I am trying to create some simple iptables DOS protection rules for my web server. I was doing testing on the following rules:
iptables -N LOGDROP > /dev/null 2> /dev/null
iptables -F LOGDROP
iptables -A LOGDROP -j LOG --log-prefix "LOGDROP "
iptables -A LOGDROP -j DROP
iptables -I INPUT -p tcp --dport 8000 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 8001 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 8000 -i eth0 -m state --state NEW -m recent --update --seconds 1 --hitcount 4 -j LOGDROP
iptables -I INPUT -p tcp --dport 8001 -i eth0 -m state --state NEW -m recent --update --seconds 1 --hitcount 4 -j LOGDROP
I created a simple script on a separate machine to do a wget and then sleep for .2 seconds. I launched this script at port 8000 and 8001, and as expected I saw drop messages start to appear in my /var/log/messages:
Jul 30 20:03:57 Server kernel: LOGDROP IN=eth0 OUT= MAC=08:00:27:d5:52:24:08:00:27:6d:cf:2f:08:00 SRC=192.168.56.102 DST=192.168.56.101 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=31049 DF PROTO=TCP SPT=44071 DPT=8000 WINDOW=14600 RES=0x00 SYN URGP=0
Jul 30 20:04:00 Server kernel: LOGDROP IN=eth0 OUT= MAC=08:00:27:d5:52:24:08:00:27:6d:cf:2f:08:00 SRC=192.168.56.102 DST=192.168.56.101 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=63571 DF PROTO=TCP SPT=38876 DPT=8001 WINDOW=14600 RES=0x00 SYN URGP=0
Jul 30 20:04:00 Server kernel: LOGDROP IN=eth0 OUT= MAC=08:00:27:d5:52:24:08:00:27:6d:cf:2f:08:00 SRC=192.168.56.102 DST=192.168.56.101 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=63984 DF PROTO=TCP SPT=44075 DPT=8000 WINDOW=14600 RES=0x00 SYN URGP=0
Everything appears to be great, except when I checked wireshark I found that the connection from source port 44071 was successful, meaning I saw a full tcp handshake, HTTP GET, and socket close. The other two entries in the log were successfully dropped, meaning I saw just a SYN packet in wireshark.
Anyone know why the connection on source port 38876 would be logged as denied but not actually dropped?