iptables UDP problem

iptables UDP problem

[k n]

Hi,

I'm using iptables on RedHat 8 with the rules listed
below. When scanned from outside the TCP port appear
as filtered; however, the UDP port is still open.

$ip0  is my external IP address.

Am I doing something wrong?

-------------
/sbin/iptables -A INPUT -i lo -p all -j ACCEPT
/sbin/iptables -A INPUT  -p tcp -d $ip0 --dport 53  -j
DROP
/sbin/iptables -A INPUT  -p udp -d $ip0 --dport 53  -j DROP

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com

Re: iptables UDP problem

[Alexander W. Janssen]

[-- Attachment #1: Type: text/plain, Size: 1768 bytes --]

On Sat, Feb 01, 2003 at 04:11:50PM -0800, k n wrote:
> Hi,
> 
> I'm using iptables on RedHat 8 with the rules listed
> below. When scanned from outside the TCP port appear
> as filtered; however, the UDP port is still open.
> 
> $ip0  is my external IP address.
> 
> Am I doing something wrong?

that the TCP-port shows up as filtered is normal since you just DROP the
SYN-packets. If you wouldn't have a firewall and there would not be daemon
running the machine would send a tcp-reset packet and send it back to nmap.
This is interpreted as "connection refused", meaning that there is not a
server running on the tcp-port.

That UDP stuff surprises me a bit; if you send a packet to a UDP port and no
server is running the machine would generate an ICMP port-unreachable message
which should have been interpreted by nmap. But since you drop all packets to
53/udp a ICMP-message was never generated and nmap couldn't have received one.

I just tested on my machine (locally with loopback and nmap 2.54BETA22):

Nonfiltered udp-ports show up as "closed"
DROPed udp-ports show up as "open"

Maybe nmap interprets it like that "as long as i don't get any errors i threat
it like it would be open." And this sort of correct as well, since you don't
have a "real connection" like in TCP - the application has to do everything on
it's own. So that UDP-stuff doesn't surprise me anymore ;-)

Don't DROP. Send real tcp-resets for unwanted TCP-connections and send real
ICMP port-unreachable messages for unwanted UDP-connections and everything
else. Just my 2c.

HTH, Alex.

-- 
"Mr Data, when I said 'Fire at Will', I didn't mean for you to be so literal."
Instructions for use of this post: Insert tounge in cheek. Read as normal.

[-- Attachment #2: Type: application/pgp-signature, Size: 248 bytes --]

Re: iptables UDP problem

[Maciej Soltysiak]

> I'm using iptables on RedHat 8 with the rules listed
> below. When scanned from outside the TCP port appear
> as filtered; however, the UDP port is still open.
>
> $ip0  is my external IP address.
>
> Am I doing something wrong?
>
> -------------
> /sbin/iptables -A INPUT -i lo -p all -j ACCEPT
> /sbin/iptables -A INPUT  -p tcp -d $ip0 --dport 53  -j
> DROP
Scanners see this:
- the machine pings back
- some ports (eg. 80) are open and respond properly
- some other ports (eg. 53) do respond at all (DROP), normally the should
  responds TCP RESET (normal operation, or -j REJECT --reject-with tcp-reset)
= so, the port is filtered.


> /sbin/iptables -A INPUT  -p udp -d $ip0 --dport 53  -j DROP
Scanners see this:
- the machine pings back,
- i do net get a "icmp dest. unreach / port unreachable), so the port is
  open.

Solution #1
- forget about what the scanner says: and leave it so it dropps the
  packets.
  For: The scans take much more time and may iritate the scanner;
       The scanner gets much less information that can be used with OS
       fingerprinting.

Solution #2
If you want the scanners to get (closed) for everything.
- reject with tcp-resets to tcp
- reject with icmp-unreach to udp

Against: The scans are quicker, you actually send packets thus disclose
information interesting to os fingerprinting.

Regards,
Maciej Soltysiak