Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a fairly complicated iptables/ipchains configuration, which is generated by APF. Traffic to port 80 should be blocked, but our Apache logs show that someone was able to probe for web pages:

[Sun Feb 03 13:08:45 2013] [error] [client 50.57.125.169] File does not exist:     /var/www/w00tw00t.at.blackhats.romanian.anti-sec:)
[Sun Feb 03 13:08:45 2013] [error] [client 50.57.125.169] File does not exist: /var/www/phpMyAdmin
[Sun Feb 03 13:08:45 2013] [error] [client 50.57.125.169] File does not exist: /var/www/phpmyadmin

Is there a way to simulate a source IP in iptables to debug why packet from 50.57.125.169 didn't get blocked? The -C | --check option seems to only report whether there exists a rule that explicitly matches the IP, but what I'd like to do is (pseudocode)

myserver% iptables --test --source_ip=50.57.125.169 --dest_port=80
Rule #17 matches (ALLOW)    // i.e. this would be the rule that matches

Is there a way to do this?

[edit] One partial solution was to enable TRACE debugging on iptables (cf. http://serverfault.com/a/126078/67472) and use hping3 (thanks Trent) which can spoof a source IP. However, the results are not showing up when the test is run from a different server, and when run from the same server, it goes over the Loopback interface.

share|improve this question

closed as not a real question by Michael Hampton, freiheit, mdpc, Ward, Jacob Feb 11 '13 at 2:54

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Check about ip spoofing for your operating system –  Hex Feb 9 '13 at 22:37
    
There is no actual Rule #17. That was the "pseudocode" (i.e. my wishlist output) of the command I'm looking for. I have edited the question to make it more clear that "Rule 17" is fiction. –  mrisher Feb 11 '13 at 6:53
    
Wow... wonder why this question closed as not a real question. It's really obvious what's being asked and IMO is a real question. –  Matt Nov 5 '13 at 1:35
    
Thanks, Matt, that's kind of you. I couldn't figure out why either. Unfortunately, I don't have enough Karma to reopen it. –  mrisher Nov 6 '13 at 6:10

3 Answers 3

up vote 3 down vote accepted

Could you just use hping to simulate the source IP address of the traffic and then check to see if the traffic is still getting through? Probably not quite what you are looking for but you could do something like

hping3 --syn --destport 80 --count 3 -a test.ip.address webserver.ip.address
share|improve this answer
    
Good idea. I thought using the -a option to spoof the source port will make me not get replies; how would it show up if the port was allowed versus blocked? –  mrisher Feb 9 '13 at 23:08
    
you would need to look at you application logs to see if the connection was reaching your application –  trent Feb 10 '13 at 1:44

You can use scapy to spoof your IP address.

share|improve this answer

I know I am not directly addressing the question you asked, but having used APF for quite some time, I could advise you on how to block the IP, in case you used a different approach.

example:to block port 80 for the host 1.2.3.4-add the following line /etc/apf/deny_hosts.rules

    tcp:in:d=80:s=1.2.3.4

In addition to this, in stead of going through the hassle of spoofing source IP, why not try to block the IP address of some client computer under your own control and try to connect from it.

share|improve this answer
    
Thanks for the help, Daniel. I have many of such rules in place, the issue is I'm trying to figure out why someone else snuck through. I'll look into the deny rules again to be sure. –  mrisher Feb 10 '13 at 16:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.