* Re: Re: need help in rate limiting tcp-syn !!
@ 2002-06-30 23:22 ganesh kumar godavari
0 siblings, 0 replies; 2+ messages in thread
From: ganesh kumar godavari @ 2002-06-30 23:22 UTC (permalink / raw)
To: George Georgalis; +Cc: Antony Stone, netfilter
george,
the scripts of of great use to me.
Thanks a lot
---
ganesh
On Sun, 30 Jun 2002 George Georgalis wrote :
>On Sat, Jun 29, 2002 at 11:21:28PM -0000, ganesh kumar godavari
>wrote:
> >hello anthony,
> > can u please tell me how i can limit the # of packets from
>a
> >tcp-syn flood and portscan from a particular ip(say a.b.c.d)
> from
> >all kinds of attack if possible.
> >
> >
> >i badly need this i am currently performing some tests on DDOS
>and
> >i need to figure this out. in a DDOS attack i want to limit the
>#
> >of packets from a group of attack clients. i have to
>dynamically
> >add the ip address and limit the # of packets from incomming
> >attack clients.
> >
> >can u please tell me how i can succefully protect my machine
> from
> >a single attack client incase of 1) portscan and 2) tcp-syn
> >flood.
> >
> >Thanks for the help
> >
>
>
>I think you can find what you need from one of the two scripts
>below.
>They are part of a tgz I found on securityfocus, called
>'firewall-rulesets'
>
>I couldn't find it but these looks good too
>http://online.securityfocus.com/tools/2006
>http://online.securityfocus.com/archive/91/205020
>
>It sounds like you want http://www.psionic.com/products/
> The TriSentry freeware suite (formerly the Abacus Project
>tools)
>
>You probably know what he's trying to teach you in the docs by
>the
>time you figure out he's trying to teach you not help you get it
>going.
>It's been a while but the docs bugged me that way before.
>
>Here are two scripts from a securityfocus tgz... note, you'll
>have to
>join the lines that have been broken (I didn't do it :-)
>
>// George
>
>
>
>#!/bin/bash
>#################################################################################
># #
># Created......: 17 August 2001 #
># Last Modified: 13/09/2001 20:28 #
># Author.......: Skylinux #
># Version......: 0.2.2 #
># Download.....: http://home.earthlink.net/~skylinux/ #
># #
>#################################################################################
># #
># Source: #
># #
># - James Stephens' Iptables script @ #
># http://www.cs.princeton.edu/~jns/security/iptables/index.html
>#
># - Linux 2.4 Packet Filtering HOWTO #
># - Linux 2.4 NAT HOWTO #
># #
>#################################################################################
># #
># Change Log: #
># #
># v0.2.2 -added FORWARD icmp rule #
># #
># v0.2 -fixed the FTP forward problem, #
># -removed some "double rules", #
># v0.11 -added NetBus,Back Orifice & Trin00 protection #
># #
>#################################################################################
># #
># To do List: #
># #
># - add Netkiller flood protection #
># - implement script with start/stop function #
># - add mirror function (attacker is scanning himself) #
># - add another TCP_SERVICES_OUT_* Setting like FORWARD_PORTS_2
>#
># - fix the error message from the ICQ rule while starting
>firewall #
># #
>#################################################################################
>#
># Documentation
># -------------
># This firewall script is using the default policy DROP
>EVERYTHING, in order to get all the services working you need to
>adjust the
># "Standard Settings".
># - IPTABLES="/usr/sbin/iptables" => This defines the path where
>your "iptables" executable is. You can find it by using "whereis
>iptables"
># - INT_IF="eth0" => Change "eth0" to the name of your INTERNAL
>NIC (Network Interface Card) eg: "eth0" "eth1" "eth2"
># - BROADCAST="192.168.3.255/24" => Change the IP to the
>BROADCAST address of your network. eg: "192.168.0.255/24"
>"192.168.1.255/24"
># - EXT_IF="ppp0" => This is you EXTERNAL INTERFACE, if you use
>dial up it is "ppp0", if you use broadband it is one of your
>Ethernets.
># - FORWARD_PORTS_1="22,80" => These are the ports which will be
>FORWARDED from your INTERNAL INTERFACE to your EXTERNAL INTERFACE
>(maximum 15 ports)
># - FORWARD_PORTS_2="194,443" => Same as above, this is just
>here if you need more than 15 ports (To prevent error messages
>you should enter at least one port in here)
># - TCP_SERVICES_IN_INT_IF="6" => Server ports you want to
>export to your LOCAL NETWORK. (To prevent error messages enter at
>least one value, port 6 is Unassigned)
># - TCP_SERVICES_IN_EXT_IF="80" => Server ports you want to
>export to your EXTERNAL INTERFACE (Internet). (To prevent error
>messages enter at least one value, port 6 is Unassigned)
># - TCP_SERVICES_OUT_INT_IF="22,80" => If you want to access
>ports from the machine where you install the firewall INSIDE your
>network you need to specify the ports. (To prevent error messages
>enter at least one value, port 6 is Unassigned)
># - TCP_SERVICES_OUT_EXT_IF="22,80" => Ports you want to connect
>to OUTSIDE your local network from the machine where the firewall
>is installed. (To prevent error messages enter at least one
>value, port 6 is Unassigned)
># - NAMESERVER_1="XXX.XXX.XXX.XXX" => The IP of your EXTERNAL
>DNS1/NAMESERVER (you can get the IP from your ISP)
># - NAMESERVER_2="XXX.XXX.XXX.XXX" => The IP of your EXTERNAL
>DNS2/NAMESERVER (you can get the IP from your ISP)
># - LOOPBACK="127.0.0.0/8" => This is your loopback IP, don't
>change this unless you know what you are doing
># - CLASS_A="10.0.0.0/8" => This will block a /8 (Class A) IP
>coming in through your EXTERNAL interface, because it will be
>spoofed.
># - CLASS_B="172.16.0.0/16" => This will block a /16 (Class B)
>IP coming in through your EXTERNAL interface, because it will be
>spoofed.
># - CLASS_C="192.168.0.0/16" => This will block a /24 (Class C)
>IP coming in through your EXTERNAL interface, because it will be
>spoofed.
># - XSERVER_PORTS="6000:6063" => Most X servers listen at these
>ports, this will block the specified ports
># - ICQ_PORT_TCP="5190" => This is the default port where ICQ
>connects to the ICQ network
># - ICQ_PORT_UDP="4000" => This is the default port where ICQ
>connects to the ICQ network
># - TROJAN_PORTS_TCP="12345,12346" => This will block INCOMING
>requests for Trojans on your Network tcp. You can add more ports
>(max 15 ports) or use port 6 to disable this feature.
># - TROJAN_PORTS_UDP="27444,31335" => This will block INCOMING
>requests for Trojans on your Network udp. You can add more ports
>(max 15 ports) or use port 6 to disable this feature.
>#
>#
>##########
># Standard Settings
>IPTABLES="/usr/sbin/iptables"
>INT_IF="eth0"
>BROADCAST="192.168.1.255/24"
>EXT_IF="ppp0"
>FORWARD_PORTS_1="20,21,22,23,25,79,80,81,110,119"
>FORWARD_PORTS_2="194,443"
>TCP_SERVICES_IN_INT_IF="22,80"
>TCP_SERVICES_IN_EXT_IF="80"
>TCP_SERVICES_OUT_INT_IF="22,80"
>TCP_SERVICES_OUT_EXT_IF="21,22,80,119"
>NAMESERVER_1="207.217.126.81"
>NAMESERVER_2="207.217.77.82"
>LOOPBACK="127.0.0.0/8"
>CLASS_A="10.0.0.0/8"
>CLASS_B="172.16.0.0/16"
>CLASS_C="192.168.0.0/16"
>UP_PORTS="1024:65535"
>XSERVER_PORTS="6000:6063"
>ICQ_PORT_TCP="5190"
>ICQ_PORT_UDP="4000"
>TROJAN_PORTS_TCP="12345,12346,1524,27665,31337"
>TROJAN_PORTS_UDP="12345,12346,27444,31335,31337"
>#
>#
>echo "Starting Firewall ....."
># Load appropriate modules.
