system toolbox » ubuntu

http://www.tty1.net/blog/2007-02-06-iptables-firewall_en.html

Iptables Firewall

This page presents a simple firewall script. It is probably not the best of all possible firewalls, nor the most secure, but may be a starting point for your experiments. Please send any comments and suggestions to Thomas Pircher <tehpeh@gmx.net>.
Turning on native Kernel IPv4 protection

The Linux kernel provides some basic protections against manipulated IP packets. A configuration could be:

echo 1 > /proc/sys/net/ipv4/tcp_syncookies # enable syn cookies (prevent against the common 'syn flood attack')
echo 0 > /proc/sys/net/ipv4/ip_forward # disable Packet forwarning between interfaces
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # ignore all ICMP ECHO and TIMESTAMP requests sent to it via broadcast/multicast
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians # log packets with impossible addresses to kernel log
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses # disable logging of bogus responses to broadcast frames
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter # do source validation by reversed path (Recommended option for single homed hosts)
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects # don't send redirects
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route # don't accept packets with SRR option

Further reading:

• The file Documentation/networking/ip-sysctl.txt in your kernel source directory
• Network Security with /proc/sys/net/ipv4

Limit ping responses

Any iptables rule can be tuned to respond only to a limited number of times per time unit by using the limit module. This can be extremely useful for log entries (A ping flooding will not lock down your computer by writing to log files). I will show an example on how to limit on ICMP responses. This is not really useful, because it imposes a maximum of responses for ALL source IPs, but it may help to reduce network traffic on brute force attacks (and reduce volume in the log file).

iptables -A INPUT -p icmp -m limit --limit 10/second -j ACCEPT
iptables -A INPUT -p icmp -j DROP

This will limit the ICMP responses to a maximum of 10 replies per second. All the rest is silently dropped. Beware: dropping ICMP responses may slow down or cut off legitime users (for example when ICMP "Fragmentation Needed" packets are dropped).
Dealing with brute force ssh attacks

A stateful firewall can make brute force ssh scans more painful to the attacker by slowing down the responses. I will present a simple teergrubing strategy against ssh scans. This method relies on the IPTables/Netfilter Recent Module, written by Snow-man. The idea is simple: permit only a limited number of new connections per source IP address; drop any further connection attempt for a while.

iptables -A INPUT -p tcp --dport 22 -m recent --rcheck --seconds 60 --hitcount 2 --name SSH -j LOG --log-prefix "SH "
iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 2 --name SSH -j DROP
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT
iptables -A INPUT -i $int_if -m state --state ESTABLISHED,RELATED -j ACCEPT

Line 1 of the script checks if the source IP has already marked as 'Bad Guy' and logs the packet, if so. The second line drops the packet if it comes from a marked IP address and marks the source again. This ensures that the source will stay blacklisted as long as the attack continues. The third line marks the source IP as 'Bad Guy' if there are more than 2 connection attempts per minute. Note that already established connections continue to work (because the packets will no more arriving on 22).

Further reading:

• IPTables/Netfilter Recent Module
• Securing Debian Manual
• Defending against brute force ssh attacks
• Dealing with SSH scans

Download the script

You can download the script at http://www.tty1.net/stuff/firewall.

#! /bin/sh #

1. firewall iptables based frewall script #
2. Written by Thomas Pircher <tehpeh@gmx.net>
3. Based on the skeleton script, written by
4. Miquel van Smoorenburg <miquels@cistron.nl> and
5. Ian Murdock <imurdock@gnu.ai.mit.edu>. #
6. Version: @(#)firewall 1.0.1 2006-01-22 tehpeh@gmx.net #

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
DAEMON=/sbin/iptables
NAME=firewall
DESC="iptables based firewall"

test -x $DAEMON || exit 0

set -e

iptables=/sbin/iptables
int_if=eth0 # internal (local) interface, e.g. eth0
int_ip=207.210.85.78 # internal (local) IP, e.g. 192.168.1.94

function firewall_start {
#modprobe ip_conntrack
#modprobe ip_conntrack_ftp
#modprobe ip_nat_ftp

1. $iptables -A INPUT -m recent --name ICMP --update --seconds 60 --hitcount 6 -j DROP
2. $iptables -A INPUT -i $int_if -d $int_ip -p icmp -m recent --set --name ICMP -j ACCEPT

1. internet (established and out)
   $iptables -A OUTPUT -o $int_if -j ACCEPT
   $iptables -A INPUT -i $int_if -m state --state ESTABLISHED,RELATED -j ACCEPT

1. public services
   $iptables -A INPUT -i $int_if -p tcp -d $int_ip -m multiport --dports 25,80,143,443,993,8000 -j ACCEPT

1. accept ssh connections (max 2/minute from the same IP address)
   $iptables -A INPUT -p tcp --dport 22 -m recent --rcheck --seconds 60 --hitcount 2 --name SSH -j LOG --log-prefix "SH "
   $iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 2 --name SSH -j DROP
   $iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT

1. log all the rest before dropping
   $iptables -A INPUT -j LOG --log-prefix "IN "
   $iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
   $iptables -A OUTPUT -j LOG --log-prefix "OU "
   $iptables -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
   $iptables -A FORWARD -j LOG --log-prefix "FW "
   $iptables -A FORWARD -j REJECT --reject-with icmp-port-unreachable
   }

function fallback_start { # flush rules
$iptables -F
$iptables -F -t mangle
$iptables -X -t mangle
$iptables -F -t nat
$iptables -X -t nat
$iptables -X

1. default policy
   $iptables -P INPUT DROP
   $iptables -P FORWARD DROP
   $iptables -P OUTPUT DROP

1. accept everything from loopback
   $iptables -A INPUT -i lo -j ACCEPT
   $iptables -A OUTPUT -o lo -j ACCEPT

1. accept ICMP packets (ping et.al.)
   $iptables -A INPUT -i $int_if -d $int_ip -p icmp -j ACCEPT

1. internet (established and out)
   $iptables -A OUTPUT -o $int_if -j ACCEPT
   $iptables -A INPUT -i $int_if -m state --state ESTABLISHED,RELATED -j ACCEPT

1. public services
   $iptables -A INPUT -i $int_if -p tcp -d $int_ip -m multiport --dports 22,25,80,143,443,993 -j ACCEPT

1. log all the rest before dropping
   $iptables -A INPUT -j LOG --log-prefix "IN "
   $iptables -A OUTPUT -j LOG --log-prefix "OU "
   $iptables -A FORWARD -j LOG --log-prefix "FW "
   }

function firewall_stop { # flush rules
$iptables -F
$iptables -F -t mangle
$iptables -X -t mangle
$iptables -F -t nat
$iptables -X -t nat
$iptables -X

1. default policy
   $iptables -P INPUT ACCEPT
   $iptables -P FORWARD ACCEPT
   $iptables -P OUTPUT ACCEPT
   }

case "$1" in
start)
echo -n "Starting $DESC: "
firewall_start || fallback_start
echo "OK."
;;
stop)
echo -n "Stopping $DESC: "
firewall_stop
echo "OK."
;;

1. reload|force-reload)
2. #
3. # If the daemon can reload its config files on the fly
4. # for example by sending it SIGHUP, do it here.
5. #
6. # If the daemon responds to changes in its config file
7. # directly anyway, make this a do-nothing entry.
8. echo -n "Reloading $DESC: $NAME"
9. echo "OK."
10. ;;
    restart|reload|force-reload) # # If the "reload" option is implemented, move the "force-reload" # option to the "reload" entry above. If not, "force-reload" is # just the same as "restart". #
    echo -n "Restarting $DESC: "
    firewall_stop
    sleep 1
    firewall_start || fallback_start
    echo "OK."
    ;;
    *)
    N=/etc/init.d/$NAME
    echo "Usage: $N {start|stop|restart|reload|force-reload}" >&2 # echo "Usage: $N {start|stop|restart|force-reload}" >&2
    exit 1
    ;;
    esac

exit 0