We have a fairly complicated iptables/ipchains configuration, which is generated by APF. Traffic to port 80 should be blocked, but our Apache logs show that someone was able to probe for web pages:
[Sun Feb 03 13:08:45 2013] [error] [client 220.127.116.11] File does not exist: /var/www/w00tw00t.at.blackhats.romanian.anti-sec:) [Sun Feb 03 13:08:45 2013] [error] [client 18.104.22.168] File does not exist: /var/www/phpMyAdmin [Sun Feb 03 13:08:45 2013] [error] [client 22.214.171.124] File does not exist: /var/www/phpmyadmin
Is there a way to simulate a source IP in iptables to debug why packet from
126.96.36.199 didn't get blocked? The
-C | --check option seems to only report whether there exists a rule that explicitly matches the IP, but what I'd like to do is (pseudocode)
myserver% iptables --test --source_ip=188.8.131.52 --dest_port=80 Rule #17 matches (ALLOW) // i.e. this would be the rule that matches
Is there a way to do this?
One partial solution was to enable
TRACE debugging on iptables (cf. http://serverfault.com/a/126078/67472) and use
hping3 (thanks Trent) which can spoof a source IP. However, the results are not showing up when the test is run from a different server, and when run from the same server, it goes over the Loopback interface.