>modprobe ip_tables
>modprobe ip_conntrack
>modprobe ip_conntrack_ftp
>#
>##########
># Flush Rules
>$IPTABLES -F
>$IPTABLES -X
>$IPTABLES -Z
>$IPTABLES -F INPUT
>$IPTABLES -F FORWARD
>$IPTABLES -F OUTPUT
>$IPTABLES -t nat -F PREROUTING
>$IPTABLES -t nat -F POSTROUTING
>#
>#
>##########
># Changing Kernel Parameters, you need CONFIG_SYSCTL defined in
>your kernel
>#
># SYN Cookie Protection
>/bin/echo "1" > /proc/sys/net/ipv4/tcp_syncookies
>
># Disable response to ping
>/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
>
># Disable response to broadcasts
>/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
>
># Don't accept source routed packets
>/bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
>/bin/echo "0" > /proc/sys/net/ipv4/conf/all/send_redirects
>
># Disable ICMP redirect acceptance
>/bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
>
># Enable bad error message protection
>/bin/echo "1" >
>/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
>
># Turn on reverse path filtering
>for interface in /proc/sys/net/ipv4/conf/*/rp_filter; do
>/bin/echo "1" > ${interface}
>done
>
># Log spoofed packets, source routed packets, redirect packets
>/bin/echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
>
># Enable IP forwarding
>echo "1" > /proc/sys/net/ipv4/ip_forward
>#
>#
>##########
># Rules
>#
># Standard Rules
>$IPTABLES -P INPUT DROP
>$IPTABLES -P FORWARD DROP
>$IPTABLES -P OUTPUT DROP
>#
># Deny packets claiming to be to or from a /8,/16,/24 (Class
>A,B,C) Network ($EXT_IF)
>$IPTABLES -A INPUT -i $EXT_IF -s $CLASS_A -j DROP
>$IPTABLES -A INPUT -i $EXT_IF -d $CLASS_A -j DROP
>$IPTABLES -A INPUT -i $EXT_IF -s $CLASS_B -j DROP
>$IPTABLES -A INPUT -i $EXT_IF -d $CLASS_B -j DROP
>$IPTABLES -A INPUT -i $EXT_IF -s $CLASS_C -j DROP
>$IPTABLES -A INPUT -i $EXT_IF -d $CLASS_C -j DROP
>$IPTABLES -A OUTPUT -o $EXT_IF -s $CLASS_A -j DROP
>$IPTABLES -A OUTPUT -o $EXT_IF -d $CLASS_A -j DROP
>$IPTABLES -A OUTPUT -o $EXT_IF -s $CLASS_B -j DROP
>$IPTABLES -A OUTPUT -o $EXT_IF -d $CLASS_B -j DROP
>$IPTABLES -A OUTPUT -o $EXT_IF -s $CLASS_C -j DROP
>$IPTABLES -A OUTPUT -o $EXT_IF -d $CLASS_C -j DROP
>#
># Firewall syn/flood and port scanner protection $INT_IF
>$IPTABLES -N syn-flood_INT_IF
>$IPTABLES -F syn-flood_INT_IF
>$IPTABLES -A INPUT -i $INT_IF -p tcp --tcp-flags SYN,ACK,FIN,RST
>RST -j syn-flood_INT_IF
>#$IPTABLES -A INPUT -i $INT_IF -p tcp --syn -j syn-flood_INT_IF
>$IPTABLES -A syn-flood_INT_IF -m limit --limit 1/s --limit-burst
>4 -j RETURN
>$IPTABLES -A syn-flood_INT_IF -j DROP
>#
># Firewall syn/flood and port scanner protection $EXT_IF
>$IPTABLES -N syn-flood_EXT_IF
>$IPTABLES -F syn-flood_EXT_IF
>$IPTABLES -A INPUT -i $EXT_IF -p tcp --tcp-flags SYN,ACK,FIN,RST
>RST -j syn-flood_EXT_IF
>#$IPTABLES -A INPUT -i $EXT_IF -p tcp --syn -j syn-flood_EXT_IF
>$IPTABLES -A syn-flood_EXT_IF -m limit --limit 1/s --limit-burst
>4 -j RETURN
>$IPTABLES -A syn-flood_EXT_IF -j DROP
>#
># Make sure NEW tcp connections are SYN packets
>$IPTABLES -A INPUT -i $INT_IF -p tcp ! --syn -m state --state NEW
>-j DROP
>$IPTABLES -A INPUT -i $EXT_IF -p tcp ! --syn -m state --state NEW
>-j DROP
>#
># Block incoming fragments $INT_IF
>$IPTABLES -A INPUT -i $INT_IF -f -j LOG --log-prefix "IPTABLES
