Skip to main content

Thread: Iptables drop good package

-

my iptables conf droping package intranet internet, trough squid3 + dansguardian configuration.

log:

jun 23 14:39:17 tcla2 kernel: [13618.768499] invalid packet: in=eth1 out= mac=00:01:02:84:8d:4c:00:0b:db:67:72:47:08:00 src=192.168.2.5 dst=192.168.2.1 len=40 tos=0x00 prec=0x00 ttl=128 id=2777 df proto=tcp spt=51275 dpt=8080 window=0 res=0x00 rst urgp=0
jun 23 14:39:44 tcla2 kernel: [13644.880528] invalid packet: in=eth1 out= mac=00:01:02:84:8d:4c:00:0b:db:67:72:47:08:00 src=192.168.2.5 dst=192.168.2.1 len=40 tos=0x00 prec=0x00 ttl=128 id=2811 df proto=tcp spt=51275 dpt=8080 window=0 res=0x00 rst urgp=0

iptables script:

sudo iptables-save
# generated iptables-save v1.4.4 on wed jun 23 15:05:24 2010
*filter
:input accept [0:0]
:forward drop [0:0]
:output accept [0:0]
:bad_packets - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_inbound - [0:0]
:tcp_outbound - [0:0]
:udp_inbound - [0:0]
:udp_outbound - [0:0]
-a input -i lo -j accept
-a input -j bad_packets
-a input -d 224.0.0.1/32 -j drop
-a input -s 192.168.2.0/24 -i eth1 -j accept
-a input -d 192.168.2.255/32 -i eth1 -j accept
-a input -i eth1 -p udp -m udp --sport 68 --dport 67 -j accept
-a input -i eth0 -m state --state related,established -j accept
-a input -s 192.168.2.0/24 -i eth1 -p tcp -m tcp --dport 8080 -j accept
-a input -i eth0 -p tcp -j tcp_inbound
-a input -i eth0 -p udp -j udp_inbound
-a input -i eth0 -p icmp -j icmp_packets
-a input -m pkttype --pkt-type broadcast -j drop
-a input -m limit --limit 3/min --limit-burst 3 -j log --log-prefix "input packet died: "
-a forward -j bad_packets
-a forward -i eth1 -p tcp -j tcp_outbound
-a forward -i eth1 -p udp -j udp_outbound
-a forward -i eth1 -j accept
-a forward -i eth0 -m state --state related,established -j accept
-a forward -p tcp -m tcp --sport 1863 -j accept
-a forward -m limit --limit 3/min --limit-burst 3 -j log --log-prefix "forward packet died: "
-a output -p icmp -m state --state invalid -j drop
-a output -s 127.0.0.1/32 -j accept
-a output -o lo -j accept
-a output -s 192.168.2.1/32 -j accept
-a output -o eth1 -j accept
-a output -o eth0 -j accept
-a output -m limit --limit 3/min --limit-burst 3 -j log --log-prefix "output packet died: "
-a bad_packets -s 192.168.2.0/24 -i eth0 -j log --log-prefix "illegal source: "
-a bad_packets -s 192.168.2.0/24 -i eth0 -j drop
-a bad_packets -m state --state invalid -j log --log-prefix "invalid packet: "
-a bad_packets -m state --state invalid -j drop
-a bad_packets -p tcp -j bad_tcp_packets
-a bad_packets -j return
-a bad_tcp_packets -i eth1 -p tcp -j return
-a bad_tcp_packets -p tcp -m tcp ! --tcp-flags fin,syn,rst,ack syn -m state --state new -j log --log-prefix "new not syn: "
-a bad_tcp_packets -p tcp -m tcp ! --tcp-flags fin,syn,rst,ack syn -m state --state new -j drop
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg none -j log --log-prefix "stealth scan: "
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg none -j drop
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,syn,rst,psh,ack,urg -j log --log-prefix "stealth scan: "
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,syn,rst,psh,ack,urg -j drop
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,psh,urg -j log --log-prefix "stealth scan: "
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,psh,urg -j drop
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,syn,rst,ack,urg -j log --log-prefix "stealth scan: "
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,syn,rst,ack,urg -j drop
-a bad_tcp_packets -p tcp -m tcp --tcp-flags syn,rst syn,rst -j log --log-prefix "stealth scan: "
-a bad_tcp_packets -p tcp -m tcp --tcp-flags syn,rst syn,rst -j drop
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn fin,syn -j log --log-prefix "stealth scan: "
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn fin,syn -j drop
-a bad_tcp_packets -p tcp -j return
-a icmp_packets -p icmp -f -j log --log-prefix "icmp fragment: "
-a icmp_packets -p icmp -f -j drop
-a icmp_packets -p icmp -m icmp --icmp-type 8 -j drop
-a icmp_packets -p icmp -m icmp --icmp-type 11 -j accept
-a icmp_packets -p icmp -j return
-a tcp_inbound -p tcp -m tcp --dport 51413 -j accept
-a tcp_inbound -p tcp -m tcp --dport 80 -j accept
-a tcp_inbound -p tcp -m tcp --dport 443 -j accept
-a tcp_inbound -p tcp -m tcp --dport 22 -j accept
-a tcp_inbound -p tcp -m tcp --dport 6891:6900 -j accept
-a tcp_inbound -p tcp -m tcp --dport 111 -j accept
-a tcp_inbound -p tcp -m tcp --dport 9400 -j accept
-a tcp_inbound -p tcp -m tcp --dport 2049 -j accept
-a tcp_inbound -p tcp -m tcp --dport 9401 -j accept
-a tcp_inbound -p tcp -m tcp --dport 9402 -j accept
-a tcp_inbound -p tcp -m tcp --dport 9403 -j accept
-a tcp_inbound -p tcp -m tcp --dport 2222:10000 -j accept
-a tcp_inbound -p tcp -m tcp --dport 631 -j accept
-a tcp_inbound -p tcp -j return
-a tcp_outbound -p tcp -j accept
-a udp_inbound -p udp -m udp --dport 137 -j drop
-a udp_inbound -p udp -m udp --dport 138 -j drop
-a udp_inbound -p udp -m udp --dport 123 -j accept
-a udp_inbound -p udp -m udp --dport 53 -j accept
-a udp_inbound -p udp -m udp --dport 5353 -j accept
-a udp_inbound -p udp -m udp --dport 111 -j accept
-a udp_inbound -p udp -m udp --dport 9400 -j accept
-a udp_inbound -p udp -m udp --dport 2049 -j accept
-a udp_inbound -p udp -m udp --dport 9401 -j accept
-a udp_inbound -p udp -m udp --dport 9402 -j accept
-a udp_inbound -p udp -m udp --dport 9403 -j accept
-a udp_inbound -p udp -m udp --dport 2222:10000 -j accept
-a udp_inbound -p udp -j return
-a udp_outbound -p udp -j accept
commit
# completed on wed jun 23 15:05:24 2010
# generated iptables-save v1.4.4 on wed jun 23 15:05:24 2010
*mangle
rerouting accept [1087894:251735380]
:input accept [1086564:251616593]
:forward accept [0:0]
:output accept [344984:2270354335]
ostrouting accept [345256:2270407549]
commit
# completed on wed jun 23 15:05:24 2010
# generated iptables-save v1.4.4 on wed jun 23 15:05:24 2010
*nat
rerouting accept [1412:127511]
ostrouting accept [382:32952]
:output accept [1531:112812]
-a prerouting -s 192.168.2.0/24 ! -d 192.168.2.0/24 -i eth1 -p tcp -m tcp --dport 80 -j redirect --to-ports 8080
-a postrouting -o eth0 -j snat --to-source 192.168.1.2
commit
# completed on wed jun 23 15:05:24 2010

try simple tcp/udp rules, without following:

