2 Questions--state (est, rel) and tuning

2 Questions--state (est, rel) and tuning

[Ginter, Jeff A]

Hello,

 

I am brand new to the list and couldn't find an easy way to browse the
whole archive, so my apologies if this has been discussed (as it
probably has).

 

I understand the state concepts, however, I keep seeing example iptable
scripts with the first rule in each chain being something like....ACCEPT
related and established packets.  

 

My first question is...Is that really needed?  In my other experiences
with stateful firewalls this rule is not needed because the firewall
remembers the outgoing packet and the rule is implied...or do I have
this very wrong?

 

 

My second question, which may not be totally applicable for this list
is...I have my netfilter/iptables set up on a Redhat 4 Ent WS box...are
the following parameters for hardening still useful and applicable with
the current kernel and distro?

 

net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.icmp_echo_ignore_all = 1 = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.log_martians = 1

 

 

Thanks very much for any help!

 

 

 

Jeff Ginter, CISSP

Computer Associates

Mid-Atlantic Consulting Manager

tel:    +1 908 874-9726

cell:   +1 609 577-1494

jeff.ginter@ca.com

 

 

Re: 2 Questions--state (est, rel) and tuning

[Daniel Lopes]

Ginter, Jeff A schrieb:
> Hello,
> 
>  
> 
> I am brand new to the list and couldn't find an easy way to browse the
> whole archive, so my apologies if this has been discussed (as it
> probably has).
> 
>  
> 
> I understand the state concepts, however, I keep seeing example iptable
> scripts with the first rule in each chain being something like....ACCEPT
> related and established packets.  
> 
>  
> 
> My first question is...Is that really needed?  In my other experiences
> with stateful firewalls this rule is not needed because the firewall
> remembers the outgoing packet and the rule is implied...or do I have
> this very wrong?
> 

Hmm you often will see a default policy of DROP in the filter tables. So 
related to the strategy deny all allow needed. Then new connections from 
inside to outside are explicitly allowed with the NEW state. Then when 
answer packets come back in and reach a filter table and there is no 
rule to handle them they will be dropped. Therefor there are the EST. 
and REL. states to allow that packets because they should be save enough 
as new conns. are only allowed/initiated from inside to outside. Surely 
it doensn´t prevent a machine with a freaking worm to spread out ;).

> 
>  
> 
> My second question, which may not be totally applicable for this list
> is...I have my netfilter/iptables set up on a Redhat 4 Ent WS box...are
> the following parameters for hardening still useful and applicable with
> the current kernel and distro?
> 
>  
> 
> net.ipv4.tcp_syncookies = 1
> net.ipv4.conf.all.accept_source_route = 0
> net.ipv4.conf.all.accept_redirects = 0
> net.ipv4.conf.all.rp_filter = 1
> net.ipv4.icmp_echo_ignore_all = 1 = 1
> net.ipv4.icmp_echo_ignore_broadcasts = 1
> net.ipv4.icmp_ignore_bogus_error_responses = 1
> net.ipv4.conf.all.log_martians = 1
> 

Yes they are.

>  
> 
> Thanks very much for any help!
> 
>  
> 
>  
> 
>  
> 
> Jeff Ginter, CISSP
> 
> Computer Associates
> 
> Mid-Atlantic Consulting Manager
> 
> tel:    +1 908 874-9726
> 
> cell:   +1 609 577-1494
> 
> jeff.ginter@ca.com
> 
>  
> 
>  
> 
> 

RE: 2 Questions--state (est, rel) and tuning

[Ginter, Jeff A]

I think I am still a bit confused...I understand what you are saying about why established and related would be needed for return packets, except...

For example on a Checkpoint or PIX you would NOT need the established or related rules.  They are aware that a conversation has started and will let return packets in....of course, it is possible that there is an implicit rule on a Checkpoint or PIX that is "hidden" that allows established and related and the user just doesn't see this and in iptables you do...but I thought this was part of the state engine.

Thanks again and sorry for my lack of understanding of the iptables code...however I think it's a fantastic security system, just trying to get my hands around it.
 
 
Jeff Ginter, CISSP
Computer Associates
Mid-Atlantic Consulting Manager
tel:    +1 908 874-9726
cell:   +1 609 577-1494
jeff.ginter@ca.com
 
-----Original Message-----
From: netfilter-bounces@lists.netfilter.org [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Daniel Lopes
Sent: Friday, June 03, 2005 9:24 AM
Cc: netfilter@lists.netfilter.org
Subject: Re: 2 Questions--state (est, rel) and tuning

Ginter, Jeff A schrieb:
> Hello,
> 
>  
> 
> I am brand new to the list and couldn't find an easy way to browse the
> whole archive, so my apologies if this has been discussed (as it
> probably has).
> 
>  
> 
> I understand the state concepts, however, I keep seeing example iptable
> scripts with the first rule in each chain being something like....ACCEPT
> related and established packets.  
> 
>  
> 
> My first question is...Is that really needed?  In my other experiences
> with stateful firewalls this rule is not needed because the firewall
> remembers the outgoing packet and the rule is implied...or do I have
> this very wrong?
> 

Hmm you often will see a default policy of DROP in the filter tables. So 
related to the strategy deny all allow needed. Then new connections from 
inside to outside are explicitly allowed with the NEW state. Then when 
answer packets come back in and reach a filter table and there is no 
rule to handle them they will be dropped. Therefor there are the EST. 
and REL. states to allow that packets because they should be save enough 
as new conns. are only allowed/initiated from inside to outside. Surely 
it doensn´t prevent a machine with a freaking worm to spread out ;).

> 
>  
> 
> My second question, which may not be totally applicable for this list
> is...I have my netfilter/iptables set up on a Redhat 4 Ent WS box...are
> the following parameters for hardening still useful and applicable with
> the current kernel and distro?
> 
>  
> 
> net.ipv4.tcp_syncookies = 1
> net.ipv4.conf.all.accept_source_route = 0
> net.ipv4.conf.all.accept_redirects = 0
> net.ipv4.conf.all.rp_filter = 1
> net.ipv4.icmp_echo_ignore_all = 1 = 1
> net.ipv4.icmp_echo_ignore_broadcasts = 1
> net.ipv4.icmp_ignore_bogus_error_responses = 1
> net.ipv4.conf.all.log_martians = 1
> 

Yes they are.

>  
> 
> Thanks very much for any help!
> 
>  
> 
>  
> 
>  
> 
> Jeff Ginter, CISSP
> 
> Computer Associates
> 
> Mid-Atlantic Consulting Manager
> 
> tel:    +1 908 874-9726
> 
> cell:   +1 609 577-1494
> 
> jeff.ginter@ca.com
> 
>  
> 
>  
> 
> 

Re: 2 Questions--state (est, rel) and tuning

[Jörg Harmuth]

Ginter, Jeff A schrieb:

> For example on a Checkpoint or PIX you would NOT need the 
> established or related rules.  They are aware that a 
> conversation has started and will let return packets in....of course, 
> it is possible that there is an implicit rule on a Checkpoint or PIX 
> that is "hidden" that allows established and related and the user just 
> doesn't see this and in iptables you do...but I thought this was part 
> of the state engine.

I can't give a proof for Checkpoint and PIX, but I think that's exactly
the way it is: You simply can't see these rules, they are generated in
the background, if you decide to have a stateful firewall, and are then
compiled into the rule set.

Looking at pf from the BSD folks, you can say "keep-state" and the
meaning is, that from this point on pf creates the needed rules on the
fly and puts it in the state table (and later on automatically deletes
these dynamic rules).

iptables - as far as I know - doesn't have such "automatics" and thus
you have to specify est,rel rules explicitely.

Any other / additional notions ?

Have a nice time,

Joerg

Re: 2 Questions--state (est, rel) and tuning

[Jason Opperisano]

On Fri, Jun 03, 2005 at 08:59:06AM -0400, Ginter, Jeff A wrote:
> I understand the state concepts, however, I keep seeing example iptable
> scripts with the first rule in each chain being something like....ACCEPT
> related and established packets.  
> 
> My first question is...Is that really needed?

yes.

> In my other experiences
> with stateful firewalls this rule is not needed because the firewall
> remembers the outgoing packet and the rule is implied...or do I have
> this very wrong?

iptables behaves differently than every other stateful firewall i can
think of (check point, pix, ipf, pf) in that they all behave this way:

1 - check state table for matching connection, if found--pass packet.
2 - if packet not found in state table--traverse filter rules

both check point and pix actually have additional checks and
restrictions, but that's a simplistic explanation to get the point
across.

the way iptables works is that as soon as the ip_conntrack module is
loaded, the conntrack table (state table) begins to be populated by
connections passing through the machine.  if you want to load filter
rules, you have an interface into the connections in the state table via
-m state--thus to pass connections that are fully established in the
state table:

  -A ${CHAIN} -m state --state ESTABLISHED -j ACCEPT

as the first rule basically emulates the basic behavior of other
firewalls.  in the simplistic case--this adds more work for the novice
user that is accustomed to stateful tracking "just magically working,"
but in the advanced case, it gives a nice level of flexibility to
actually bypass or override what's in the state table.  the spirit of
linux:  maximum flexibility.

> My second question, which may not be totally applicable for this list
> is...I have my netfilter/iptables set up on a Redhat 4 Ent WS box...are
> the following parameters for hardening still useful and applicable with
> the current kernel and distro?
> 
> net.ipv4.tcp_syncookies = 1
> net.ipv4.conf.all.accept_source_route = 0
> net.ipv4.conf.all.accept_redirects = 0
> net.ipv4.conf.all.rp_filter = 1
> net.ipv4.icmp_echo_ignore_all = 1 = 1
> net.ipv4.icmp_echo_ignore_broadcasts = 1
> net.ipv4.icmp_ignore_bogus_error_responses = 1
> net.ipv4.conf.all.log_martians = 1

other than net.ipv4.icmp_echo_ignore_all, yes.  but i'm one of those
weirdos that does not believe ICMP is some fountain of evil and the
source of everything bad on the Internet.  you'd have more flexibility
blocking/allowing specific ICMP packets in your iptables filter rules
than using sysctl to do it.

-j

--
"Stewie: It rubs the lotion on its skin or else it gets the hose again."
        --Family Guy