0

I have looked for the answer to this question to no avail, apologies if I missed it.

I would like to know how effective iptables would be against MitM attacks - in the following setup:

ALLOW INPUT {only one IP address} 
DROP All Else Anywhere

I guess what I am asking is, would it still be possible for someone to masquerade as the one allowed IP to connect and prepare mitm attack on any incoming connections?

Also, what if the connecting device had the same iptables configuration, allowing only the first device's IP...

You'd think that would be a fairly secure setup - but I want to be sure...

Improve this question

1 Answer 1

Reset to default
3

Yes it will be possible to successfully achieve a MITM attack.

Consider the simple scenario where the origin IP you are allowing has a LAN inside so any person in the LAN will be able to MITM any connection since all of them has the very same "outside" IP. 

SERVER <-- IPTABLES (only IP1 filter) <--------- LAN(IP1) (natting) <-|--- MITM Client 
                                                                      |
                                                                      |--- Client 1

Here Client 1 may init a connection, and MITM client can intercept it transparently. (you have the very same problem in the other way).

The best way you have to solve this is using point to point connection with authentication (using certificates or similar).

Improve this answer
5
  • Thanks for that! Any chance you know of a good tutorial for setting up p2p with certificates?
    – asimovwasright
    Mar 18, 2014 at 10:58
  • One more thought; would you consider a public/private rsa key pair based ssh connection safe? SSH is very important for me, since the two devices in question share information via shell scripts - and I wouldn't know where to begin scripting a vpn connection safely...
    – asimovwasright
    Mar 18, 2014 at 11:35
  • well, ssh should be fine =)
    – kiBytes
    Mar 18, 2014 at 11:42
  • right, so ssh connections are safe - as long as you are using them with rsa keys? Or have I missed something?
    – asimovwasright
    Mar 18, 2014 at 11:43
  • Now, passwords are fine also. The point is that security is not about a protocol or using private-public keys or a hard password, you also need to protect those things and use them in a safe way, preventing people from acquiring them... A bunch of things...
    – kiBytes
    Mar 18, 2014 at 11:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .