* Firewall Script Help
@ 2004-03-08 18:47 Christopher Davis
2004-03-08 18:49 ` David Cannings
2004-03-08 18:51 ` Aldo S. Lagana
0 siblings, 2 replies; 9+ messages in thread
From: Christopher Davis @ 2004-03-08 18:47 UTC (permalink / raw)
To: netfilter
Hello Netfilter Friends!
I am trying to block incoming traffic on the INPUT chain
with reserved ip's. I am still able to connect to the
server from a reserved ip. Below is my entire script if
someone would like to review and comment -- all coments
welcome! This is for a webserver -- port 80 and ssh port 22
only. I have not yet included the logging option so those
options are commented out at this point...
Thanks!
Christopher Davis
#!/bin/sh
# Assignments
IPTABLES=/sbin/iptables
BADIP="0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16
172.16.0.0/12 192.0.0.0/24 192.168.0.0/16 192.0.34.0/24
224.0.0.0/4 240.0.0.0/5 255.255.255.255"
SHUNIP=""
case "$1" in
start)
echo -n "Starting Firewall..."
# Clear Old Rules
$IPTABLES -X
$IPTABLES -F
$IPTABLES -Z
# Default policy to DROP
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
# Logging chain
$IPTABLES -N LDROP
#$IPTABLES -A LDROP -j LOG --log-prefix "IPT DROP: "
$LOGOPT
$IPTABLES -A LDROP -j DROP
$IPTABLES -N LBADIP
$IPTABLES -A LBADIP -p tcp --dport 137:139 -j DROP
$IPTABLES -A LBADIP -p udp --dport 137:139 -j DROP
#$IPTABLES -A LBADIP -j LOG --log-prefix "IPT BAD: "
$LOGOPT
$IPTABLES -A LBADIP -j DROP
$IPTABLES -N LSHUN
#$IPTABLES -A LSHUN -j LOG --log-prefix "IPT Shun: "
$LOGOPT
$IPTABLES -A LSHUN -j DROP
# Cleaning up traffic for INPUT
$IPTABLES -N BADIP
for ip in $BADIP; do
$IPTABLES -A BADIP -s $ip -j LBADIP
$IPTABLES -A BADIP -d $ip -j LBADIP
done
$IPTABLES -N SHUN
for ip in $SHUNIP; do
$IPTABLES -A SHUN -s $ip -j LSHUN
$IPTABLES -A SHUN -d $ip -j LSHUN
done
# Traffic on INPUT chain
$IPTABLES -A INPUT -m state --state INVALID -j DROP
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j
ACCEPT
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j
DROP
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j
DROP
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j
DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j
DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL
SYN,FIN,PSH,URG -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL
SYN,RST,ACK,FIN,URG -j DROP
$IPTABLES -A INPUT -s 0/0 -p tcp --destination-port 80 -j
ACCEPT
$IPTABLES -A INPUT -s 0/0 -p tcp --destination-port 22 -j
ACCEPT
$IPTABLES -A INPUT -p tcp --tcp-flags SYN SYN -j DROP
$IPTABLES -A INPUT -p tcp --syn -j DROP
$IPTABLES -A INPUT -p icmp --icmp-type
destination-unreachable -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type source-quench -j
ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type time-exceeded -j
ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type parameter-problem -j
ACCEPT
#Authorized traffic on Output
#$IPTABLES -A OUTPUT -s 66.93.253.104 -p tcp --source-port
80 -j ACCEPT
#$IPTABLES -A OUTPUT -s 66.93.253.104 -p tcp --source-port
22 -j ACCEPT
$IPTABLES -A OUTPUT -s 66.93.253.104 -j ACCEPT
echo "Done."
;;
stop)
echo -n "Stopping Firewall..."
$IPTABLES -X
$IPTABLES -F
$IPTABLES -Z
# Allow established connections only
$IPTABLES -A INPUT -i eth0 -m state --state
ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -i eth0 -j REJECT
echo "Done."
;;
restart)
echo -n "Restarting Firewall..."
$0 stop > /dev/null
sleep 1
$0 start > /dev/null
echo "Done."
;;
*)
echo "Usage: $0 {start|stop|restart"
;;
esac
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Firewall Script Help
2004-03-08 18:47 Firewall Script Help Christopher Davis
@ 2004-03-08 18:49 ` David Cannings
2004-03-08 19:19 ` Christopher Davis
2004-03-09 4:34 ` Mark E. Donaldson
2004-03-08 18:51 ` Aldo S. Lagana
1 sibling, 2 replies; 9+ messages in thread
From: David Cannings @ 2004-03-08 18:49 UTC (permalink / raw)
To: netfilter
On Monday 08 March 2004 18:47, Christopher Davis wrote:
> I am trying to block incoming traffic on the INPUT chain
> with reserved ip's. I am still able to connect to the
> server from a reserved ip. Below is my entire script if
> someone would like to review and comment -- all coments
> welcome! This is for a webserver -- port 80 and ssh port 22
> only. I have not yet included the logging option so those
> options are commented out at this point...
Just a quick point, it is (in my opinion at least) far easier to read your
firewall rules if they're output from iptables itself. Following through
the script is harder.
# iptables -L -v
David
^ permalink raw reply [flat|nested] 9+ messages in thread
* RE: Firewall Script Help
2004-03-08 18:47 Firewall Script Help Christopher Davis
2004-03-08 18:49 ` David Cannings
@ 2004-03-08 18:51 ` Aldo S. Lagana
1 sibling, 0 replies; 9+ messages in thread
From: Aldo S. Lagana @ 2004-03-08 18:51 UTC (permalink / raw)
To: cldavis, netfilter
I've found that blocking in the PREROUTING chain sometimes is the only way
(I know I know its bad to filter on the NAT chains, but - it works...)
-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Christopher Davis
Sent: Monday, March 08, 2004 1:47 PM
To: netfilter@lists.netfilter.org
Subject: Firewall Script Help
Hello Netfilter Friends!
I am trying to block incoming traffic on the INPUT chain
with reserved ip's. I am still able to connect to the
server from a reserved ip. Below is my entire script if
someone would like to review and comment -- all coments
welcome! This is for a webserver -- port 80 and ssh port 22
only. I have not yet included the logging option so those
options are commented out at this point...
Thanks!
Christopher Davis
#!/bin/sh
# Assignments
IPTABLES=/sbin/iptables
BADIP="0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16
172.16.0.0/12 192.0.0.0/24 192.168.0.0/16 192.0.34.0/24
224.0.0.0/4 240.0.0.0/5 255.255.255.255"
SHUNIP=""
case "$1" in
start)
echo -n "Starting Firewall..."
# Clear Old Rules
$IPTABLES -X
$IPTABLES -F
$IPTABLES -Z
# Default policy to DROP
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
# Logging chain
$IPTABLES -N LDROP
#$IPTABLES -A LDROP -j LOG --log-prefix "IPT DROP: "
$LOGOPT
$IPTABLES -A LDROP -j DROP
$IPTABLES -N LBADIP
$IPTABLES -A LBADIP -p tcp --dport 137:139 -j DROP
$IPTABLES -A LBADIP -p udp --dport 137:139 -j DROP
#$IPTABLES -A LBADIP -j LOG --log-prefix "IPT BAD: "
$LOGOPT
$IPTABLES -A LBADIP -j DROP
$IPTABLES -N LSHUN
#$IPTABLES -A LSHUN -j LOG --log-prefix "IPT Shun: "
$LOGOPT
$IPTABLES -A LSHUN -j DROP
# Cleaning up traffic for INPUT
$IPTABLES -N BADIP
for ip in $BADIP; do
$IPTABLES -A BADIP -s $ip -j LBADIP
$IPTABLES -A BADIP -d $ip -j LBADIP
done
$IPTABLES -N SHUN
for ip in $SHUNIP; do
$IPTABLES -A SHUN -s $ip -j LSHUN
$IPTABLES -A SHUN -d $ip -j LSHUN
done
# Traffic on INPUT chain
$IPTABLES -A INPUT -m state --state INVALID -j DROP
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j
ACCEPT
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j
DROP
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j
DROP
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j
DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j
DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL
SYN,FIN,PSH,URG -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL
SYN,RST,ACK,FIN,URG -j DROP
$IPTABLES -A INPUT -s 0/0 -p tcp --destination-port 80 -j
ACCEPT
$IPTABLES -A INPUT -s 0/0 -p tcp --destination-port 22 -j
ACCEPT
$IPTABLES -A INPUT -p tcp --tcp-flags SYN SYN -j DROP
$IPTABLES -A INPUT -p tcp --syn -j DROP
$IPTABLES -A INPUT -p icmp --icmp-type
destination-unreachable -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type source-quench -j
ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type time-exceeded -j
ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type parameter-problem -j
ACCEPT
#Authorized traffic on Output
#$IPTABLES -A OUTPUT -s 66.93.253.104 -p tcp --source-port
80 -j ACCEPT
#$IPTABLES -A OUTPUT -s 66.93.253.104 -p tcp --source-port
22 -j ACCEPT
$IPTABLES -A OUTPUT -s 66.93.253.104 -j ACCEPT
echo "Done."
;;
stop)
echo -n "Stopping Firewall..."
$IPTABLES -X
$IPTABLES -F
$IPTABLES -Z
# Allow established connections only
$IPTABLES -A INPUT -i eth0 -m state --state
ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -i eth0 -j REJECT
echo "Done."
;;
restart)
echo -n "Restarting Firewall..."
$0 stop > /dev/null
sleep 1
$0 start > /dev/null
echo "Done."
;;
*)
echo "Usage: $0 {start|stop|restart"
;;
esac
^ permalink raw reply [flat|nested] 9+ messages in thread
* RE: Firewall Script Help
2004-03-08 18:49 ` David Cannings
@ 2004-03-08 19:19 ` Christopher Davis
2004-03-08 20:12 ` David Cannings
2004-03-09 4:34 ` Mark E. Donaldson
1 sibling, 1 reply; 9+ messages in thread
From: Christopher Davis @ 2004-03-08 19:19 UTC (permalink / raw)
To: netfilter
David:
> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org]On
> Behalf Of David Cannings
> Sent: Monday, March 08, 2004 1:50 PM
> To: netfilter@lists.netfilter.org
> Subject: Re: Firewall Script Help
>
> Just a quick point, it is (in my opinion at
> least) far easier to read your
> firewall rules if they're output from iptables
> itself. Following through
> the script is harder.
>
> # iptables -L -v
>
> David
Here it is! If it is easier to read, I can forward indivual
txt docs with the same information -- I didn't want to
attach anything being sent to the list.
Thanks again!
Christopher Davis
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 DROP all -- any any anywhere
anywhere state INVALID
0 0 ACCEPT all -- any any anywhere
anywhere state RELATED,ESTABLISHED
0 0 ACCEPT all -- lo any anywhere
anywhere
0 0 DROP tcp -- any any anywhere
anywhere tcp flags:FIN,ACK/FIN
0 0 DROP tcp -- any any anywhere
anywhere tcp flags:PSH,ACK/PSH
0 0 DROP tcp -- any any anywhere
anywhere tcp flags:ACK,URG/URG
0 0 DROP tcp -- any any anywhere
anywhere tcp flags:FIN,RST/FIN,RST
0 0 DROP tcp -- any any anywhere
anywhere tcp flags:FIN,SYN/FIN,SYN
0 0 DROP tcp -- any any anywhere
anywhere tcp flags:SYN,RST/SYN,RST
0 0 DROP tcp -- any any anywhere
anywhere tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
0 0 DROP tcp -- any any anywhere
anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
0 0 DROP tcp -- any any anywhere
anywhere tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
0 0 DROP tcp -- any any anywhere
anywhere tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,PSH,URG
0 0 DROP tcp -- any any anywhere
anywhere tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG
0 0 ACCEPT tcp -- any any anywhere
anywhere tcp dpt:www
0 0 ACCEPT tcp -- any any anywhere
anywhere tcp dpt:ssh
0 0 DROP tcp -- any any anywhere
anywhere tcp flags:SYN/SYN
0 0 DROP tcp -- any any anywhere
anywhere tcp flags:SYN,RST,ACK/SYN
0 0 ACCEPT icmp -- any any anywhere
anywhere icmp destination-unreachable
0 0 ACCEPT icmp -- any any anywhere
anywhere icmp source-quench
0 0 ACCEPT icmp -- any any anywhere
anywhere icmp time-exceeded
0 0 ACCEPT icmp -- any any anywhere
anywhere icmp parameter-problem
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT tcp -- any any
www01.colligatedtechnologies.com anywhere tcp
spt:www
0 0 ACCEPT tcp -- any any
www01.colligatedtechnologies.com anywhere tcp
spt:ssh
1 66 ACCEPT all -- any any
www01.colligatedtechnologies.com anywhere
Chain BADIP (0 references)
pkts bytes target prot opt in out source
destination
0 0 LBADIP all -- any any 0.0.0.0/8
anywhere
0 0 LBADIP all -- any any anywhere
0.0.0.0/8
0 0 LBADIP all -- any any 10.0.0.0/8
anywhere
0 0 LBADIP all -- any any anywhere
10.0.0.0/8
0 0 LBADIP all -- any any 127.0.0.0/8
anywhere
0 0 LBADIP all -- any any anywhere
127.0.0.0/8
0 0 LBADIP all -- any any
169.254.0.0/16 anywhere
0 0 LBADIP all -- any any anywhere
169.254.0.0/16
0 0 LBADIP all -- any any 172.16.0.0/12
anywhere
0 0 LBADIP all -- any any anywhere
172.16.0.0/12
0 0 LBADIP all -- any any 192.0.0.0/24
anywhere
0 0 LBADIP all -- any any anywhere
192.0.0.0/24
0 0 LBADIP all -- any any
192.168.0.0/16 anywhere
0 0 LBADIP all -- any any anywhere
192.168.0.0/16
0 0 LBADIP all -- any any 192.0.34.0/24
anywhere
0 0 LBADIP all -- any any anywhere
192.0.34.0/24
0 0 LBADIP all -- any any
BASE-ADDRESS.MCAST.NET/4 anywhere
0 0 LBADIP all -- any any anywhere
BASE-ADDRESS.MCAST.NET/4
0 0 LBADIP all -- any any 240.0.0.0/5
anywhere
0 0 LBADIP all -- any any anywhere
240.0.0.0/5
0 0 LBADIP all -- any any
255.255.255.255 anywhere
0 0 LBADIP all -- any any anywhere
255.255.255.255
Chain LBADIP (22 references)
pkts bytes target prot opt in out source
destination
0 0 DROP tcp -- any any anywhere
anywhere tcp dpts:netbios-ns:netbios-ssn
0 0 DROP udp -- any any anywhere
anywhere udp dpts:netbios-ns:netbios-ssn
0 0 DROP all -- any any anywhere
anywhere
Chain LDROP (0 references)
pkts bytes target prot opt in out source
destination
0 0 DROP all -- any any anywhere
anywhere
Chain LSHUN (0 references)
pkts bytes target prot opt in out source
destination
0 0 DROP all -- any any anywhere
anywhere
Chain SHUN (0 references)
pkts bytes target prot opt in out source
destination
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Firewall Script Help
2004-03-08 19:19 ` Christopher Davis
@ 2004-03-08 20:12 ` David Cannings
2004-03-08 20:32 ` Antony Stone
0 siblings, 1 reply; 9+ messages in thread
From: David Cannings @ 2004-03-08 20:12 UTC (permalink / raw)
To: netfilter
On Monday 08 March 2004 19:19, Christopher Davis wrote:
> David:
> > Just a quick point, it is (in my opinion at
> > least) far easier to read your
> > firewall rules if they're output from iptables
> > itself. Following through
> > the script is harder.
> Here it is! If it is easier to read, I can forward indivual
> txt docs with the same information -- I didn't want to
> attach anything being sent to the list.
Only a few comments, your script seems fairly comprehensive.
> Chain INPUT (policy DROP 0 packets, 0 bytes)
> pkts bytes target prot opt in out source
> destination
> 0 0 DROP all -- any any anywhere
> anywhere state INVALID
> 0 0 ACCEPT all -- any any anywhere
> anywhere state RELATED,ESTABLISHED
> 0 0 ACCEPT all -- lo any anywhere
> anywhere
> 0 0 DROP tcp -- any any anywhere
> anywhere tcp flags:FIN,ACK/FIN
> 0 0 DROP tcp -- any any anywhere
As I understand it, this means "check the flags FIN and ACK, only match if
FIN is set and ACK isn't". This would match packets that only have the
FIN flag set, which I am fairly sure are valid. I may need correcting on
this issure, however.
> anywhere tcp dpt:ssh
> 0 0 DROP tcp -- any any anywhere
Do you really want anybody in the world able to connect to your SSH
server? Personally, I only allow from IP addresses ranges that I know.
If you're on DHCP on your home connection, allow the whole /24 or
even /16 address pool the IP comes from. That still leaves a few billion
hosts unable to connect to you.
I say this purely from a paranoid point of view. As soon as a remote
exploit is found in SSH malicious people can possibly take advantage of
it.
> anywhere tcp flags:SYN/SYN
> 0 0 DROP tcp -- any any anywhere
Perhaps use the NEW keyword here, it might help.
> Chain BADIP (0 references)
> pkts bytes target prot opt in out source
> destination
You don't reference this chain anywhere. Perhaps you should -I a
reference to it at the top of the INPUT and OUTPUT chains.
Blocking INVALID packets may do what you do with manual --tcp-flags
checks, as I do not know the specific internals of it. In short, it
blocks packets that aren't related to existing connections but I am
unsure whether it will also block "illegal" packets so I cannot comment.
David
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Firewall Script Help
2004-03-08 20:12 ` David Cannings
@ 2004-03-08 20:32 ` Antony Stone
0 siblings, 0 replies; 9+ messages in thread
From: Antony Stone @ 2004-03-08 20:32 UTC (permalink / raw)
To: netfilter
On Monday 08 March 2004 8:12 pm, David Cannings wrote:
> > 0 0 DROP tcp -- any any anywhere
> > anywhere tcp flags:FIN,ACK/FIN
>
> As I understand it, this means "check the flags FIN and ACK, only match if
> FIN is set and ACK isn't". This would match packets that only have the
> FIN flag set, which I am fairly sure are valid. I may need correcting on
> this issue, however.
You are correct.
TCP connections start with:
packet 1: SYN (only) from the client
packet 2: SYN/ACK from the server
packet 3: ACK from the client
all further packets have the ACK flag set from both client and server
and then they end with
packet n-3: FIN (only) from the side which wants to stop talking
packet n-2: FIN/ACK from the other side
packet n-1: FIN (only) from the other side (to confirm it will stop talking
too)
packet n: FIN/ACK from the side which ended the communication
(Although note that the final two packets are optional and often not seen,
indeed often blocked by netfilter because by that time it thinks the
connection is no longer ESTABLSIHED.)
Regards,
Antony.
--
What is this talk of "software release"?
Our software evolves and matures until it is capable of escape, leaving a
bloody trail of designers and quality assurance people in its wake.
