Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to make a simple restriction on www packets under two rules:

  1. Allow inbound/outbound www packets. (This works.)
  2. Drop inbound traffic to port 80 from source ports below 1024. (This does not work.)

Now, technically, when I use hping to test my rules,

hping3 192.168.100.100 -S -p80 -s 1023

I should not receive any packets. However, I still receive packets, which means that my rule about dropping packets from ports below 1024 does not work.

Does anyone know why?

This is my iptables rules in shell-script so far:

##!/bin/sh
INTERNET=eth0

SERVER_IP="192.168.7.100"

ALLOWED_WWW_PORT=80

IPT="/sbin/iptables"

clear
# Flushing all rules
$IPT -F
$IPT -X


# DROP all incomming traffic

$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP


# Drop inbound traffic to port 80(http) from source ports less than 1024

$IPT -A INPUT -p tcp -i $INTERNET -s 0/0 --sport 0:1023 -d $SERVER_IP --dport 80 -j DROP



# Permit inbound www(80) packets.

$IPT -A INPUT -p tcp -i $INTERNET -s 0/0 -d $SERVER_IP --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -o $INTERNET -s $SERVER_IP --sport 80 -d 0/0 -m state --state ESTABLISHED -j ACCEPT


# Permit outbound www(80) packets.

$IPT -A OUTPUT -p tcp -o $INTERNET -s $SERVER_IP -d 0/0 --dport $ALLOWED_WWW_PORT -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -i $INTERNET -s 0/0 --sport $ALLOWED_WWW_PORT -d $SERVER_IP -m state --state ESTABLISHED -j ACCEPT



# Log and drop all other packets to file /var/log/messages
iptables -A OUTPUT -j LOG
iptables -A INPUT -j LOG
iptables -A FORWARD -j LOG

# make sure nothing comes or goes out of this box
iptables -A OUTPUT -j DROP
iptables -A INPUT -j DROP
iptables -A FORWARD -j DROP

# save, restart, and check the iptables

service iptables save

service iptables restart

iptables -L -n -v -x

When I run my shell script, here's the Chain INPUT result:

Chain INPUT (policy DROP 0 packets, 0 bytes)

    pkts      bytes target     prot opt in     out     source               destination         

       0        0 DROP       tcp  --  eth0   *       0.0.0.0/0            192.168.7.100       tcp spts:0:1023 dpt:80 

       0        0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            192.168.7.100       tcp dpt:80 state NEW,ESTABLISHED 

       0        0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            192.168.7.100       tcp spt:80 state ESTABLISHED 

What is the correct way to use hping to test my rule from another machine?

Here's my packets result:

[root@daniel-laptop ~]# hping2 192.168.7.100 -S -p 80 -s 1023

HPING 192.168.7.100 (eth0 192.168.7.100): S set, 40 headers + 0 data bytes

len=46 ip=192.168.7.100 ttl=64 DF id=0 sport=80 flags=RA seq=1 win=0 rtt=0.5 ms

len=46 ip=192.168.7.100 ttl=64 DF id=0 sport=80 flags=RA seq=2 win=0 rtt=0.3 ms

len=46 ip=192.168.7.100 ttl=64 DF id=0 sport=80 flags=RA seq=3 win=0 rtt=0.4 ms

len=46 ip=192.168.7.100 ttl=64 DF id=0 sport=80 flags=RA seq=4 win=0 rtt=0.5 ms

len=46 ip=192.168.7.100 ttl=64 DF id=0 sport=80 flags=RA seq=5 win=0 rtt=0.5 ms

len=46 ip=192.168.7.100 ttl=64 DF id=0 sport=80 flags=RA seq=6 win=0 rtt=0.3 ms

len=46 ip=192.168.7.100 ttl=64 DF id=0 sport=80 flags=RA seq=7 win=0 rtt=0.4 ms

^C

--- 192.168.7.100 hping statistic ---

8 packets tramitted, 7 packets received, 13% packet loss

round-trip min/avg/max = 0.3/0.4/0.5 ms

[root@daniel-laptop ~]# 
share|improve this question
    
Ok, how are you "seeing packets"? because tcpdump (and similar programs based on libpcap) get raw data before, netfilter code, so you would even see packets that will later be dropped –  Luka Marinko Feb 1 '11 at 8:43
    
do you mean the hping statistic above? –  snow Feb 1 '11 at 9:04
    
From hping man page "hping2 uses source port in order to guess replies sequence number. It starts with a base source port number, and increase this number for each packet sent." AND "If you need that source port not be increased for each sent packet use the -k --keep option. " So you should add switch '--keep' to your command –  Luka Marinko Feb 1 '11 at 9:15
    
so your full command "hping2 192.168.7.100 -S -p 80 -s 123 --keep" –  Luka Marinko Feb 1 '11 at 9:18
    
it works!! just because of not knowing to put the "--keep" option has caused my almost 1 day of waste. THank you so much, LUKA!!!!! :) –  snow Feb 1 '11 at 9:18

4 Answers 4

Re-arrange your script file a bit; move the "Drop inbound traffic to port 80..." rule above the "Permit inbound www(80) traffic" rule.

Right now the ACCEPT rule is evaluated before the DROP rule, so the traffic can get through even from ports <1024.

You can verify this with iptables -vL and see which rules are getting hits.

share|improve this answer

If you look at the output of iptables -L you should see that the rule to allow inbound packets on port 80 is before the rule to block packets on port 80 with a source port below 1024. The effect of this is to allow all packets on port 80 as iptables stops processing rules when a match is found.

Rearrange your rules so that the block on source ports below 1024 is before the permit on port 80.

share|improve this answer
    
Is my hping testing in the proper way? hping3 192.168.100.100 -S -p80 -s 1023 I didn't move the below 1024 drop rule to the top, however, I still received packets on this hping testing. –  snow Feb 1 '11 at 8:39
    
@snow: I've not used hping so can't help. I would have tested it with nc –  Iain Feb 1 '11 at 9:31

Don't use hping3 to test, it increment sport with each successive packet.

Correct rules:

$IPT -A INPUT -p tcp -i $DEFAULT_NIC -s 0/0 --sport 0:1023 -d $SERVER_IP --dport 80 -j DROP
$IPT -A INPUT -p tcp -i $DEFAULT_NIC -s 0/0 -d $SERVER_IP --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -o $DEFAULT_NIC -s $SERVER_IP --sport 80 -d 0/0 -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -o $DEFAULT_NIC -s $SERVER_IP -d 0/0 --dport $ALLOWED_WWW_PORT -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -i $DEFAULT_NIC -s 0/0 --sport $ALLOWED_WWW_PORT -d $SERVER_IP -m state --state ESTABLISHED -j ACCEPT

Move sport rules up.

Test:

server# nc -l -t -p 80
client# nc -t IP 80 -p 1023
client# nc -t IP 80 -p 1024
share|improve this answer
    
ok, moved. how should I test in hping? when i use hping to test my rules, hping3 192.168.100.100 -S -p80 -s 1023 I should NOT receive any packets. However, i still receive packets, which means my rule that says less than 1024 does not work. –  snow Feb 1 '11 at 8:22
    
Don't use hping3 to test. hping3 increment port with each successive packet. –  alvosu Feb 1 '11 at 8:35
    
ok just to clarify, how are you seeing packets?, because if you use tcpdump or similar, you will see packets before they are dropped by firewall –  Luka Marinko Feb 1 '11 at 8:39
    
No, tcpdump dump packet before firewall. Use: tcpdump -pn port 80 or icmp. tcpdump -pn host $IP –  osdyng Feb 1 '11 at 8:41
    
thi is what i get when trying nc: [root@dan-fedora14-virtual shell-scripts]# nc -l -t -p 80 usage: nc [-46DdhklnrStUuvzC] [-i interval] [-p source_port] [-s source_ip_address] [-T ToS] [-w timeout] [-X proxy_version] [-x proxy_address[:port]] [hostname] [port[s]] [root@dan-fedora14-virtual shell-scripts]# –  snow Feb 1 '11 at 9:06

Have you checked the order of your INPUT rules? Perhaps the traffic is allowed by your first INPUT rule.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.