall Limit for TCP-SYN-Flood detection
TCPSYNLIMIT="1/s"
# Burst Limit for TCP-SYN-Flood detection
TCPSYNLIMITBURST="5"
# Overall Limit for TCP-SYN-Flood detection
PINGLIMIT="1/s"
# Burst Limit for TCP-SYN-Flood detection
PINGLIMITBURST="5"
$IPTABLES -F
$IPTABLES -F -t mangle
$IPTABLES -F -t nat
$IPTABLES -X
$IPTABLES -X -t mangle
$IPTABLES -X -t nat
# Set up IP FORWARDing and Masquerading
$IPTABLES --table nat --append POSTROUTING --out-interface $EXTIF
-j MASQUERADE
$IPTABLES --append FORWARD --in-interface $INTIF -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward # Enables
packet forwarding by kernel
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -N PORTSCANLIMIT
$IPTABLES -A PORTSCANLIMIT -p tcp --tcp-flags SYN,ACK,FIN,RST RST
-m limit --limit $TCPSYNLIMIT --limit-burst $TCPSYNLIMITBURST -j
ACCEPT
$IPTABLES -A PORTSCANLIMIT -p tcp --tcp-flags SYN,ACK,FIN,RST RST
-j DROP
$IPTABLES -A PORTSCANLIMIT -j RETURN
$IPTABLES -N TCPACCEPT
$IPTABLES -A TCPACCEPT -p tcp --syn -m limit --limit $TCPSYNLIMIT
--limit-burst $TCPSYNLIMITBURST -j ACCEPT
$IPTABLES -A TCPACCEPT -p tcp --syn -j DROP
$IPTABLES -A TCPACCEPT -p tcp -j PORTSCANLIMIT
$IPTABLES -A TCPACCEPT -j RETURN
$IPTABLES -N PINGACCEPT
$IPTABLES -A PINGACCEPT -p icmp --icmp-type echo-request -m limit
--limit $PINGLIMIT --limit-burst $PINGLIMITBURST -j ACCEPT
$IPTABLES -A PINGACCEPT -p icmp --icmp-type echo-request -j DROP
$IPTABLES -A PINGACCEPT -p icmp -j RETURN
$IPTABLES -A INPUT -p tcp -s bib.cs.edu -j TCPACCEPT
$IPTABLES -A INPUT -p icmp -s bib.cs.edu -j PINGACCEPT
#$IPTABLES -A TCPACCEPT -p tcp !--syn -j ACCEPT
#$IPTABLES -A INPUT -p tcp --syn -j DROP
#IPTABLES -A INPUT -i $EXTIF -j DROP
#$IPTABLES -A INPUT -i $EXTIF -p tcp -j TCPACCEPT
#$IPTABLES -A INPUT -p tcp -j DROP
_________________________________________________________
There is always a better job for you at Monsterindia.com.
Go now http://monsterindia.com/rediffin/
[-- Attachment #2: Type: message/rfc822, Size: 4517 bytes --]
[-- Attachment #2.1.1: Notification --]
[-- Type: text/plain, Size: 429 bytes --]
This is the Postfix program at host lists.samba.org.
I'm sorry to have to inform you that the message returned
below could not be delivered to one or more destinations.
For further assistance, please contact <postmaster@samba.org>
If you do so, please include this problem report. You can
delete your own text from the message returned below.
The Postfix program
<netfileter@lists.samba.org>: unknown user: "netfileter"
[-- Attachment #2.1.2: Undelivered Message --]
[-- Type: message/rfc822, Size: 3518 bytes --]
From: "ganesh kumar godavari" <gkgodava@rediffmail.com>
To: netfileter@lists.samba.org
Subject: help in rate limiting
Date: 29 Jun 2002 20:54:31 -0000
Message-ID: <20020629205431.20278.qmail@webmail6.rediffmail.com>
hello group,
i have attached my shell code to limit the ping-icmp and
tcp-syn and tcp-portscan protection. i need some help in this
matter.
i am not able to limit the incoming tcp-syn packet and port scan
packets done using nmap.
i used nmap -sS -O -P0 -p1-15 <host name> for port scanning, nmap
-sS -O -P0 <host name> for syn flooding.
can anyone tell me what is wrong!!. i am successfully able to
limit the ping flood (ping -f <hostname>) from bib.cs.edu.
but when i repeat the experiment with tcp-syn flood and tcp port
scan. i am not able to limit.
logically the rules look fine for me. but i am not able to do some
rate limiting.
