22

I realize there are different opinions, but one major attitude of people who really know about networking and security is that most of these iptables/sysctl rules are redundant, if not damaging to you and the network. Some will aggressively criticize you for breaking with standard behavior without reason. Some examples: The standard TCP/IP behavior is to ...


13

The short answer Usually you will only need connection tracking for outbound connections. If any local device makes a connection to the Internet, the firewall records that this specific IP and port tried to make a connection to the other IP and port. Thus when the answer from the Internet arrives, the firewall knows to let it pass, because it has seen an ...


10

In most cases doing an nmap -p 0-65535 -PN <ip> works well for testing a remote firewall's TCP rulesets. If you want something more advanced you can use a packet crafter like hping which is designed to test firewall rulesets. Here is some information on building packets with hping.


9

iptables -F does not change the default policy. So when you set it to DROP and do a flush afterwards, it stays on DROP. I use the following commands to flush the tables iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT iptables -F iptables -X This changes the default policies to ACCEPT for all filter chains, flushes the rules ...


9

The Majestic project is a distributed web crawler, which explains why you get such a lot of different source IP addresses. It is not malicious, that is it does not attack your site and it does not even uses lots of resources (800 requests a day is not much). Like most proper bots Majestic even includes a URL in the user-agent string and if you visit this ...


7

Why are you using iptables rather than using good old Wireshark which is specifically made for this? Wireshark is a free and open-source packet analyzer and the ideal tool for performing these types of analysis. EDIT If you need to reinject the packets I would have a look at scapy in python.


7

It appears that Fail2ban fits your scenario perfectly. It is rather configurable so you should be able to setup what you need by consulting the documentation a little.


7

Which version of linux are you using and how is your iptables configure that is causing these messages to be logged? I can offer an alternative possible explanation. In the packets there seems to be the RST flag being set. 11:45:26 my.com kernel: IPTABLES: SRC=220.255.XX.XXA DST=192.168.1.2 LEN=40 TOS=0x00 PREC=0x00 TTL=57 ID=49687 PROTO=TCP SPT=443 ...


7

First, let's correct some assumptions and terminology which will make understanding the results a lot easier: The -F option is a "quick" scan because it scans only 100 ports. It is the equivalent of --top-ports 100. Without this option, Nmap scans 1000 TCP ports. The -A option is not "intense" but rather "All features." It is the equivalent of -sV -sC -O --...


6

I would be careful in making these part of the same ruleset for devices inside a trusted network and those in a DMZ. By using the rules you've got defined there, you're not going to respond to a DHCP server asking (ICMP echo) if your IP is in use. This could lead to a duplicate address situation. I would create two different sets of rules to apply to ...


6

REJECT is nicer to other people: if the connection is the result of an honest mistake (a configuration error) then whoever tried to initiate a connection receives the standards-approved response that nobody is listening on that port. With DROP, nothing is returned, so whoever is trying to connect will wait until it gets bored. While REJECT seems better for ...


6

You might want to clarify if you're looking for DoS or DDoS protection. See this answer for more details. In a typical web-application architecture, the WAF stands in front of your web-application, either in your network zone (e.g. DMZ) or within an external service provider network that filters the traffic for you. In case of a DDoS attack, the WAF will be ...


6

ARP and TCP/IP are different layers in the networking technology stack. If you have read about the OSI model, that applies here. ARP is a protocol at layer 2 dealing with connecting the host to the local network. TCP/IP are protocols dealing with connecting networks together. iptables deals (mostly) with TCP/IP and higher layers. arptables deals with ...


5

For a client PC, connected directly to the internet via ppp, the following ruleset is a good start: iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset iptables -A INPUT -p udp -j REJECT ip6tables -A INPUT -i lo -j ACCEPT ip6tables -A INPUT -m ...


5

Right, so this is is a Hard Questiontm. Since all environments are different, it is very tricksome to provide a "One Size Fits All" ruleset that one can expect to just drop in. Any such configs, config snippets, recommendations, etc, must be fully grokked and tweaked to work in your environment. That being said, as discussed in the security.blogoverflow.com ...


5

You can set up one PC or virtual machine to host 2 or 3 different services (Web server, FTP server, SSH for example). This is the PC where you'll be editing the iptables rules. First demo a different PC accessing each service and show it works (e.g., visit the web site, ftp and ssh servers). Next, use an iptables rule to rejects access from any IP to ...


5

At home I use iptables for my network firewall (integrated with my gateway) as well as my host firewall. I recommend taking a look at the linux home networking iptables tutorial, ubuntu iptables tutorial and this iptables script generator. If you can outline what you need to show for this presentation it would be easier to answer this question. It seems ...


5

You mention iptables, so you are implying linux (at least as an example for an OS with tunable network policies). Since a very long time, linux has had a limit on the number of ICMP error message sent. The default is very low: 1 message/s. This behaviour of linux is tunable with network sysctl parameters: the icmp_ratelimit sysctl icmp_ratelimit - ...


5

iptables is a user-mode program that acts as an interface to the Netfilter hooks that the Linux kernel provides. By it's very definition, it cannot run in kernel mode as it is a user-mode program designed to interface with a set of kernel hooks. iptables can only be modified by the root user anyway. If a piece of malware manages to elevate privileges that ...


5

Stateful firewalls are mindful of incoming connections that are part of a circuit that was previously established. iptables can certainly do this. The short answer is that you need a firewall rule that blocks all new incoming connections, but allows established incoming connections.


5

Assuming that your side initiates every communication, then yes, blocking every connection to your machine from IP addresses you didn't connect to is a good idea. But note that this is firewall basics. Most client-side firewalls don't allow any incoming connections initiated from a remote machine unless you specificallly allow them. They do more than you ...


5

Scapy does not route the traffic, nor does it touch the traffic at all in this scenario. When you enable IP forwarding on a host, it becomes a router. When the host receives a packet not destined for one of its own addresses, it will route the packet per its routing table. Since the traffic from the victim has a destination IP address not matching the ...


4

IPtables won't detect a successful Ettercap attack. Ettercap is used for ARP cache poisoning, CAM table flooding - it's a layer 2 attack tool to perform network sniffing via exploiting issues/vulnerabilities on switches. See this tutorial for some examples. To be honest, think the question is a little generic and maybe dated. Folks don't generally test ...


4

So to elaborate on your question here's what I've been running (and I'll use your examples with notes, since mine are pretty much devoid of comments having been carried on to net fliter since IPCHAINS died all those years ago.) This could work for an internal system, but you'll often spend time configuring your iptables for new applications not taken into ...


4

It depends what you are trying to protect against, if this traffic goes over the internet, technically people would still be able to sniff or modify your traffic if they were able to put themselves between your two machines. IPTables is a firewall but it does not offer means of encrypting the traffic. Therefore you need to depend on other protocols like ...


4

You can do this by making a customized active response. This will require you to write a script which can add IPs to your remote firewall. I suggest reading up on the linked documents as they explain this quite well.


4

If you have an OSSEC agent running on the remote firewall, you can use native ossec commands. The < location > option defines where the active response should be executed. Normally it is configured to execute the active response on the host that generated the event ("local"), but can also be configured to execute the active response on any host that has ...


4

You don't have much information in that log, so you need to assume something (or use some tool that will do that for you). For example, say that most of your clients are in US/EMEA. Then maybe all IPs coming from China can be blocked. You can get them with WHOIS from the logs, or try online services: IPDeny seems to not have data: http://www.ipdeny.com/...


4

In practice this is likely to be a reasonable protection, but from an ideal standpoint you shouldn't rely on it. Apart from anything else it disregards the possibility that an attacker can get access to a machine on your local LAN (e.g. if one of your systems gets infected by malware) In terms of having iptables reject LAN IPs from the Internet, yep this ...


4

A routing firewall participates in the IP process, whereas a bridging, or transparent, firewall does not. A transparent firewall acts more as a tap on a line, while a routing firewall has to forward traffic onto its next destination. The advantages of a transparent firewall are that it can be installed in-line between two devices without having to ...


Only top voted, non community-wiki answers of a minimum length are eligible