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Firewall Script Help
@ 2004-03-08 21:14 cldavis
2004-03-08 22:06 ` Antony Stone
0 siblings, 1 reply; 9+ messages in thread
From: cldavis @ 2004-03-08 21:14 UTC (permalink / raw)
To: netfilter
Anthony:
> -----Original Message-----
> From: Antony Stone [mailto:Antony@Soft-Solutions.co.uk]
> Sent: Monday, March 8, 2004 08:32 PM
> To: netfilter@lists.netfilter.org
> Subject: Re: Firewall Script Help
>
> On Monday 08 March 2004 8:12 pm, David Cannings wrote:
>
> > > 0 0 DROP tcp -- any any anywhere
> > > anywhere tcp flags:FIN,ACK/FIN
> >
> > As I understand it, this means "check the flags FIN and ACK, only match if
> > FIN is set and ACK isn't". This would match packets that only have the
> > FIN flag set, which I am fairly sure are valid. I may need correcting on
> > this issue, however.
>
> You are correct.
>
[...]
Packets that only have the FIN flag set are valid -- but I believe would be taken care of by the ESTABLISHED,RELATED rule. The FIN FLAG rule I entered just in case someone decided to bombard my systems with FIN flag packets only...
Is that an unneeded rule to protect against a DoS attack?
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Firewall Script Help
2004-03-08 21:14 cldavis
@ 2004-03-08 22:06 ` Antony Stone
0 siblings, 0 replies; 9+ messages in thread
From: Antony Stone @ 2004-03-08 22:06 UTC (permalink / raw)
To: netfilter
On Monday 08 March 2004 9:14 pm, cldavis@speakeasy.net wrote:
> Antony:
> > >
> > > As I understand it, this means "check the flags FIN and ACK, only match
> > > if FIN is set and ACK isn't". This would match packets that only have
> > > the FIN flag set, which I am fairly sure are valid. I may need
> > > correcting on this issue, however.
> >
> > You are correct.
>
> Packets that only have the FIN flag set are valid -- but I believe would be
> taken care of by the ESTABLISHED,RELATED rule.
Yes, that's a fair point.
> The FIN FLAG rule I entered
> just in case someone decided to bombard my systems with FIN flag packets
> only... Is that an unneeded rule to protect against a DoS attack?
I'm not aware of a DoS attack using FIN flags (since no resources get used by
a system when it receives a FIN packet), however people certainly do carry
out port scans using FIN packets, and therefore I agree with you, it's
probably a sensible thing to block.
Antony.
--
Software development can be quick, high quality, or low cost.
The customer gets to pick any two out of three.
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 9+ messages in thread
* RE: Firewall Script Help
2004-03-08 18:49 ` David Cannings
2004-03-08 19:19 ` Christopher Davis
@ 2004-03-09 4:34 ` Mark E. Donaldson
1 sibling, 0 replies; 9+ messages in thread
From: Mark E. Donaldson @ 2004-03-09 4:34 UTC (permalink / raw)
To: david, netfilter
As David said "Opinion". Not all of us believe that to be the case.
-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of David Cannings
Sent: Monday, March 08, 2004 10:50 AM
To: netfilter@lists.netfilter.org
Subject: Re: Firewall Script Help
On Monday 08 March 2004 18:47, Christopher Davis wrote:
> I am trying to block incoming traffic on the INPUT chain with reserved
> ip's. I am still able to connect to the server from a reserved ip.
> Below is my entire script if someone would like to review and comment
> -- all coments welcome! This is for a webserver -- port 80 and ssh
> port 22 only. I have not yet included the logging option so those
> options are commented out at this point...
Just a quick point, it is (in my opinion at least) far easier to read your
firewall rules if they're output from iptables itself. Following through
the script is harder.
# iptables -L -v
David
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2004-03-09 4:34 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-03-08 18:47 Firewall Script Help Christopher Davis
2004-03-08 18:49 ` David Cannings
2004-03-08 19:19 ` Christopher Davis
2004-03-08 20:12 ` David Cannings
2004-03-08 20:32 ` Antony Stone
2004-03-09 4:34 ` Mark E. Donaldson
2004-03-08 18:51 ` Aldo S. Lagana
-- strict thread matches above, loose matches on Subject: below --
2004-03-08 21:14 cldavis
2004-03-08 22:06 ` Antony Stone
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox