Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Working on locking down a *nix server box with some fancy iptable(v1.4.4) rules. I'm approaching the matter with a "paranoid, everyone's out to get me" style, not necessarily because I expect the box to be a hacker magnet but rather just for the sake of learning iptables and *nix security more throughly. Everything is well commented - so if anyone sees something I missed please let me know! The *nat table's "--to-ports" point to the only ports with actively listening services. (aside from pings) Layer 2 apps listen exclusively on chmod'ed sockets bridged by one of the layer 1 daemons. Layers 3+ inherit from layer 2 in a similar fashion.

The two lines giving me grief are commented out at the very bottom of the *filter rules. The first line runs fine but it's all or nothing. :)

Many thanks,

Peter H.

*nat
#Flush previous rules, chains and counters for the 'nat' table
-F
-X
-Z

#Redirect traffic to alternate internal ports
-I PREROUTING --src 0/0 -p tcp --dport 80 -j REDIRECT --to-ports 8080
-I PREROUTING --src 0/0 -p tcp --dport 443 -j REDIRECT --to-ports 8443
-I PREROUTING --src 0/0 -p udp --dport 53 -j REDIRECT --to-ports 8053
-I PREROUTING --src 0/0 -p tcp --dport 9022 -j REDIRECT --to-ports 8022
COMMIT

*filter
#Flush previous settings, chains and counters for the 'filter' table
-F
-X
-Z

#Set default behavior for all connections and protocols
-P INPUT DROP
-P OUTPUT DROP
-A FORWARD -j DROP

#Only accept loopback traffic originating from the local NIC
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j DROP

#Accept all outgoing non-fragmented traffic having a valid state
-A OUTPUT ! -f -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

#Drop fragmented incoming packets (Not always malicious - acceptable for use now)
-A INPUT -f -j DROP

#Allow ping requests rate limited to one per second (burst ensures reliable results for high latency connections)
-A INPUT -p icmp --icmp-type 8 -m limit --limit 1/sec --limit-burst 2 -j ACCEPT

#Declaration of custom chains
-N INSPECT_TCP_FLAGS
-N INSPECT_STATE
-N INSPECT

#Drop incoming tcp connections with invalid tcp-flags
-A INSPECT_TCP_FLAGS -p tcp --tcp-flags ALL ALL -j DROP
-A INSPECT_TCP_FLAGS -p tcp --tcp-flags ALL NONE -j DROP
-A INSPECT_TCP_FLAGS -p tcp --tcp-flags ACK,FIN FIN -j DROP
-A INSPECT_TCP_FLAGS -p tcp --tcp-flags ACK,PSH PSH -j DROP
-A INSPECT_TCP_FLAGS -p tcp --tcp-flags ACK,URG URG -j DROP
-A INSPECT_TCP_FLAGS -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
-A INSPECT_TCP_FLAGS -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
-A INSPECT_TCP_FLAGS -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
-A INSPECT_TCP_FLAGS -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A INSPECT_TCP_FLAGS -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
-A INSPECT_TCP_FLAGS -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

#Accept incoming traffic having either an established or related state
-A INSPECT_STATE -m state --state ESTABLISHED,RELATED -j ACCEPT
#Drop new incoming tcp connections if they aren't SYN packets
-A INSPECT_STATE -m state --state NEW -p tcp ! --syn -j DROP
#Drop incoming traffic with invalid states
-A INSPECT_STATE -m state --state INVALID -j DROP

#INSPECT chain definition
-A INSPECT -p tcp -j INSPECT_TCP_FLAGS
-A INSPECT -j INSPECT_STATE

#Route incoming traffic through the INSPECT chain
-A INPUT -j INSPECT

#Accept redirected HTTP traffic via HA reverse proxy
-A INPUT -p tcp --dport 8080 -j ACCEPT

#Accept redirected HTTPS traffic via STUNNEL SSH gateway (As well as tunneled HTTPS traffic destine for other services)
-A INPUT -p tcp --dport 8443 -j ACCEPT

#Accept redirected DNS traffic for NSD authoritative nameserver
-A INPUT -p udp --dport 8053 -j ACCEPT

#Accept redirected SSH traffic for OpenSSH server
#Temp solution:
-A INPUT -p tcp --dport 8022 -j ACCEPT
#Ideal solution:
#Limit new ssh connections to max 10 per 10 minutes while allowing an "unlimited" (or better reasonably limited?) number of established connections.
#-A INPUT -p tcp --dport 8022 --state NEW,ESTABLISHED -m recent --set -j ACCEPT
#-A INPUT -p tcp --dport 8022 --state NEW -m recent --update --seconds 600 --hitcount 11 -j DROP
COMMIT

*mangle
#Flush previous rules, chains and counters in the 'mangle' table
-F
-X
-Z
COMMIT

share|improve this question
    
Why a -1 to this question? –  ring0 Jan 9 '11 at 14:32

1 Answer 1

up vote 1 down vote accepted

What exactly is your question? I assume you are asking why the two lines don't work, its because you are missing the "-m state".

change

#-A INPUT -p tcp --dport 8022 --state NEW,ESTABLISHED -m recent --set -j ACCEPT
#-A INPUT -p tcp --dport 8022 --state NEW -m recent --update --seconds 600 --hitcount 11 -j 

to

#-A INPUT -p tcp --dport 8022 -m state --state NEW,ESTABLISHED -m recent --set -j ACCEPT
#-A INPUT -p tcp --dport 8022 -m state --state NEW -m recent --update --seconds 600 --hitcount 11 -j 

If you want us to read over your config and validate it, this isn't the place for that but if you have specific questions about iptables, or how to structure firewall rules in general this is a great place to ask.

share|improve this answer
    
You answered the question! :) Great catch on the missing switch! I was seriously over-complicating the problem, focusing too much on specifics while ignoring the obvious answers. I wasn't soliciting a line by line code review or even specific implementations but rather seeking more general advice from more experienced admins. For instance: "You should rate limiting tcp traffic to help negate DDOS attacks" or "You might want to filter your udp traffic to protect against insert vulnerability here" type suggestions. But thanks again for spotting that blaring omission - everything's working now! –  Peter Hanneman Jan 10 '11 at 0:58
    
Truth is by the time a packet has reached your OS there are lots of ways it can do you damage and there is a good chance you have already lost. A good hardware firewall is the answer here rather than fancy iptables. Or look at setting up an OpenBSD box - pf is fantastic. Your firewall should be physically isolated from what its firewalling. –  hellomynameisjoel Jan 10 '11 at 10:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.