How to set iptables to drop packets that I'm not listening on?

Question

I've got a Kali Linux box I use for pen testing.

I would like to configure my machine to DROP incoming packets, but only when I'm not listening on them.

e.g. if I run a netcat listener on port 80, I would like connections from the internet to be possible, but as soon as I stop netcat I would like the packets to be dropped rather than rejected.

I know this would be possible by the use of scripts, but is there any support for iptables to do this automatically?

I have had a suggestion to use the NFQUEUE target for all incoming packets, but then I'll have to modify the source of the listening application (if no user-space application is listening on the specified queue, the packets are dropped).

Answer 1

If never seen this done without a script, so here is a baseline script for you to accomplish this:

checkht="lsof -c httpd | awk '{print $1}' | uniq | grep h"

if [ -n "$checkht" ]; then

    echo "webserver is running let me shut down uptables rules blocking HTTP"
    iptables -vnL --line-numbers |awk '/tcp dpt:80/{print "iptables -D INPUT "$1}' | sh

else

   iptables -A INPUT -s 0.0.0.0/0 -p tcp --dport 80 -j DROP

fi

Checks to see if http is running, if it is, it makes sure that IPTABLES has no rule blocking HTTP. If it's not running, it blocks the world from reaching that port. However, because you're not listening on the port, the rule to block makes little sense. There is nothing for anyone to attack since nothing is running.

Answer 2

What you want to do is simply drop outgoing RST's and ICMP unreachable messages. That way your machine will simply end up ignoring unknown traffic, while SYN packets to open ports will be answered. See solutions at https://stackoverflow.com/questions/13215135/how-to-make-all-outgoing-rst-drop

Answer 3

The short answer is: no by design, and here's an example of what would need to happen if it was possible:

1. netcat opens socket on port X by calling the relative syscall (such as listen)
2. kernel traps syscall, executes network code (in this case, opens port)
3. kernel talks to the relative iptables module (assuming it's available and loaded) and opens a hole in the firewall to let traffic go to the newly opened port.

This would open up a potential security hole: how would the kernel know that the program is legitimate, i.e. is not a trojan that wants to open a remote shell? Here are a few answers:

• Because the program is whitelisted somewhere; but this would shift the security into another set of issues:
  • how do you know that the program hasn't been compromised? You could use something like tripwire, but this opens up another security question: how can you guarantee that the master list is not compromised?
  • how do you deal with updates? E.g. version Z of ssh can punch holes through the firewall; your system self-updates, now the hash of ssh changed, and you are locked out.
• Because the user launching it belongs to a privileged group: how do you deal with SUID binaries? Take a look at the ping program permissions for example.

Another can of worms^W^W^W set of potential issues would be the interface between iptables (at kernel level) and the syscalls; every minor change in iptables would require a potential rewrite of the code underlying the syscalls, introducing bugs, etc.

In a nutshell, you are describing the problem that application firewalls face (think about Windows or Mac firewalls). It's do-able, but it's not simple.

At a networking level you might want to take a look at UPnP whose function was to allow services to punch holes through a gateway's firewall. With the obvious security consequences.

Or you could use a script instead :)

Answer 4

you could write a simple bash script that parses out netcat output and builds a new iptables ruleset accordingly every time its running.

You probably have to make sure that you allow connections first before you set the drop all rule else you would reset all running connections each time the script runs.

Then you could set a cronjob that will run your script every minute.

As lorenzog pointed out this might not be the most secure setup, on the other hand if you have no iptables running by default then this is probably better than nothing.

Also you could set a range of port as a whitelist and ignore all other ports that netstat spits out...

As this is about your Kali box (VM?) it should only be running for specific tasks anyways. Kali is not meant to be used as a default client/server operating system for daily tasks. So I would let you get a away with this kind of dynamic firewall setup ;)