ICMP, SYN, ACK flooding

ICMP, SYN, ACK flooding

[Robert Gil]

In this script for iptables i cant seem to get the icmp flood protection 
to work. Im limiting the icmp to 1/s and a burst of 4... (under ping of 
death), same goes for syn flood allthough im not quite sure how to test 
syn/ack/fin/xmas flooding. And how can i go about closing all ports to 
syn packets except the ones listed so i dont have the responding. 
Perhaps i have some things in the wrong order. Any help would be great.
                                                                        
              ~Rob Gil
#######################################################
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

iptables -A INPUT -j ACCEPT -p tcp --dport 21
iptables -A INPUT -j ACCEPT -p tcp --dport 22
iptables -A INPUT -j ACCEPT -p tcp --dport 25
iptables -A INPUT -j ACCEPT -p tcp --dport 80
iptables -A INPUT -j ACCEPT -p tcp --dport 110
iptables -A INPUT -j ACCEPT -p tcp --dport 443

iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

# Flood Protection
# SYN
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
                                                                                                      

# Port Scan
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit \
--limit 1/s  -j ACCEPT
                                                                                                      

# Ping Of Death
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 
1/s \ --limit-burst 4 -j ACCEPT

#ICMP REQ (ECHO)
#iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
                                                                                

#ICMP REP (ECHO)
#iptables -A INPUT -i eth0 -p icmp --icmp-type echo-reply -j ACCEPT

# Refuse Loopback From Outside
iptables -A INPUT -i eth0 -d 127.0.0.0/8 -j DROP
# Kill Fragments
#iptables -A INPUT -i eth0 -f -j LOG --log-level debug --log-prefix 
"IPTABLES \ FRAGMENTS: "
iptables -A INPUT -i eth0 -f -j DROP

echo 1 > /proc/sys/net/ipv4/ip_forward

Re: ICMP, SYN, ACK flooding

[Antony Stone]

On Friday 05 December 2003 10:11 pm, Robert Gil wrote:

> In this script for iptables i cant seem to get the icmp flood protection
> to work. Im limiting the icmp to 1/s and a burst of 4... (under ping of
> death), same goes for syn flood allthough im not quite sure how to test
> syn/ack/fin/xmas flooding. And how can i go about closing all ports to
> syn packets except the ones listed so i dont have the responding.
> Perhaps i have some things in the wrong order. Any help would be great.

What is the machine which this script is running on supposed to do?

You have a strange mixture of mostly INPUT rules, with just a single FORWARD 
rule, so I wonder whether you are trying to use netfilter to protect the 
machine itself, or whether it is a Firewall protecting other machines on a 
network?

Antony.

-- 
Perfection in design is achieved not when there is nothing left to add, but 
rather when there is nothing left to take away.

 - Antoine de Saint-Exupery

                                                     Please reply to the list;
                                                           please don't CC me.

Re: ICMP, SYN, ACK flooding

[Antony Stone]

On Friday 05 December 2003 10:21 pm, Antony Stone wrote:

> On Friday 05 December 2003 10:11 pm, Robert Gil wrote:
> > In this script for iptables i cant seem to get the icmp flood protection
> > to work. Im limiting the icmp to 1/s and a burst of 4... (under ping of
> > death), same goes for syn flood allthough im not quite sure how to test
> > syn/ack/fin/xmas flooding. And how can i go about closing all ports to
> > syn packets except the ones listed so i dont have the responding.
> > Perhaps i have some things in the wrong order. Any help would be great.
>
> What is the machine which this script is running on supposed to do?
>
> You have a strange mixture of mostly INPUT rules, with just a single
> FORWARD rule, so I wonder whether you are trying to use netfilter to
> protect the machine itself, or whether it is a Firewall protecting other
> machines on a network?

Sorry, that was inaccurate - you have more than one FORWARD rule, but it's 
still a strange mixture all the same....

Antony

-- 
In science, one tries to tell people
in such a way as to be understood by everyone
something that no-one ever knew before.

In poetry, it is the exact opposite.

 - Paul Dirac

                                                     Please reply to the list;
                                                           please don't CC me.

Re: ICMP, SYN, ACK flooding

[Jeffrey Laramie]

On Friday 05 December 2003 17:11, Robert Gil wrote:
> In this script for iptables i cant seem to get the icmp flood protection
> to work. Im limiting the icmp to 1/s and a burst of 4... (under ping of
> death), same goes for syn flood allthough im not quite sure how to test
> syn/ack/fin/xmas flooding. And how can i go about closing all ports to
> syn packets except the ones listed so i dont have the responding.
> Perhaps i have some things in the wrong order. Any help would be great.
>
>               ~Rob Gil
> #######################################################
> iptables -P INPUT DROP
> iptables -P FORWARD DROP
> iptables -P OUTPUT ACCEPT
>
> iptables -A INPUT -j ACCEPT -p tcp --dport 21
> iptables -A INPUT -j ACCEPT -p tcp --dport 22
> iptables -A INPUT -j ACCEPT -p tcp --dport 25
> iptables -A INPUT -j ACCEPT -p tcp --dport 80
> iptables -A INPUT -j ACCEPT -p tcp --dport 110
> iptables -A INPUT -j ACCEPT -p tcp --dport 443
>
> iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A INPUT -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
>

As a general rule it's good to have the ESTABLISHED, RELATED rule ahead of the 
generic ACCEPT rules since they will catch most of your packets.

Jeff