>FRAGMENTS $INT_IF: "
>$IPTABLES -A INPUT -i $INT_IF -f -j DROP
>#
># Block incoming fragments $EXT_IF
>$IPTABLES -A INPUT -i $EXT_IF -f -j LOG --log-prefix "IPTABLES
>FRAGMENTS $EXT_IF: "
>$IPTABLES -A INPUT -i $EXT_IF -f -j DROP
>#
># Drop broadcast packets
>$IPTABLES -A INPUT -i $EXT_IF -d $BROADCAST -j DROP
>#
># Trojan protection
>$IPTABLES -A INPUT -i $INT_IF -p tcp -m multiport --dport
>$TROJAN_PORTS_TCP -j LOG --log-prefix "IPTABLES Trojan INT_IF:
>"
>$IPTABLES -A INPUT -i $INT_IF -p udp -m multiport --dport
>$TROJAN_PORTS_UDP -j LOG --log-prefix "IPTABLES Trojan INT_IF:
>"
>$IPTABLES -A INPUT -i $INT_IF -p tcp -m multiport --dport
>$TROJAN_PORTS_TCP -j DROP
>$IPTABLES -A INPUT -i $INT_IF -p udp -m multiport --dport
>$TROJAN_PORTS_UDP -j DROP
>$IPTABLES -A INPUT -i $EXT_IF -p tcp -m multiport --dport
>$TROJAN_PORTS_TCP -j LOG --log-prefix "IPTABLES Trojan EXT_IF:
>"
>$IPTABLES -A INPUT -i $EXT_IF -p udp -m multiport --dport
>$TROJAN_PORTS_UDP -j LOG --log-prefix "IPTABLES Trojan EXT_IF:
>"
>$IPTABLES -A INPUT -i $EXT_IF -p tcp -m multiport --dport
>$TROJAN_PORTS_TCP -j DROP
>$IPTABLES -A INPUT -i $EXT_IF -p udp -m multiport --dport
>$TROJAN_PORTS_UDP -j DROP
>#
># ICQ INPUT/OUTPUT rules (I get the error message that the
>hostname is not found, if somebody knows why PLZ let me know)
>#$IPTABLES -A OUTPUT -o $EXT_IF -p udp -d icq.mirabilis.com
>--dport $ICQ_PORT_UDP -m state --state NEW,ESTABLISHED,RELATED -j
>ACCEPT
>#$IPTABLES -A OUTPUT -o $EXT_IF -p tcp -d login.icq.com --dport
>$ICQ_PORT_TCP -m state --state NEW,ESTABLISHED,RELATED -j
>ACCEPT
>#
># icmp INPUT/OUTPUT rules $INT_IF. For a list of icmp types check
>the end of this file.
>$IPTABLES -A INPUT -i $INT_IF -p icmp -m state --state
>ESTABLISHED,RELATED -j ACCEPT
>$IPTABLES -A OUTPUT -o $INT_IF -p icmp -m state --state
>NEW,ESTABLISHED,RELATED -j ACCEPT
>#$IPTABLES -A INPUT -i $INT_IF -p icmp --icmp-type 0 -j DROP
>#
># icmp INPUT/OUTPUT rules $EXT_IF. For a list of icmp types check
>the end of this file.
>$IPTABLES -A INPUT -i $EXT_IF -p icmp -m state --state
>ESTABLISHED,RELATED -j ACCEPT
>$IPTABLES -A OUTPUT -o $EXT_IF -p icmp -m state --state
>NEW,ESTABLISHED,RELATED -j ACCEPT
>#$IPTABLES -A INPUT -i $EXT_IF -p icmp --icmp-type 0 -j DROP
>#
># Nameserver INPUT/OUTPUT
>$IPTABLES -A INPUT -i $EXT_IF -p udp -s $NAMESERVER_1 -m state
>--state ESTABLISHED -j ACCEPT
>$IPTABLES -A INPUT -i $EXT_IF -p udp -s $NAMESERVER_2 -m state
>--state ESTABLISHED -j ACCEPT
>$IPTABLES -A OUTPUT -o $EXT_IF -p udp -d $NAMESERVER_1 --dport 53
>-m state --state NEW,ESTABLISHED -j ACCEPT
>$IPTABLES -A OUTPUT -o $EXT_IF -p udp -d $NAMESERVER_2 --dport 53
>-m state --state NEW,ESTABLISHED -j ACCEPT
>#
># INPUT
>$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j
>ACCEPT
>$IPTABLES -A INPUT -i lo -m state --state NEW,ESTABLISHED,RELATED
>-j ACCEPT
>$IPTABLES -A INPUT -i $INT_IF -p tcp -m multiport --dport
>$TCP_SERVICES_IN_INT_IF -m state --state NEW,ESTABLISHED -j
>ACCEPT
>$IPTABLES -A INPUT -i $EXT_IF -p tcp -m multiport --dport
>$TCP_SERVICES_IN_EXT_IF -m state --state NEW,ESTABLISHED -j
>ACCEPT
>
>#$IPTABLES -A INPUT -i $EXT_IF -p tcp --sport 21 -m state
>--state ESTABLISHED -j ACCEPT
>$IPTABLES -A INPUT -i $EXT_IF -p tcp --sport 20 -m state --state
>NEW,ESTABLISHED,RELATED -j ACCEPT
>$IPTABLES -A INPUT -i $EXT_IF -p tcp --sport $UP_PORTS --dport
>$UP_PORTS -m state --state ESTABLISHED -j ACCEPT
>
>#
># FORWARD
>$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p icmp -m state
>--state NEW,ESTABLISHED -j ACCEPT
>$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p udp -d
>$NAMESERVER_1 --dport 53 -m state --state NEW,ESTABLISHED -j
>ACCEPT
>$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p udp -d
>$NAMESERVER_2 --dport 53 -m state --state NEW,ESTABLISHED -j
>ACCEPT
>$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p tcp -m multiport
>--dport $FORWARD_PORTS_1 -m state --state NEW,ESTABLISHED -j
>ACCEPT
>$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p udp -m multiport
>--dport $FORWARD_PORTS_1 -m state --state NEW,ESTABLISHED -j
>ACCEPT
>$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p tcp -m multiport
>--dport $FORWARD_PORTS_2 -m state --state NEW,ESTABLISHED -j
>ACCEPT
>$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p udp -m multiport
>--dport $FORWARD_PORTS_2 -m state --state NEW,ESTABLISHED -j
>ACCEPT
>$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p udp -d
>icq.mirabilis.com --dport $ICQ_PORT_UDP -m state --state
>NEW,ESTABLISHED,RELATED -j ACCEPT
>$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p tcp -d
>login.icq.com --dport $ICQ_PORT_TCP -m state --state
>NEW,ESTABLISHED,RELATED -j ACCEPT
>$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p tcp --dport 20 -m
>state --state ESTABLISHED -j ACCEPT
>$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -p tcp --sport
>$UP_PORTS --dport $UP_PORTS -m state --state ESTABLISHED,RELATED
>-j ACCEPT
>#$IPTABLES -A FORWARD -i $EXT_IF -o $INT_IF -p tcp --sport 21 -m
>state --state ESTABLISHED -j ACCEPT
>#$IPTABLES -A FORWARD -i $EXT_IF -o $INT_IF -p tcp --sport 20 -m
>state --state ESTABLISHED,RELATED -j ACCEPT
>$IPTABLES -A FORWARD -i $EXT_IF -o $INT_IF -m state --state
>ESTABLISHED,RELATED -j ACCEPT
>#
># OUTPUT
>$IPTABLES -A OUTPUT -o $EXT_IF -m state --state
>ESTABLISHED,RELATED -j ACCEPT
>$IPTABLES -A OUTPUT -o lo -m state --state
>NEW,ESTABLISHED,RELATED -j ACCEPT
>$IPTABLES -A OUTPUT -o $INT_IF -p tcp -m multiport --sport
>$TCP_SERVICES_IN_INT_IF -m state --state NEW,ESTABLISHED -j
>ACCEPT
>$IPTABLES -A OUTPUT -o $EXT_IF -p tcp -m multiport --sport
>$TCP_SERVICES_IN_EXT_IF -m state --state NEW,ESTABLISHED -j
>ACCEPT
>$IPTABLES -A OUTPUT -o $INT_IF -p tcp -m multiport --dport
>$TCP_SERVICES_OUT_INT_IF -m state --state NEW,ESTABLISHED -j
>ACCEPT
>$IPTABLES -A OUTPUT -o $EXT_IF -p tcp -m multiport --dport
>$TCP_SERVICES_OUT_EXT_IF -m state --state NEW,ESTABLISHED -j
>ACCEPT
>
>$IPTABLES -A OUTPUT -o $EXT_IF -p tcp --dport 20 -m state --state
>NEW,ESTABLISHED,RELATED -j ACCEPT
>$IPTABLES -A OUTPUT -o $EXT_IF -p tcp --sport $UP_PORTS --dport
>$UP_PORTS -m state --state ESTABLISHED,RELATED -j ACCEPT
>#
># POSTROUTING
>$IPTABLES -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE
>
>##########
># icmp types
>#
># 0 Echo Reply [RFC792]
># 1 Unassigned [JBP]
># 2 Unassigned [JBP]
># 3 Destination Unreachable [RFC792]
># 4 Source Quench [RFC792]
># 5 Redirect [RFC792]
># 6 Alternate Host Address [JBP]
># 7 Unassigned [JBP]
># 8 Echo [RFC792]
># 9 Router Advertisement [RFC1256]
># 10 Router Solicitation [RFC1256]
># 11 Time Exceeded [RFC792]
># 12 Parameter Problem [RFC792]
># 13 Timestamp [RFC792]
># 14 Timestamp Reply [RFC792]
># 15 Information Request [RFC792]
># 16 Information Reply [RFC792]
># 17 Address Mask Request [RFC950]
># 18 Address Mask Reply [RFC950]
># 19 Reserved (for Security) [Solo]
># 20-29 Reserved (for Robustness Experiment) [ZSu]
># 30 Traceroute [RFC1393]
># 31 Datagram Conversion Error [RFC1475]
># 32 Mobile Host Redirect [David Johnson]
># 33 IPv6 Where-Are-You [Bill Simpson]
># 34 IPv6 I-Am-Here [Bill Simpson]
># 35 Mobile Registration Request [Bill Simpson]
># 36 Mobile Registration Reply [Bill Simpson]
># 37 Domain Name Request [Simpson]
># 38 Domain Name Reply [Simpson]
># 39 SKIP [Markson]
># 40 Photuris [Simpson]
># 41-255 Reserved [JBP]
>##########
>echo "Firewall STARTED"
>### END ###
>
>#iptables -t nat -A PREROUTING --dport <the listening port of
>internal host> -i <outer iface(eth0 for you)> -j DNAT --to
>#iptables -t nat -A PREROUTING -p tcp -i (inet iface) --dport 80
>-j DNAT --to-destination xxx.xxx.xxx.xxx:80
>#iptables -t filter -A FORWARD -p tcp -d xxx.xxx.xxx.xxx --dport
>80 -j ACCEPT
>#iptables -A OUTPUT -o $IFACE -p icmp -m state --state
>NEW,ESTABLISHED,RELATED -j ACCEPT
>#iptables -A INPUT -i $IFACE -p icmp -m state --state
>ESTABLISHED,RELATED -j ACCEPT
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>----------
>+++++
>Contributed by vogt@hansenet.com
>+++++
>
>#! /bin/sh
>#
># firewall setting up IPTables firewalling
># this is a debian startscript
>(/etc/init.d/firewall)
># other distributions may need slight
>modifications
>#
>
>IPTABLES="/sbin/iptables"
>
>set -e
>
>case "$1" in
> start)
> echo "Starting firewall: "
> modprobe ip_conntrack
> echo -n "setting default policy: "
> # syncookies and NO ip-forwarding
> echo 1 > /proc/sys/net/ipv4/tcp_syncookies
> echo 0 > /proc/sys/net/ipv4/ip_forward
> $IPTABLES -F
> $IPTABLES -X
> $IPTABLES -Z
> $IPTABLES -P INPUT DROP
> $IPTABLES -P FORWARD DROP
> $IPTABLES -P OUTPUT DROP
> $IPTABLES -N in_icmp
> $IPTABLES -N in_tcp
> $IPTABLES -N in_udp
> $IPTABLES -A INPUT -p tcp -j in_tcp
> $IPTABLES -A INPUT -p udp -j in_udp
> $IPTABLES -A INPUT -p icmp -j in_icmp
> echo "done"
> echo -n "spoofing, redirect and broadcast protection/logging:
>"
> echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
> echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
> echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
> echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
> echo "done"
> echo -n "enabling scan detection: "
> if [ -f /lib/modules/`uname
>-r`/kernel/net/ipv4/netfilter/ipt_psd.o ];
>then
> $IPTABLES -A INPUT -m psd -m limit --limit 5/minute -j LOG
>--log-prefix '#### Port Scan ####'
> echo "psd enabled"
> else
> $IPTABLES -A INPUT -p icmp --icmp-type echo-request -m limit
>--limit 5/minute -j LOG --log-prefix '#### Ping Scan ####'
> # high rate for stealth scans, since they could be
>legitimate connection
> # attempts as well
> $IPTABLES -A in_tcp -p tcp --tcp-flags SYN,ACK,FIN,RST RST
>-m limit --limit 1/s --limit-burst 5 -j LOG --log-level info
>--log-prefix
>'#### Stealth Scan ####'
> $IPTABLES -A in_tcp -p tcp --tcp-flags ALL FIN,URG,PSH -m
>limit --limit 5/m -j LOG --log-level info --log-prefix '#### XMAS
>Scan ####'
> $IPTABLES -A in_tcp -p tcp --tcp-flags SYN,RST SYN,RST -m
>limit --limit 5/m -j LOG --log-level info --log-prefix '####
>SYN/RST Scan
>####'
> $IPTABLES -A in_tcp -p tcp --tcp-flags SYN,FIN SYN,FIN -m
>limit --limit 5/m -j LOG --log-level info --log-prefix '####
>SYN/FIN Scan
>####'
> echo "limited detection enabled (no ipt_psd module)"
> fi
> echo -n "flood, fragment and various other protections: "
> # we allow 4 TCP connects per second, no more
> $IPTABLES -N syn-flood
> $IPTABLES -A INPUT -p tcp --syn -j syn-flood
> $IPTABLES -A syn-flood -m limit --limit 1/s --limit-burst 4
>-j
>RETURN
> $IPTABLES -A syn-flood -j DROP
> # new connections that have no syn set are most probably evil
> $IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j
>DROP
> # invalid packets
> $IPTABLES -A INPUT -p tcp -m state --state INVALID -m limit
>--limit
>10/m -j LOG --log-level info --log-prefix "### Invalid Packet
>###"
> $IPTABLES -A INPUT -p tcp --tcp-option 64 -m limit --limit
>5/m -j LOG
>--log-level info --log-prefix "### Bad TCP FLAG(64) ###"
> $IPTABLES -A INPUT -p tcp --tcp-option 128 -m limit --limit
>5/m -j LOG
>--log-level info --log-prefix "### Bad TCP FLAG(128) ###"
> echo "done"
> echo -n "setting up ICMP: "
> # we allow echo requests and replies
> # could limit replies to could limit replies to related, but
>since we
> # answer ping requests, where would be the point in that?
> $IPTABLES -A in_icmp -p icmp --icmp-type 0 -j ACCEPT
> $IPTABLES -A in_icmp -p icmp --icmp-type 8 -j ACCEPT
> # we need destination unreachable
> $IPTABLES -A in_icmp -p icmp --icmp-type 3 -j ACCEPT
> # we are nice and allow traceroute, though it is not
>required
> $IPTABLES -A in_icmp -p icmp --icmp-type 11 -j ACCEPT
> $IPTABLES -A in_icmp -p icmp --icmp-type 30 -j ACCEPT
> echo "done"
> echo -n "enabling local and outgoing traffic: "
> $IPTABLES -A INPUT -i lo -j ACCEPT
> $IPTABLES -I in_tcp -p tcp --dport 1024:65535 -m state
>--state
>ESTABLISHED,RELATED -j ACCEPT
> $IPTABLES -A OUTPUT -j ACCEPT
> # we are nice and reject instead of drop ident traffic
> $IPTABLES -I in_tcp -p tcp --dport auth --j REJECT
> echo "done"
> echo -n "enabling selected services:"
> $IPTABLES -I in_tcp -p tcp --dport http -m state --state
>NEW,ESTABLISHED
>-j ACCEPT
> echo -n " http"
> $IPTABLES -I in_tcp -p tcp --dport ssh -m state --state
>NEW,ESTABLISHED -j ACCEPT
> echo -n " ssh"
> $IPTABLES -I in_tcp -p tcp --dport smtp -m state --state
>NEW,ESTABLISHED -j ACCEPT
> echo -n " smtp"
> $IPTABLES -I in_tcp -p tcp --dport imaps -m state --state
>NEW,ESTABLISHED -j ACCEPT
> echo -n " imaps"
> $IPTABLES -I in_tcp -p tcp --dport domain -m state --state
>NEW,ESTABLISHED -j ACCEPT
> $IPTABLES -I in_udp -p udp --dport domain -m state --state
>NEW,ESTABLISHED -j ACCEPT
> echo -n " dns"
> $IPTABLES -I in_tcp -p tcp --dport ftp -m state --state
>NEW,ESTABLISHED -j ACCEPT
> # active ftp
> $IPTABLES -I in_tcp -p tcp --dport ftp-data -m state --state
>ESTABLISHED,RELATED -j ACCEPT
> echo -n " ftp"
> # quake3
> $IPTABLES -I in_udp -p udp --dport 1024:65535 -j ACCEPT
> echo -n " quake (all UDP >1024)"
> echo " - all done"
> echo "Firewall setup complete."
> ;;
> stop)
> echo -n "Shutting down firewall: "
> $IPTABLES -F
> $IPTABLES -X
> $IPTABLES -P INPUT ACCEPT
> $IPTABLES -P FORWARD ACCEPT
> $IPTABLES -P OUTPUT ACCEPT
> echo "done"
> ;;
> *)
> N=/etc/init.d/$NAME
> echo "Usage: $N {start|stop}" >&2
> exit 1
> ;;
>esac
>
>exit 0
>
>
>
>
>
>
>
>
>
>
>
>
>
>--
>GEORGE GEORGALIS, System Admin/Architect cell: 347-451-8229
>Security Services, Web, Mail,
>mailto:george@galis.org
>File, Print, DB and DNS Servers.
>http://www.galis.org/george
>
>
_________________________________________________________
There is always a better job for you at Monsterindia.com.
Go now http://monsterindia.com/rediffin/
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: Re: need help in rate limiting tcp-syn !!
@ 2002-06-29 23:21 ganesh kumar godavari
0 siblings, 0 replies; 2+ messages in thread
From: ganesh kumar godavari @ 2002-06-29 23:21 UTC (permalink / raw)
To: Antony Stone; +Cc: netfilter
hello anthony,
can u please tell me how i can limit the # of packets from a
tcp-syn flood and portscan from a particular ip(say a.b.c.d) from
all kinds of attack if possible.
i badly need this i am currently performing some tests on DDOS and
i need to figure this out. in a DDOS attack i want to limit the #
of packets from a group of attack clients. i have to dynamically
add the ip address and limit the # of packets from incomming
attack clients.
can u please tell me how i can succefully protect my machine from
a single attack client incase of 1) portscan and 2) tcp-syn
flood.
Thanks for the help
---
ganesh
On Sun, 30 Jun 2002 Antony Stone wrote :
>On Saturday 29 June 2002 9:56 pm, ganesh kumar godavari wrote:
>
> > hello group,
> > i have attached my shell code to limit the ping-icmp and
> > tcp-syn and tcp-portscan protection. i need some help in
>this
> > matter.
> >
> > i am not able to limit the incoming tcp-syn packet and port
>scan
> > packets done using nmap.
> >
> > i used nmap -sS -O -P0 -p1-15 <host name> for port scanning,
>nmap
> > -sS -O -P0 <host name> for syn flooding.
>
> > $IPTABLES -N PORTSCANLIMIT
> > $IPTABLES -A PORTSCANLIMIT -p tcp --tcp-flags SYN,ACK,FIN,RST
>RST
> > -m limit --limit $TCPSYNLIMIT --limit-burst $TCPSYNLIMITBURST
>-j
> > ACCEPT
> > $IPTABLES -A PORTSCANLIMIT -p tcp --tcp-flags SYN,ACK,FIN,RST
>RST
> > -j DROP
> > $IPTABLES -A PORTSCANLIMIT -j RETURN
>
>You're using -sS with nmap, which sends SYN packets, but your
>portscanlimit
>rule is looking for packets with the RST flag set.
>
>The option "--tcp-flags SYN,ACK,FIN,RST RST" means "look at the
>flags SYN,
>ACK, FIN and RST, and match if the RST flag (only) is set".
>
>If you want to match on only the SYN flag being set, then the
>option should
>read "--tcp-flags SYN,ACK,FIN,RST SYN" (this will ignore the PSH
>and URG
>flags).
>
>If you want to match on the SYN flag being set no matter what
>other flags may
>be set as well, use "--tcp-flags SYN SYN".
>
>Remember that this is not the only way of doing a port scan with
>nmap,
>however :-)
>
>
>
>Antony.
>
_________________________________________________________
There is always a better job for you at Monsterindia.com.
Go now http://monsterindia.com/rediffin/
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2002-06-30 23:22 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2002-06-30 23:22 Re: need help in rate limiting tcp-syn !! ganesh kumar godavari
-- strict thread matches above, loose matches on Subject: below --
2002-06-29 23:21 ganesh kumar godavari
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox