2

I setup port knocking rules on CentOS 7, iptables as follow:

-I INPUT -p tcp --dport 1 -m recent --set --rsource --name KNOCK1 -m limit --limit 5/min -j LOG --log-prefix "knock 1" --log-level 7
-I INPUT -p tcp --dport 2 -m recent --rcheck --rsource --seconds 20 --name KNOCK1 -m recent --set --rsource --name KNOCK2 -m limit --limit 5/min -j LOG --log-prefix "knock 2" --log-level 6
-I INPUT -p tcp --dport 3 -m recent --rcheck --rsource --seconds 20 --name KNOCK2 -m recent --set --rsource --name OPEN_NOW -m limit --limit 5/min -j LOG --log-prefix "knock 3" --log-level 6
-I INPUT -p tcp --dport 22 -m state --state NEW -m recent --rcheck --rsource --seconds 20 --name OPEN_NOW -j ACCEPT

Then I blocked port 22:

iptables -A INPUT -p tcp --dport 22 -j DROP

It works correctly because before sending the port sequence, nmap displays as:

22/tcp filtered ssh     no-response

And after sending the following probes (on Windows):

nmap -PN --host_timeout 201 --max-retries 0 -p 1 200.xxx.xxx.xxx && nmap -PN --host_timeout 201 --max-retries 0 -p 2 200.xxx.xxx.xxx && nmap -PN --host_timeout 201 --max-retries 0 -p 3 200.xxx.xxx.xxx

Both nmap and nc shows it as open:

nmap:
22/tcp open  ssh     syn-ack ttl 49
nc:
hostname.xxxx.xxxx [200.xxx.xxx.xxx] 22 (ssh) open

However, I cannot ssh into it, using any client (Putty, nc). It timeouts as Iptables is correctly dropping the packets. But the port is OPEN (since the probes opened the port) meaning the DROP rule was no longer in effect and nmap/nc got "Ack / Open", shouldnt I be able to ssh?

Improve this question
4
  • How do you know that the timeout is because iptables is dropping packets? Are you sure that SSH works if you remove the port knocking protection but keep the rest of your iptables rules, i.e. the ones which you don't show here?
    – Steffen Ullrich
    Aug 27, 2017 at 12:22
  • Yes Im able ssh before the rules. There are no other rules (its a fresh install). Im guessing it drops them because I tried with other port 80 and saw the rule counter increase before the knock (timeout). But after the knock it didnt increase the counter (as its open). So yeah its weird for port 22 to DO drop them after knock... I will try setting another ssh on other port and loggin everything (cant do it on 22 because it kills my connection).
    – Jonas
    Aug 27, 2017 at 23:09
  • 1
    Could it be because of lacking -contrack or any other rule that allows continous flow of packets? I havent used any other rule like say -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT ... maybe thats whats missing for a full ssh session?
    – Jonas
    Aug 27, 2017 at 23:19
  • You just accept packets in state NEW after port knocking. Everything else to port 22 is handled by the DROP rule which means also established connections. I recommend to read digitalocean.com/community/tutorials/…
    – Steffen Ullrich
    Aug 28, 2017 at 4:31

1 Answer 1

Reset to default
0

Well yeah problem was of course the --state NEW only allowed 1 packet to SYN, after which server replied with SYN/ACK and then iptables will drop every following packet from client.

But I didnt wanted to use -contrack for ALL connections, since Im just paranoid over performance or any exploit that could take advantage of established connections that somehow passed the rules.

So I added --state NEW,RELATED,ESABLISHED just for the last knock, and that allowed me to ssh for 20 seconds, then it will drop the connection, but during that time I would just -j ACCEPT my IP.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .