I have an Elastic Search server which seems to have been exploited (it's being used for a DDoS attack having had NO firewall for about a month).

As a temporary measure while I create a new one I was hoping to block all traffic to and from the server which wasn't coming from or going to our web server. Will these iptables rules achieve this:

iptables -I INPUT \! --src -m tcp -p tcp --dport 9200 -j DROP
iptables -P FORWARD \! --src DROP
iptables -P OUTPUT \! --src DROP

The first rule is tried and tested but obviously wasn't preventing traffic coming from my server to other IP addresses so I was hoping I could add the second two rules to full secure it.

  • These firewall rules might not help at all. Quite often the software running on web server are vulnerable, and are exploited to install malware. You should make sure all web site software is up-to-date, and fix possible security issues in code you have made yourself. – Tero Kilkanen May 31 '14 at 19:25

To accomplish this, I would implement a default drop, AFTER defining the allowed IPs. So it would look like

iptables -I INPUT --src -p tcp --dport 9200 -j ACCEPT
iptables -P INPUT DROP
iptables -I FORWARD --src ACCEPT
iptables -P FORWARD DROP
iptables -I OUTPUT --src ACCEPT
iptables -P OUTPUT DROP

Also, keep in mind, the FORWARD chain is most likely not doing anything, unless you have multiple nics, vlan tagging, etc... and "1" in /proc/sys/net/ipv4/ip_forward.

Also, test your rules first, and possible add a 10 minute cron to flush rules, or you may lock yourself out, if this is a remote machine, without out-of-band console access :)

  • You've reversed the port condition on the INPUT chain. – Andrew Domaszek May 30 '14 at 11:53
  • oops typo... fixed – nandoP Jun 1 '14 at 22:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.