-a output -m limit --limit 3/min --limit-burst 3 -j log --log-prefix "output packet died: "
-a bad_packets -s 192.168.2.0/24 -i eth0 -j log --log-prefix "illegal source: "
-a bad_packets -s 192.168.2.0/24 -i eth0 -j drop
-a bad_packets -m state --state invalid -j log --log-prefix "invalid packet: "
-a bad_packets -m state --state invalid -j drop
-a bad_packets -p tcp -j bad_tcp_packets
-a bad_packets -j return
-a bad_tcp_packets -i eth1 -p tcp -j return
-a bad_tcp_packets -p tcp -m tcp ! --tcp-flags fin,syn,rst,ack syn -m state --state new -j log --log-prefix "new not syn: "
-a bad_tcp_packets -p tcp -m tcp ! --tcp-flags fin,syn,rst,ack syn -m state --state new -j drop
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg none -j log --log-prefix "stealth scan: "
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg none -j drop
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,syn,rst,psh,ack,urg -j log --log-prefix "stealth scan: "
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,syn,rst,psh,ack,urg -j drop
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,psh,urg -j log --log-prefix "stealth scan: "
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,psh,urg -j drop
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,syn,rst,ack,urg -j log --log-prefix "stealth scan: "
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn,rst,psh,ack,urg fin,syn,rst,ack,urg -j drop
-a bad_tcp_packets -p tcp -m tcp --tcp-flags syn,rst syn,rst -j log --log-prefix "stealth scan: "
-a bad_tcp_packets -p tcp -m tcp --tcp-flags syn,rst syn,rst -j drop
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn fin,syn -j log --log-prefix "stealth scan: "
-a bad_tcp_packets -p tcp -m tcp --tcp-flags fin,syn fin,syn -j drop
-a bad_tcp_packets -p tcp -j return
-a icmp_packets -p icmp -f -j log --log-prefix "icmp fragment: "
-a icmp_packets -p icmp -f -j drop
-a icmp_packets -p icmp -m icmp --icmp-type 8 -j drop
-a icmp_packets -p icmp -m icmp --icmp-type 11 -j accept
-a icmp_packets -p icmp -j return
and check log again.


Forum The Ubuntu Forum Community Ubuntu Specialised Support Ubuntu Servers, Cloud and Juju Server Platforms [ubuntu] Iptables drop good package


Ubuntu

Comments

Post a Comment

Popular posts from this blog

Joomla site hacked, cant see front and - Joomla! Forum - community, help and support

-
hi all; here thing: i went see site because haven't visited week or 2 , surprised when saw white page some provocation written on tab , acronym of attacker on page. i log on ftp server see if files there , found vital data remind safe. i tried put site off line got same hackers index.html file displaying when press "preview" button in joomla admin. deleted index.html file , tried check offline site option again. time got offline page. but problem resumes when put site online... white page, nothing else written. site date, , joomla updated v. 1.5.10 few days back. virtuemart commponent installed, newest v. 1.1.3 do need install fresh joomla copy , overwrite files previous including data base, or can avoid job fixing index.html on front end. i didn't make backup copy of site, i'll if not working save date in case potential hacker delete server... any suggestions? check template index.html file (edit html in template manager active template) usual source of hacking...
Read more

Christian Home School Programs - Joomla! Forum - community, help and support

-
Image
hello guys, (my first custom template) i got son in accelerated christian home school program. they did not have web site designing , hosting cover fees in trade. website: christian home school programs i've not got content published... the graphics imagination i've installed jumi i have directphp installed mostly custom css layout , i've used css purity seo, christian home shool - 200 million+ organics i have optimized code behind visual design crawlers. any thoughts / recommendations? i'm new custom templating in joomla ears open gurus of joomla richard hey, well done on first custom template. i don't background... @ all. think should going more professional look, maybe isnt repeating on both x , y axis, , isnt shade of blue. as far content goes, there isnt much... site performance good. good luck tim Board index Joomla! Official Sites & Infrastructure Sites & Infrastructure - Feedback/Information ...
Read more

Trouble with PF_OutFlag_I_USE_AUDIO and PF_CHECKOUT_LAYER_AUDIO

-
i trying render graphical representation of layer's audio waveform. have seen this similar thread , problem checking out audio, cannot far.   in globalsetup function set out_flags thus..   out_data-> out_flags = pf_outflag_i_use_audio;   but in pf_cmd_frame_setup function, , pf_cmd_render function ( pf_cmd_smart_pre_render pf_cmd_smart_render)   the pf_indata src_snd structure empty , in_data->start_sampl == 0, in_data->dur_sampl == 0, in_data->total_sampl == 0     i missing something, appreciate guidance,   thanks   steve (london, uk - adobe plugin developers nearby?) More discussions in After Effects SDK adobe
Read more