Thanks a mil
--
ganesh
#!/bin/sh
# This is the location of the iptables command
IPTABLES="/sbin/iptables"
EXTIF="eth0"
INTIF="eth1"
# Overall Limit for TCP-SYN-Flood detection
TCPSYNLIMIT="1/s"
# Burst Limit for TCP-SYN-Flood detection
TCPSYNLIMITBURST="5"
# Overall Limit for TCP-SYN-Flood detection
PINGLIMIT="1/s"
# Burst Limit for TCP-SYN-Flood detection
PINGLIMITBURST="5"
$IPTABLES -F
$IPTABLES -F -t mangle
$IPTABLES -F -t nat
$IPTABLES -X
$IPTABLES -X -t mangle
$IPTABLES -X -t nat
# Set up IP FORWARDing and Masquerading
$IPTABLES --table nat --append POSTROUTING --out-interface $EXTIF
-j MASQUERADE
$IPTABLES --append FORWARD --in-interface $INTIF -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward # Enables
packet forwarding by kernel
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -N PORTSCANLIMIT
$IPTABLES -A PORTSCANLIMIT -p tcp --tcp-flags SYN,ACK,FIN,RST RST
-m limit --limit $TCPSYNLIMIT --limit-burst $TCPSYNLIMITBURST -j
ACCEPT
$IPTABLES -A PORTSCANLIMIT -p tcp --tcp-flags SYN,ACK,FIN,RST RST
-j DROP
$IPTABLES -A PORTSCANLIMIT -j RETURN
$IPTABLES -N TCPACCEPT
$IPTABLES -A TCPACCEPT -p tcp --syn -m limit --limit $TCPSYNLIMIT
--limit-burst $TCPSYNLIMITBURST -j ACCEPT
$IPTABLES -A TCPACCEPT -p tcp --syn -j DROP
$IPTABLES -A TCPACCEPT -p tcp -j PORTSCANLIMIT
$IPTABLES -A TCPACCEPT -j RETURN
$IPTABLES -N PINGACCEPT
$IPTABLES -A PINGACCEPT -p icmp --icmp-type echo-request -m limit
--limit $PINGLIMIT --limit-burst $PINGLIMITBURST -j ACCEPT
$IPTABLES -A PINGACCEPT -p icmp --icmp-type echo-request -j DROP
$IPTABLES -A PINGACCEPT -p icmp -j RETURN
$IPTABLES -A INPUT -p tcp -s bib.cs.edu -j TCPACCEPT
$IPTABLES -A INPUT -p icmp -s bib.cs.edu -j PINGACCEPT
#$IPTABLES -A TCPACCEPT -p tcp !--syn -j ACCEPT
#$IPTABLES -A INPUT -p tcp --syn -j DROP
#IPTABLES -A INPUT -i $EXTIF -j DROP
#$IPTABLES -A INPUT -i $EXTIF -p tcp -j TCPACCEPT
#$IPTABLES -A INPUT -p tcp -j DROP
_________________________________________________________
There is always a better job for you at Monsterindia.com.
Go now http://monsterindia.com/rediffin/
next reply other threads:[~2002-06-29 20:56 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-06-29 20:56 ganesh kumar godavari [this message]
2002-06-29 22:48 ` need help in rate limiting tcp-syn !! Antony Stone
-- strict thread matches above, loose matches on Subject: below --
2002-06-29 23:21 ganesh kumar godavari
2002-06-30 5:35 ` George Georgalis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20020629205619.20469.qmail@webmail6.rediffmail.com \
--to=gkgodava@rediffmail.com \
--cc=netfilter@lists.samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox