1

So last semester I studied a bit about network hardening and one of the things that we did was write IP table rules to ensure that only a whitelisted set of services are able to talk to each other between machines.

But what this essentially means is that any two services running on specific ports are able to talk to each other. It doesn't quite bind the service with the port and I guess depends on the user to ensure that it is only the intended services that run on those ports.

Is there some way to ensure maybe have the service associated with the IP table rules? Or something other than IP tables that does this for you?

I am sure somebody somewhere would have exploited IP table based hardening.

EDIT To be clear, my goal is:
I want to have an application level restriction instead of port level. I want to restrict communication such that only specific services can talk to each other instead of a port based system like IP tables. For e.g. I just want MySQL services running on two hosts to talk to each other instead of saying only port 5000 should be used for communication and depending on the user to ensure that no other service is using port 5000

I am not asking for any product recommendations. This is for me to learn about security. I am guessing that you can do a signature based filtering of packets but it may not work on encrypted packets.

  • Can you be more specific about what you're trying to do (including what protocols you're using) and what you've tried? Are you looking for a better way to configure your firewall setting or are you looking at identification and blocking at a higher level like through certificates? Your question isn't clear on these specifics which makes it hard to answer without being general. IP addresses can change or be spoofed but certificates and encryption provide a basis for much more secure identification methods. – Cody P Jul 18 '17 at 18:18
  • @CodyP does this help? – Limit Jul 18 '17 at 18:31
1

Pretty sure you can do that with TCP wrappers I would give a very detailed account of how to do it but, Red Hat does it much better!

  • While not in the entirety, it does solve the problem by saying so and so clients are allowed to connect to a certain service. Not that only a specific service is allowed to run or maybe I didn't understand it correctly – Limit Jul 20 '17 at 18:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.