Re: stop accepting new connections on port 80

["Bill Hance" <bill@billhance.com>]

what about entering a new rule, immediately before the one saying

-dport 80 -m state --state NEW -j ACCEPT

the new one would be

-dport 80 -m state --state NEW -j DROP


that would drop the new connections before they got to the rule that
accepts them

and it shouldn't effect establish/related or connection tracking

  -Bill




> Hi,
>
> I've been trying to figure out how to get iptables to stop accepting new
> connections on port 80 while letting the existing connections finish up
> what they're doing.
>
> I thought it would be as easy as removing the rule that allows new
> connections and leaving the rule that allowed related and established
> connections, but when I remove the rule that allows new connections, all
> connections stop working.
>
> I tried variations with the rule, like changing NEW to ESTABLISHED and the
> such, but no luck...
>
> I was working on this during off hours when the web server only had maybe
> 5 or 6 active connections, so I'm not sure if the connection tracking
> module is the problem or if its what I'm doing.  I know the following
> rules aren't the greatest, but we're behind a firewall and use host based
> firewalls as just another security measure.
>
> This is all on stock RHEL4 kernels and packages - but I tested with gentoo
> on 2.6.13 and had the same issues.
>
> hopefully I've included enough info to help you help me :)
>
> Thanks,
>
> Mike
>
>
> ####### script to edit iptables rules
> #!/bin/bash
> # stop accepting new connections..
>
> # this is the default chain on the web servers.
> chain="RH-Firewall-1-INPUT"
>
> case $1 in
> start)
>     # umm, yeah, start to stop accepting new connections
>     echo "removing iptables rule for new connections on port 80"
>     line=`iptables -nL --line-numbers | awk '$10 ~ /dpt:80/ {print $1}'`
>     iptables -D RH-Firewall-1-INPUT $line
> ;;
>
> stop)
>     # re-add deleted chain to accept new connections
>     echo "now allowing connections"
>     # inserting it on line 6 because thats where it is when iptables
> starts after a reboot
>     iptables -I $chain 6 -p tcp -m state --state NEW -m tcp --dport 80 -j
> ACCEPT
> ;;
> esac
>
> ####### end script
>
> #### system info
> [root@www16 ~]# cat /etc/redhat-release
> Red Hat Enterprise Linux AS release 4 (Nahant Update 2)
> [root@www16 ~]# uname -a
> Linux www16 2.6.9-22.ELsmp #1 SMP Mon Sep 19 18:32:14 EDT 2005 i686 i686
> i386 GNU/Linux
>
> [root@www16 ~]# iptables -nL --line-numbers
> Chain INPUT (policy ACCEPT)
> num  target     prot opt source               destination
> 1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0
>
> Chain FORWARD (policy ACCEPT)
> num  target     prot opt source               destination
> 1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0
>
> Chain OUTPUT (policy ACCEPT)
> num  target     prot opt source               destination
>
> Chain RH-Firewall-1-INPUT (2 references)
> num  target     prot opt source               destination
> 1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
> 2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp
> type 255
> 3    ACCEPT     esp  --  0.0.0.0/0            0.0.0.0/0
> 4    ACCEPT     ah   --  0.0.0.0/0            0.0.0.0/0
> 5    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state
> RELATED,ESTABLISHED
> 6    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state
> NEW tcp dpt:80
> 7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state
> NEW tcp dpt:22
> 8    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state
> NEW tcp dpt:5666
> 9    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           state
> NEW udp dpt:161
> 10   REJECT     all  --  0.0.0.0/0            0.0.0.0/0
> reject-with icmp-host-prohibited
>
>
>
> [root@www16 ~]# iptables-save
> # Generated by iptables-save v1.2.11 on Wed Dec  7 12:20:25 2005
> *filter
> :INPUT ACCEPT [0:0]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [10643556:3502431634]
> :RH-Firewall-1-INPUT - [0:0]
> -A INPUT -j RH-Firewall-1-INPUT
> -A FORWARD -j RH-Firewall-1-INPUT
> -A RH-Firewall-1-INPUT -i lo -j ACCEPT
> -A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
> -A RH-Firewall-1-INPUT -p ipv6-crypt -j ACCEPT
> -A RH-Firewall-1-INPUT -p ipv6-auth -j ACCEPT
> -A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j
> ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j
> ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 5666 -j
> ACCEPT
> -A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 161 -j
> ACCEPT
> -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
> COMMIT
> # Completed on Wed Dec  7 12:20:25 2005
>
> [root@www16 ~]# iptables --version
> iptables v1.2.11
>
>