How are my iptables rules circumvented?

Question

I'm using ufw on a debian server and apparently an attacker is able to circumvent the filtering rules. ufw uses iptables.

The server host http and mail services, and has an ssh port. I use a non-standard port for my ssh and imaps services. I have no login attempts on ssh, but continuous login attempts on imaps. Changing the imaps port didn’t help. In a matter of hours, I get new login attempts.

login attempts go by pairs from apparently random IP addresses, but most frequently from 2 IP addresses in the 185.211.245.128/25 network. I suspect, it's the home base of the attacker.

The first weird thing I noticed was that if I put a deny (DROP) rule after the allow (ACCEPT) rules for ssh, http, mail, but just in front of the allow rule of my imaps server, the deny rules had no effect. For instance, I had a deny rule for 185.211.245.128/25, but I still saw login attempts from a host in that network. Once I moved the deny rule in front of all allow rules, the login attempts where successfully rejected by the rules.

Since I still got login attempts from random IP addresses (4 to 6 per day), I decided to deny all connection to my imaps server, and only allow IP where I have clients.

To my surprise, I still have login attempts from random IPs. The iptables rules are circumvented.

Here is a copy of the ufw rules some IP hidden:

# ufw status
Status: active

To Action From
-- ------ ----
Anywhere DENY 77.252.26.62
Anywhere DENY 188.162.43.53
Anywhere DENY 77.40.52.94
Anywhere DENY 186.206.168.111
Anywhere DENY 77.40.62.199
Anywhere DENY 103.242.117.49
Anywhere DENY 138.121.244.253
Anywhere DENY 77.40.2.180
Anywhere DENY 77.243.24.0/22
Anywhere DENY 181.112.204.100
Anywhere DENY 202.129.0.42
Anywhere DENY 141.98.80.0/24
Anywhere DENY 185.211.245.128/25
712/tcp ALLOW xxx.xxx.xxx.xxx
712/tcp ALLOW xxx.xxx.0.0/16
712/tcp ALLOW xxx.xxx.xxx.0/21
732/tcp ALLOW Anywhere
80/tcp ALLOW Anywhere
443/tcp ALLOW Anywhere
25/tcp ALLOW Anywhere
465/tcp ALLOW Anywhere
732/tcp ALLOW Anywhere (v6)
80/tcp ALLOW Anywhere (v6)
443/tcp ALLOW Anywhere (v6)
25/tcp ALLOW Anywhere (v6)
465/tcp ALLOW Anywhere (v6)

The imaps is listening on port 712.

Here is the full content of my iptables obtained with iptables -nvL.

Chain INPUT (policy DROP 2912 packets, 156K bytes)
 pkts bytes target     prot opt in     out     source               destination         
37202 6116K fail2ban-dovecot  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 25,465,587,143,220,993,110,995,712
 3603 3539K fail2ban-sasl  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 25,465,587,143,220,993,110,995
 3574 3537K fail2ban-postfix  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 25,465,587
  771 41088 fail2ban-nginx-http-auth  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443
 6304 2096K fail2ban-ssh  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 732
 112K   26M ufw-before-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 112K   26M ufw-before-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 3025  162K ufw-after-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 2939  157K ufw-after-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 2939  157K ufw-reject-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 2939  157K ufw-track-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ufw-before-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-before-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-after-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-after-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-reject-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 2 packets, 170 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 108K   50M ufw-before-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 108K   50M ufw-before-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
21567 2683K ufw-after-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
21567 2683K ufw-after-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
21567 2683K ufw-reject-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
21567 2683K ufw-track-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-dovecot (1 references)
 pkts bytes target     prot opt in     out     source               destination         
37202 6116K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-nginx-http-auth (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  771 41088 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-postfix (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 3574 3537K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-sasl (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 3603 3539K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-ssh (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 6279 2094K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ufw-after-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-after-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    8   624 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:137
    0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:138
    6   280 ufw-skip-to-policy-input  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:139
   72  3380 ufw-skip-to-policy-input  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:445
    0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ufw-skip-to-policy-input  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:68
    0     0 ufw-skip-to-policy-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 2625  128K LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-output (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-after-output (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-before-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ufw-user-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ufw-before-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
27445   12M ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
61175   13M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
  299 12524 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
  299 12524 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 4
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12
18532  645K ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
   66 22448 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
 4507  244K ufw-not-local  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251          udp dpt:5353
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            239.255.255.250      udp dpt:1900
 4507  244K ufw-user-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ufw-before-logging-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-before-logging-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-before-logging-output (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-before-output (1 references)
 pkts bytes target     prot opt in     out     source               destination         
27445   12M ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
59060   36M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
21567 2683K ufw-user-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ufw-logging-allow (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "

Chain ufw-logging-deny (2 references)
 pkts bytes target     prot opt in     out     source               destination         
  296 12404 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID limit: avg 3/min burst 10
    3   120 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-not-local (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 4507  244K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ufw-reject-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-reject-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-reject-output (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-skip-to-policy-forward (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ufw-skip-to-policy-input (7 references)
 pkts bytes target     prot opt in     out     source               destination         
   86  4284 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ufw-skip-to-policy-output (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ufw-track-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-track-output (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 1393 83580 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW
20172 2599K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW

Chain ufw-user-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-user-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       77.252.26.62         0.0.0.0/0           
    0     0 DROP       all  --  *      *       188.162.43.53        0.0.0.0/0           
    0     0 DROP       all  --  *      *       77.40.52.94          0.0.0.0/0           
    0     0 DROP       all  --  *      *       186.206.168.111      0.0.0.0/0           
    0     0 DROP       all  --  *      *       77.40.62.199         0.0.0.0/0           
    0     0 DROP       all  --  *      *       103.242.117.49       0.0.0.0/0           
    0     0 DROP       all  --  *      *       138.121.244.253      0.0.0.0/0           
    0     0 DROP       all  --  *      *       77.40.2.180          0.0.0.0/0           
    0     0 DROP       all  --  *      *       77.243.24.0/22       0.0.0.0/0           
    0     0 DROP       all  --  *      *       181.112.204.100      0.0.0.0/0           
    0     0 DROP       all  --  *      *       202.129.0.42         0.0.0.0/0           
    0     0 DROP       all  --  *      *       141.98.80.0/24       0.0.0.0/0           
   40  1600 DROP       all  --  *      *       185.211.245.128/25   0.0.0.0/0           
  356 22784 ACCEPT     tcp  --  *      *       xxx.xxx.xxx.xxx        0.0.0.0/0            tcp dpt:712
    0     0 ACCEPT     tcp  --  *      *       xxx.xxx.0.0/16        0.0.0.0/0            tcp dpt:712
   11   660 ACCEPT     tcp  --  *      *       xxx.xxx.xxx.0/21      0.0.0.0/0            tcp dpt:712
   31  1868 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:732
  617 32728 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
  144  7956 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
  278 14936 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:25
    5   244 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:465

Chain ufw-user-limit (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ufw-user-logging-forward (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-user-logging-input (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-user-logging-output (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-user-output (1 references)
 pkts bytes target     prot opt in     out     source               destination

It looks as if the attacker is able to punch a hole in the firewall. It also looks like other allowed tcp connections are required to do that, because if I put the drop rules before all allow rules he can’t establish a tcp connection to the imaps server.

Another information is that when I changed the imaps port, I didn’t see a port scan in the logs. The attacker manage to do something to locate the new port while staying below the radar.

Peteris · Accepted Answer · 2019-03-07 08:53:31Z

2

Order matters

An arriving packet is matched against the list IN THE ORDER OF THE LIST; the first ACCEPT or DROP rule that matches will determine the fate of the packet.

The "weird thing" you noticed, "if I put a deny (DROP) rule after the allow (ACCEPT) rules for ssh, http, mail, but just in front of the allow rule of my imaps server, the deny rules had no effect." is not a weird thing but a key part of how iptables rules are supposed to work. If iptables reaches a rule like '25/tcp ALLOW Anywhere' then any deny rules after that won't matter, they have lower priority.

If you want to whitelist only some addresses for port 712, then you need to ensure that right after the ALLOW rules for these specific addresses you have a DROP rule for everything else on that port - which seems to be missing your current configuration example.

edited Mar 7 at 8:53

answered Mar 7 at 8:47

Peteris

6,7361 gold badge19 silver badges29 bronze badges

I may have not be clear enough. I had rule ACCEPT from any to port 25, DROP from 185.211.245.128/25 to any port, ACCEPT from any to port 712 in that order. However I did saw login attempts over tcp from an IP in the network 185.211.245.128/25 to the port 712. I’m aware of the rule order thing. Once the drop rule was moved before the accept rule, the login attempts were rejected. – chmike Mar 7 at 9:23
Regarding your last point, the ufw is configured for deny by default. Whatever is not explicitly allowed, is rejected. But I will add the DROP rule to see if it has an impact. It will tell us if the hole in the rules is before or after that point. – chmike Mar 7 at 9:28
I installed the drop rule as suggested and did saw a new connection attempt this morning from some random ip address. The drop rules don’t stop him. The "attacker" manages to circumvent my iptable rules. – chmike Mar 8 at 8:30
Mystery solved. Failed login attempts were through the postfix submission port 465 which I configured to delegate authentication to dovecot. I forgot that I configured postfix in this way. The lack of hints in the log made me assume that the failed login attempts were through the imaps port. – chmike Mar 14 at 7:54

add a comment |

chmike · Accepted Answer · 2019-03-14 07:50:40Z

The explanation is that the dovecot login attempts are through the postfix submission port 465. I forgot that I configured postfix to delegate authentication to dovecot. If postfix left a log trace informing that the login attempt was through the submission port 465, that would have helped me to understand what was happening.

I used tcpdump, that I left running during 24h, to log incoming tcp connections that cross checked with the failed dovecot login attempts. If you encounter a similar problem, that is the way to go to diagnose the problem.

There were no direct login attempts to the imaps server. The firewall is not circumvented and works as expected. I hope you are reassured as I was.

asked	4 months ago
viewed	89 times
active	4 months ago

Stack Exchange Network

current community

your communities

more stack exchange communities

How are my iptables rules circumvented?

2 Answers 2

Order matters

Your Answer

Not the answer you're looking for? Browse other questions tagged iptables or ask your own question.

Hot Network Questions

How are my iptables rules circumvented?

2 Answers 2

Order matters

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged iptables or ask your own question.

Related

Hot Network Questions