Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 9 years ago.
Improve this question
I have firewall rule that should accept all the connections, but drop connections from a ssh brute force attack (except 10.0.0.0/8 range). This rule will block an IP if it attempts more than 24 connections per 10minute.
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp --dport 22 -s ! 10.0.0.0/8 -m state --state NEW -m recent --set --name SSH
-A INPUT -p tcp --dport 22 -s ! 10.0.0.0/8 -m state --state NEW -m recent --update --seconds 600 --hitcount 25 --rttl --name SSH -j DROP
-A INPUT -j ACCEPT
-A FORWARD -j ACCEPT
COMMIT
It errors out when I try to start iptables as bad arguement.
iptables: Applying firewall rules: Bad argument `10.0.0.0/8'
This was talked before in SF. iptables changed the way it accept parameters. Now the bang should be before the parameter, so your lines becomes this:
-A INPUT -p tcp --dport 22 ! -s 10.0.0.0/8 -m state --state NEW -m recent --set --name SSH
-A INPUT -p tcp --dport 22 ! -s 10.0.0.0/8 -m state --state NEW -m recent --update --seconds 600 --hitcount 25 --rttl --name SSH -j DROP
And yes, every blog in internet is wrong.
Related
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 4 years ago.
Improve this question
I have changed ssh default port to 2020, And add iptable rule in order to allow incoming traffic on that port using below command.
iptables -A INPUT -p tcp -m tcp --dport 2020 -j ACCEPT
And i would like to block all other ports on the server. And use below command after allowing ssh. All session are closed. How can i fix it.
iptables -P INPUT DROP
iptables -P OUTPUT DROP
You may need to enable OUTPUT
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 2020 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --sport 2020 -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 6 years ago.
Improve this question
I have an iptables firewall with the default INPUT policy set to DROP. I'm using this for slowing down SSH brute force attempts. The problem is that if I leave the last line in, the previous rules don't trigger and all SSH traffic is accepted. If i leave it out, packets from bad IPs get dropped, but I also can't connect to SSH myself. To my understanding, iptables is sequential, so it should only reach the last rule if it hasn't triggered any of the previous rules. What I am trying to say in the last line is "if your IP isn't on the SSH_BRUTEFORCE list, go on through. What am I doing wrong ?
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -N SSHSCAN
iptables -A INPUT -i ens3 -p tcp -m tcp --dport 22 -m state --state NEW -j SSHSCAN
iptables -A SSHSCAN -m recent --set --name SSH_BRUTEFORCE --rsource
iptables -A SSHSCAN -m recent --update --seconds 360 --hitcount 10 --name SSH_BRUTEFORCE --rsource -j LOG --log-prefix "Anti SSH-Bruteforce: " --log-level 2
iptables -A SSHSCAN -m recent --update --seconds 360 --hitcount 10 --name SSH_BRUTEFORCE --rsource -j DROP
iptables -A SSHSCAN -m recent --rcheck --name SSH_BRUTEFORCE -j ACCEPT
You can start with rate-limiting for example:
/usr/sbin/iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
/usr/sbin/iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
If you want to log the drops then
/sbin/iptables -N LOGDROP
/sbin/iptables -A LOGDROP -j LOG
/sbin/iptables -A LOGDROP -j DROP
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j LOGDROP
source is here https://www.rackaid.com/blog/how-to-block-ssh-brute-force-attacks/
Also I would recommend to move the default port to something else and like #larsks suggested I would deny login with password and only accept keys.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 3 years ago.
Improve this question
on an empty iptables I did:
$iptables -P INPUT DROP
$iptables -P OUTPUT DROP
$iptables -P FORWARD DROP
and a few rules for SSH, HTTP and TEAMSPEAK
and when I did iptables-save I got that result that allows some IP
# Generated by iptables-save v1.4.8 on Thu Feb 20 23:55:32 2014
*raw
:PREROUTING ACCEPT [6299:1141558]
:OUTPUT ACCEPT [6172:2577934]
COMMIT
# Completed on Thu Feb 20 23:55:32 2014
# Generated by iptables-save v1.4.8 on Thu Feb 20 23:55:32 2014
*nat
:PREROUTING ACCEPT [328:23247]
:INPUT ACCEPT [170:9752]
:OUTPUT ACCEPT [1190:168880]
:POSTROUTING ACCEPT [717:89971]
COMMIT
# Completed on Thu Feb 20 23:55:32 2014
# Generated by iptables-save v1.4.8 on Thu Feb 20 23:55:32 2014
*mangle
:PREROUTING ACCEPT [6299:1141558]
:INPUT ACCEPT [6299:1141558]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [6172:2577934]
:POSTROUTING ACCEPT [5699:2499025]
COMMIT
# Completed on Thu Feb 20 23:55:32 2014
# Generated by iptables-save v1.4.8 on Thu Feb 20 23:55:32 2014
*filter
:INPUT DROP [17:1024]
:FORWARD DROP [0:0]
:OUTPUT DROP [76:11042]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p udp -m udp --dport 9987 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCE\
PT
-A OUTPUT -p tcp -m tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT\
-A OUTPUT -p udp -m udp --sport 9987 -j ACCEPT
COMMIT
The question is, is it normal? Am I hacked?
If your question is referring to the numbers in square brackets i.e.
*nat
:PREROUTING ACCEPT [328:23247] <-- these numbers
Then no, you haven't been hacked.
Those are packet and byte counters.
A very good tutorial on iptables by Oskar Andreasson is found at: http://www.faqs.org/docs/iptables/index.html
with a page covering what you are asking about at: http://www.faqs.org/docs/iptables/iptables-save.html
Note that iptables-save is made to be used by iptables-resture, hence the complex formatting. Use iptables -S for a more simple form.
Furthermore, I would suggest using a more simple rules such as:
Allow outgoing traffic and continue any already established connections
iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -P FORWARD DROP
Specific port you want to use for input
iptables -A INPUT -p TCP --dport 22 -m state --state ESTABLISHED,NEW -j ACCEPT
iptables -A INPUT -p TCP --dport 80 -m state --state ESTABLISHED,NEW -j ACCEPT
iptables -A INPUT -p TCP --dport 443 -m state --state ESTABLISHED,NEW -j ACCEPT
iptables -A INPUT -p TCP --dport 9987 -m state --state ESTABLISHED,NEW -j ACCEPT
Of course, run those in a script, otherwise the 'iptables -f' would disconnect your current SSH session.
I have the following iptable rules for a new system.
Basically I am trying to allow incoming www, ssl and ssh and allow outgoing ftp,ssh,smtp,dns,www and ssl connections. Plus a special rules for an outgoing mysql connection to a specific mysql server, a DoS attack helper and some dropped packet logging. All other connections I want dropped.
My trouble is, every single time I run the shell script for these rules, I get locked out tighter than a drum. It drops the established ssh session and won't allow me to begin a new one. I have to reboot through a console as even flushing the rules in a console session does not help.
It does not matter if the fallback rules (top three after the flush) are at the beginning or the end. I've tried many ways and I am hoping a new set of eyes may see what I am missing:
iptables -F
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport --dport 21,22,25,53,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m multiport --sport 21,22,25,53,80,443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p tcp -s 172.xxx.xxx.xxx --sport 1024:65535 -d 172.xxx.xxx.xxx --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 172.xxx.xxx.xxx --sport 3306 -d 172.xxx.xxx.xxx --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dport 80,443 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
iptables -A LOGGING -j DROP
Any help would be appreciated. NOTE: I obfuscated the internal IP for posting.
I'm securing my server (with iptables) so that only http and ssh ports are open and that is fine, although I use the mail command (server: CentOS 6.2) in some applications and it does not get through now thanks to iptables blocking everything.
What ports do I allow it access to?
Mail usage: echo "{{message}}" | mail -s "{{subject}}" me#mail.com
I've tried the standard mail port 25, but I have had no success with that.
Here is the current setup:
iptables --flush
iptables -P INPUT DROP
iptables -P OUTPUT DROP
# incoming ssh
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
# outgoing ssh
iptables -A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
#HTTP
iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
# mail (does not work)
iptables -A INPUT -i eth0 -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT
(EDIT) ANSWER: The working iptables rule:
iptables -A OUTPUT -o eth0 -p tcp --sport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT
The OUTPUT commands should also refer to --dport, not --sport. You'll also want to allow NEW outgoing packets in order to initiate the connection to the SMTP server.
In general, however, since OUTPUT controls only those packets that your own system generates, you can set the OUTPUT policy to ACCEPT unless you need to prevent the generation of outgoing packets.
Two more comments:
1. Jay D's suggestion to "allow everything and then start blocking specific traffic" is insecure. Never configure iptables this way because you'd have to know in advance which ports an attacker might use and block them all individually. Always use a whitelist instead of a blacklist if you can.
2. A hint from the trenches: when you're debugging iptables, it's often helpful to -Insert and -Append log messages at the beginning and end of each chain, then clear the counters, and run an experiment. (In your case, issue the mail command.) Then check the counters and logs to understand how the packet(s) migrated through the chains and where they may have been dropped.