1

Archwiki features an article with suggestions for a stateful iptables firewall. They recommend some rules to trick port scanners, but advise that they open up a vulnerability for DoS attacks. In particular, by denying access to IPs that continuously try to access closed ports, a potential attacker could send these packets with a spoofed IP so that my firewall would lock out legitimate users.

The suggested TCP rules are as follows:

# iptables -I TCP -p tcp -m recent --update --rsource --seconds 60 --name TCP-PORTSCAN -j REJECT --reject-with tcp-reset
# iptables -A INPUT -p tcp -m recent --set --rsource --name TCP-PORTSCAN -j REJECT --reject-with tcp-reset

My question is, could I limit the effectiveness of said DoS attack if I add the packet's TTL to the rules? According to iptables' man page:

--rttl: [···] this will narrow the match to only happen when the address is in the list and the TTL of the current packet matches that of the packet which hit the --set rule. This may be useful if you have problems with people faking their source address in order to DoS you via this module by disallowing others access to your site by sending bogus packets to you.

Would it work or am I missing something?

2 Answers 2

1

There are a couple of issues with using the TTL option for this purpose. You are essentially proposing using TTL as an additional component of identification when identifying addresses.

However, just as attackers can spoof IPs to lock out legitimate clients, they can also spoof packets' TTL values; anybody can generate packets with arbitrary TTL values, they aren't confined to starting with the assumed initial value.

Also, naturally as network infrastructure changes, the number of hops between you and the attacker will change over time, limiting the practical usefulness of TTL as a unique identifier.

The final problem with this technique is that it is entirely possible that an attacker would happen to have the same number of hops between them and you as there are between many legitimate hosts and you. Therefore even without any TTL spoofing they could probably achieve some level of DoS attack.

2
  • Thank you for your answer, it's very insightful. Do you suggest any alternative that uses iptables alone? (no other daemon). I ask out of pure curiosity :) Mar 1, 2018 at 20:51
  • @andresgongora Unfortunately no I don't know about alternatives very well, you could ask a separate question about that if you wanted.
    – B00TK1D
    Mar 21, 2018 at 17:13
1

This doesn't really answer your question because it is something outside of iptables but if you want to protect against port scans, PSAD is a better option. You can configure it to block any ip that port scans your system. http://cipherdyne.org/psad/

This uses iptables but it isn't necesarily just an iptables rule

1
  • Thank you very much for your suggestion. I'll definitively check it out :) Mar 1, 2018 at 19:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .