1

I'm trying to make a simple restriction on www packets under two rules:

  1. Allow inbound/outbound www packets. (This works.)
  2. Drop inbound traffic to port 80 from source ports below 1024. (This does not work.)

Now, technically, when I use hping to test my rules,

hping3 192.168.100.100 -S -p80 -s 1023

I should not receive any packets. However, I still receive packets, which means that my rule about dropping packets from ports below 1024 does not work.

Does anyone know why?

This is my iptables rules in shell-script so far:

##!/bin/sh
INTERNET=eth0

SERVER_IP="192.168.7.100"

ALLOWED_WWW_PORT=80

IPT="/sbin/iptables"

clear
# Flushing all rules
$IPT -F
$IPT -X


# DROP all incomming traffic

$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP


# Drop inbound traffic to port 80(http) from source ports less than 1024

$IPT -A INPUT -p tcp -i $INTERNET -s 0/0 --sport 0:1023 -d $SERVER_IP --dport 80 -j DROP



# Permit inbound www(80) packets.

$IPT -A INPUT -p tcp -i $INTERNET -s 0/0 -d $SERVER_IP --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -o $INTERNET -s $SERVER_IP --sport 80 -d 0/0 -m state --state ESTABLISHED -j ACCEPT


# Permit outbound www(80) packets.

$IPT -A OUTPUT -p tcp -o $INTERNET -s $SERVER_IP -d 0/0 --dport $ALLOWED_WWW_PORT -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -i $INTERNET -s 0/0 --sport $ALLOWED_WWW_PORT -d $SERVER_IP -m state --state ESTABLISHED -j ACCEPT



# Log and drop all other packets to file /var/log/messages
iptables -A OUTPUT -j LOG
iptables -A INPUT -j LOG
iptables -A FORWARD -j LOG

# make sure nothing comes or goes out of this box
iptables -A OUTPUT -j DROP
iptables -A INPUT -j DROP
iptables -A FORWARD -j DROP

# save, restart, and check the iptables

service iptables save

service iptables restart

iptables -L -n -v -x

When I run my shell script, here's the Chain INPUT result:

Chain INPUT (policy DROP 0 packets, 0 bytes)

    pkts      bytes target     prot opt in     out     source               destination         

       0        0 DROP       tcp  --  eth0   *       0.0.0.0/0            192.168.7.100       tcp spts:0:1023 dpt:80 

       0        0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            192.168.7.100       tcp dpt:80 state NEW,ESTABLISHED 

       0        0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            192.168.7.100       tcp spt:80 state ESTABLISHED 

What is the correct way to use hping to test my rule from another machine?

Here's my packets result:

[root@daniel-laptop ~]# hping2 192.168.7.100 -S -p 80 -s 1023

HPING 192.168.7.100 (eth0 192.168.7.100): S set, 40 headers + 0 data bytes

len=46 ip=192.168.7.100 ttl=64 DF id=0 sport=80 flags=RA seq=1 win=0 rtt=0.5 ms

len=46 ip=192.168.7.100 ttl=64 DF id=0 sport=80 flags=RA seq=2 win=0 rtt=0.3 ms

len=46 ip=192.168.7.100 ttl=64 DF id=0 sport=80 flags=RA seq=3 win=0 rtt=0.4 ms

len=46 ip=192.168.7.100 ttl=64 DF id=0 sport=80 flags=RA seq=4 win=0 rtt=0.5 ms

len=46 ip=192.168.7.100 ttl=64 DF id=0 sport=80 flags=RA seq=5 win=0 rtt=0.5 ms

len=46 ip=192.168.7.100 ttl=64 DF id=0 sport=80 flags=RA seq=6 win=0 rtt=0.3 ms

len=46 ip=192.168.7.100 ttl=64 DF id=0 sport=80 flags=RA seq=7 win=0 rtt=0.4 ms

^C

--- 192.168.7.100 hping statistic ---

8 packets tramitted, 7 packets received, 13% packet loss

round-trip min/avg/max = 0.3/0.4/0.5 ms

[root@daniel-laptop ~]# 
5
  • Ok, how are you "seeing packets"? because tcpdump (and similar programs based on libpcap) get raw data before, netfilter code, so you would even see packets that will later be dropped Feb 1, 2011 at 8:43
  • do you mean the hping statistic above?
    – snow
    Feb 1, 2011 at 9:04
  • From hping man page "hping2 uses source port in order to guess replies sequence number. It starts with a base source port number, and increase this number for each packet sent." AND "If you need that source port not be increased for each sent packet use the -k --keep option. " So you should add switch '--keep' to your command Feb 1, 2011 at 9:15
  • so your full command "hping2 192.168.7.100 -S -p 80 -s 123 --keep" Feb 1, 2011 at 9:18
  • it works!! just because of not knowing to put the "--keep" option has caused my almost 1 day of waste. THank you so much, LUKA!!!!! :)
    – snow
    Feb 1, 2011 at 9:18

4 Answers 4

2

Re-arrange your script file a bit; move the "Drop inbound traffic to port 80..." rule above the "Permit inbound www(80) traffic" rule.

Right now the ACCEPT rule is evaluated before the DROP rule, so the traffic can get through even from ports <1024.

You can verify this with iptables -vL and see which rules are getting hits.

0
2

If you look at the output of iptables -L you should see that the rule to allow inbound packets on port 80 is before the rule to block packets on port 80 with a source port below 1024. The effect of this is to allow all packets on port 80 as iptables stops processing rules when a match is found.

Rearrange your rules so that the block on source ports below 1024 is before the permit on port 80.

2
  • Is my hping testing in the proper way? hping3 192.168.100.100 -S -p80 -s 1023 I didn't move the below 1024 drop rule to the top, however, I still received packets on this hping testing.
    – snow
    Feb 1, 2011 at 8:39
  • @snow: I've not used hping so can't help. I would have tested it with nc
    – user9517
    Feb 1, 2011 at 9:31
2

Don't use hping3 to test, it increment sport with each successive packet.

Correct rules:

$IPT -A INPUT -p tcp -i $DEFAULT_NIC -s 0/0 --sport 0:1023 -d $SERVER_IP --dport 80 -j DROP
$IPT -A INPUT -p tcp -i $DEFAULT_NIC -s 0/0 -d $SERVER_IP --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -o $DEFAULT_NIC -s $SERVER_IP --sport 80 -d 0/0 -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -o $DEFAULT_NIC -s $SERVER_IP -d 0/0 --dport $ALLOWED_WWW_PORT -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -i $DEFAULT_NIC -s 0/0 --sport $ALLOWED_WWW_PORT -d $SERVER_IP -m state --state ESTABLISHED -j ACCEPT

Move sport rules up.

Test:

server# nc -l -t -p 80
client# nc -t IP 80 -p 1023
client# nc -t IP 80 -p 1024
6
  • ok, moved. how should I test in hping? when i use hping to test my rules, hping3 192.168.100.100 -S -p80 -s 1023 I should NOT receive any packets. However, i still receive packets, which means my rule that says less than 1024 does not work.
    – snow
    Feb 1, 2011 at 8:22
  • Don't use hping3 to test. hping3 increment port with each successive packet.
    – alvosu
    Feb 1, 2011 at 8:35
  • ok just to clarify, how are you seeing packets?, because if you use tcpdump or similar, you will see packets before they are dropped by firewall Feb 1, 2011 at 8:39
  • No, tcpdump dump packet before firewall. Use: tcpdump -pn port 80 or icmp. tcpdump -pn host $IP
    – osdyng
    Feb 1, 2011 at 8:41
  • thi is what i get when trying nc: [root@dan-fedora14-virtual shell-scripts]# nc -l -t -p 80 usage: nc [-46DdhklnrStUuvzC] [-i interval] [-p source_port] [-s source_ip_address] [-T ToS] [-w timeout] [-X proxy_version] [-x proxy_address[:port]] [hostname] [port[s]] [root@dan-fedora14-virtual shell-scripts]#
    – snow
    Feb 1, 2011 at 9:06
0

Have you checked the order of your INPUT rules? Perhaps the traffic is allowed by your first INPUT rule.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .