1

I need some advice securing a LAN using iptables.

I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These examples gave easy to see results with wireshark, tcpdump and on bandwith, but I am not able to find a way to perform similar things with an attacker outside LAN.

I've also tried to use ettercap which seems very powerful tool but dont know what type of attacks or what scenarios should I test vs iptables.

Improve this question
3
  • You can use --rcheck --seconds 60 --hitcount 20 -d <subnetid>, so after 20 hits on complete subnet it will drop connections. While you can allow different ratios on the port 80 etc. This could be practical to prevent scan if you run linux based router/firewall.
    – Andrew Smith
    Jul 20, 2012 at 19:10
  • This is extremely vague; can you describe the context in details? Which services, etc.
    – curiousguy
    Jul 22, 2012 at 5:28
  • The thing is I am lookoing for any possible way that iptables may be useful to secure, let analyze traffic and let us notice when something bad is happening.
    – scx
    Jul 22, 2012 at 10:05

2 Answers 2

Reset to default
4

IPtables won't detect a successful Ettercap attack. Ettercap is used for ARP cache poisoning, CAM table flooding - it's a layer 2 attack tool to perform network sniffing via exploiting issues/vulnerabilities on switches. See this tutorial for some examples.

To be honest, think the question is a little generic and maybe dated. Folks don't generally test firewalls per se but instead, how to bypass firewalls to get to the PII behind.

IPtables is a firewall so it generally has all the advantages and limitations of most firewalls. It comes in handy (to paraphrase you) when you need to lock down your host or hosts behind your iptables firewall to restrict access to/from only allowed ports/services and IP addresses. It can also be used to throttle or mangle traffic. Here's a couple of links on testing firewalls that should give you an idea -

Improve this answer
2

iptables is simply a firewall. What is important is how you configure it. You should take some basic steps to determine what rules you need.

1) Deny by default policy - all traffic into your LAN should be dropped, unless you explicitly allow it using a whitelist.

2) Determine what services your LAN is running. Do you have a web server? Allow port 80 or 443. Are you running a ftp server? Allow port 21. Only allow what is needed. Nothing more.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .