0

I have looked for the answer to this question to no avail, apologies if I missed it.

I would like to know how effective iptables would be against MitM attacks - in the following setup:

ALLOW INPUT {only one IP address} 
DROP All Else Anywhere

I guess what I am asking is, would it still be possible for someone to masquerade as the one allowed IP to connect and prepare mitm attack on any incoming connections?

Also, what if the connecting device had the same iptables configuration, allowing only the first device's IP...

You'd think that would be a fairly secure setup - but I want to be sure...

3

Yes it will be possible to successfully achieve a MITM attack.

Consider the simple scenario where the origin IP you are allowing has a LAN inside so any person in the LAN will be able to MITM any connection since all of them has the very same "outside" IP.

SERVER <-- IPTABLES (only IP1 filter) <--------- LAN(IP1) (natting) <-|--- MITM Client 
                                                                      |
                                                                      |--- Client 1

Here Client 1 may init a connection, and MITM client can intercept it transparently. (you have the very same problem in the other way).

The best way you have to solve this is using point to point connection with authentication (using certificates or similar).

  • Thanks for that! Any chance you know of a good tutorial for setting up p2p with certificates? – asimovwasright Mar 18 '14 at 10:58
  • One more thought; would you consider a public/private rsa key pair based ssh connection safe? SSH is very important for me, since the two devices in question share information via shell scripts - and I wouldn't know where to begin scripting a vpn connection safely... – asimovwasright Mar 18 '14 at 11:35
  • well, ssh should be fine =) – kiBytes Mar 18 '14 at 11:42
  • right, so ssh connections are safe - as long as you are using them with rsa keys? Or have I missed something? – asimovwasright Mar 18 '14 at 11:43
  • Now, passwords are fine also. The point is that security is not about a protocol or using private-public keys or a hard password, you also need to protect those things and use them in a safe way, preventing people from acquiring them... A bunch of things... – kiBytes Mar 18 '14 at 11:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.