3

I have setup a firewall with iptables to ratelimit connections based on content. The following is an example of one of my rules that stops wordpress bruteforce attacks.

iptables -A INPUT  -p tcp -m tcp --dport 80 -m string --algo bm --string "POST /wp-login.php" -m recent --set --name wp_brute --rsource
iptables -A INPUT  -p tcp -m tcp --dport 80 -m string --algo bm --string "POST /wp-login.php" -m recent --name wp_brute --rcheck --seconds 60 --hitcount 4 -j LOG --log-level=6 --log-prefix="Wordpress Attack:"
iptables -A INPUT  -p tcp -m tcp --dport 80 -m string --algo bm --string "POST /wp-login.php" -m recent --name wp_brute --rcheck --seconds 60 --hitcount 4 -j REJECT --reject-with tcp-reset

I am trying to get another rule that is a little tricker because I want to block based on the response packet from an incoming connection. For example if someone tries to login using pop3 and the response is authentication failed then I want to block the original IP. However the above rule will not work obviously because the sport is the original dport.

I tried this but I think it should be the output table not the input table.

iptables -A INPUT  -p tcp -m tcp --dport 110 -m string --algo bm --string "Password supplied for " -m recent --set --name pop3_brute --rsource
iptables -A INPUT  -p tcp -m tcp --dport 110 -m string --algo bm --string "Password supplied for " -m recent --name pop3_brute --rcheck --seconds 60 --hitcount 4 -j LOG --log-level=6 --log-prefix="POP3 Attack:"
iptables -A INPUT  -p tcp -m tcp --dport 110 -m string --algo bm --string "Password supplied for " -m recent --name pop3_brute --rcheck --seconds 60 --hitcount 4 -j REJECT --reject-with tcp-reset

So then I tried this

iptables -A OUTPUT  -p tcp -m tcp --sport 110 -m string --algo bm --string "Password supplied for " -m recent --set --name pop3_brute --rsource
iptables -A OUTPUT  -p tcp -m tcp --sport 110 -m string --algo bm --string "Password supplied for " -m recent --name pop3_brute --rcheck --seconds 60 --hitcount 4 -j LOG --log-level=6 --log-prefix="POP3 Attack:"
iptables -A OUTPUT  -p tcp -m tcp --sport 110 -m string --algo bm --string "Password supplied for " -m recent --name pop3_brute --rcheck --seconds 60 --hitcount 4 -j REJECT --reject-with tcp-reset

I am a little new to iptables so having a little trouble figuring out how to block the remote IP based on the response packet I return to it on a hit counter.

3
  • What is not working? Are the connections not being blocked, or are you trying to do something else and it isn't working? – womble Aug 14 '15 at 5:44
  • This is working, I want to try to block the outside ip based on the response packet my server sends back to the outside ip. For example I get a login request on pop3, my login failure will be in my response packet, if I respond with login failure X times block for X time. – ThatGuy Aug 14 '15 at 16:29
  • Personally, I think this isn't a winning idea, because all POP3/IMAP traffic should be TLS-protected (thus watching the traffic go over the network won't get you anything). Nevertheless, the rules you have should work, at a first glance, so what isn't working? – womble Aug 15 '15 at 7:41
2

Typically you would log the failures at the application level and then have a utility like for example fail2ban parse the logs and generate/manage firewall rules.

1

It has been awhile; however, wp uses SSL on the login page doesnt it? Rather, have you set up ssl at all? I say this due to where iptables sits on the stack.

IF you got to the login page and see that it is using SSL in anyway, the below rules would not be able to match any string you would be able to set up. SSL would be handled by apache, not the netfilter piece. So, iptables would only be seeing jibberish.

You would be better served putting alot of that in a vhost or htaccess file to match on POST using a exclusion for your address. I suggest directly in the vhost entry ( assuming you are using vhost ) since it only reads it in on vhost load. The htaccess option, common in shared hosting, would be checked on ever call to the match on the htaccess block. During a brute force on a shared hosting account you might generate some load.

Again, its been awhile since I messed with WP.

As to the pop3 match, have you tried doing a brute yourself while watching tcpdump? Something like :

tcpdump -xxV port 110

Doing the above would give EXACTLY what iptables will be able to match on. I would check out https://danielmiessler.com/study/tcpdump/ for some pointers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.