2

I have an Elastic Search server which seems to have been exploited (it's being used for a DDoS attack having had NO firewall for about a month).

As a temporary measure while I create a new one I was hoping to block all traffic to and from the server which wasn't coming from or going to our web server. Will these iptables rules achieve this:

iptables -I INPUT \! --src 1.2.3.4 -m tcp -p tcp --dport 9200 -j DROP
iptables -P FORWARD \! --src 1.2.3.4 DROP
iptables -P OUTPUT \! --src 1.2.3.4 DROP

The first rule is tried and tested but obviously wasn't preventing traffic coming from my server to other IP addresses so I was hoping I could add the second two rules to full secure it.

1
  • These firewall rules might not help at all. Quite often the software running on web server are vulnerable, and are exploited to install malware. You should make sure all web site software is up-to-date, and fix possible security issues in code you have made yourself. May 31, 2014 at 19:25

1 Answer 1

0

To accomplish this, I would implement a default drop, AFTER defining the allowed IPs. So it would look like

iptables -I INPUT --src 1.2.3.4 -p tcp --dport 9200 -j ACCEPT
iptables -P INPUT DROP
iptables -I FORWARD --src 1.2.3.4 ACCEPT
iptables -P FORWARD DROP
iptables -I OUTPUT --src 1.2.3.4 ACCEPT
iptables -P OUTPUT DROP

Also, keep in mind, the FORWARD chain is most likely not doing anything, unless you have multiple nics, vlan tagging, etc... and "1" in /proc/sys/net/ipv4/ip_forward.

Also, test your rules first, and possible add a 10 minute cron to flush rules, or you may lock yourself out, if this is a remote machine, without out-of-band console access :)

2
  • You've reversed the port condition on the INPUT chain. May 30, 2014 at 11:53
  • oops typo... fixed
    – nandoP
    Jun 1, 2014 at 22:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .