0

We currently have a server that blocks all connections using iptables, and we have to whitelist an IP expressly in order to be able to access the server remotely.

Essentially, the first rule allows the whitelisted IPs (including localhost interface) to progress further to the other chains on the firewall, while rejecting any IP that is not on the list.

Is it possible for an attacker to somehow circumvent the iptables rules to gain access to the server?

Sample rules follow below:

Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 1507K 136M ALLOW all -- * * 0.0.0.0/0 0.0.0.0/0

Chain ALLOW (1 references) pkts bytes target prot opt in out source destination 183K 36M next_chain all -- * * 198.###.##.### 0.0.0.0/0 3053K 237M ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 116K 5859K REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable

  • 2
    What about IPv6 traffic? – Steffen Ullrich Sep 21 '17 at 12:08
  • Good question. Worth noting that my answer assumes there's no IPv6 address assigned to any interface. – Polynomial Sep 21 '17 at 12:09
  • I'm using open suse 42ish and only set up ipv4 with yast lan. didn't even bother with ipv6. guessing that is safe enough? – Son of Sam Sep 21 '17 at 15:28
2

Your INPUT chain is largely useless as it forwards all packets from all interfaces to the ALLOW chain anyway - you could've just implemented the ALLOW chain rules in the INPUT chain.

With the rules you have there, UDP and ICMP traffic can be sent to the server by spoofing the source IP address. Response packets would not be received by the attacker, but this may not be necessary for certain attack types.

TCP packets (e.g. SYN) can also reach the server in the same way, but a connection cannot be created as the attacker could not construct a full TCP handshake.

Of course, the attacker would need to know which source IPs are accepted in order to spoof it.

Other than that the rules look alright.

  • I did a spotcheck on the server and found a foreign (otherwise blocked) that had an established session with a service. Is it possible for a service to enable access beyond the scope of iptables? – Son of Sam Oct 3 '17 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.