{"id":201,"date":"2012-06-11T08:10:06","date_gmt":"2012-06-11T08:10:06","guid":{"rendered":"http:\/\/rmohan.com\/?p=201"},"modified":"2012-06-11T08:10:06","modified_gmt":"2012-06-11T08:10:06","slug":"iptables-rules","status":"publish","type":"post","link":"https:\/\/mohan.sg\/?p=201","title":{"rendered":"IPTABLES Rules"},"content":{"rendered":"

Limiting Spam and Attacks
\nSecurity – Training
\n<\/strong>
\nYou can use a bridge to effectively limit spam and attacks by managing the IP Ranges per Country.The basis behind the thought here is that these IP Address Ranges probably do not need access to your network in any way, unless you are an International business. By blocking these country ranges you may be reducing SPAM and Malware by up to 25%. In addition, in the event of a catastrophic virus outbreak you may create a window of time to secure your server by blocking these IP Ranges. The following websites keep track of network subnets that are related to each country.<\/p>\n

Lesson 9 \/ Lesson 11<\/p>\n

These websites provide the subnets for each country.<\/p>\n

http:\/\/www.countryipblocks.net\/country-blocks\/cidr\/<\/p>\n

http:\/\/ip.ludost.net<\/p>\n

Why limit IP subnets?
\nSome may say, “if you want a global business you need to allow access to your server from anywhere.” If you have ever run a mail server and see that 70-85% of all email is Spam you may reconsider that. If you have ever run a web server and see scripting attacks from locations you cannot pronounce let allow speak their language, you may reconsider. The fact is, there are a lot of attacks on your infrastructure and if you do not take steps to protect it you will lose it. Blocking country subnets may not stop those who use proxies and it will certainly not stop the guy down the street on your subnet….but it will make as difference and you will notice it within the hour.<\/p>\n

Implementing these restrictions will require you to add statements to your iptables in order to specifically drop subnets. The good thing about doing this from a bridge firewall is that you will do this once for the whole network. From the command line you will need to add a line to indicate the subnet source that you want to drop on the INPUT table. Here is an example that drops the subnet at 201.0.0.0\/8. Remember that the bridge is only using the FORWARD so this must be reflecting in your rules.<\/p>\n

iptables -A FORWARD -s 201.0.0.0\/8 -j DROP<\/p>\n

As an alternative you may want to only limit access to countries via port 80. This line will drop all attempts from the subnet at 201.0.0.0\/8 in reaching any port except port 80.
\niptables -A FORWARD -s 201.0.0.0\/8 -p tcp –dport ! 80 -j DROP<\/p>\n

Add A Script<\/p>\n

When you view the number of subnets to work with you will realize that writing rules will get to be a lot of work. What you can do is create a file called banned and place it in your \/etc\/ directory and then add this script to your firewall to access the “banned” file.<\/p>\n

##########################################
\n# BLOCK COUNTRY ATTACKS
\nBADIP=\/etc\/banned
\nBANNED=$( grep -v -E “^#” $BADIP )
\nfor ip in $BANNED
\ndo
\niptables -A INPUT -p tcp -s $ip -j DROP
\niptables -A FORWARD -p tcp -s $ip -j DROP
\ndone<\/p>\n

The \/etc\/banned file will look like this:<\/p>\n

24.190.78.101
\n58.0.0.0\/8
\n59.32.0.0\/13
\n59.40.0.0\/15
\n59.42.0.0\/16
\n59.43.0.0\/16
\n59.44.0.0\/14
\n59.48.0.0\/16
\n59.49.0.0\/17<\/p>\n

Prevent synchronization packet flooding (Sync Flood)
\n# Iptables-A FORWARD-p tcp – syn-m limit – limit 1 \/ s-j ACCEPT
\nAlso was writing
\n# The iptables-A INPUT-p tcp – syn-m limit – limit 1 \/ s-j ACCEPT
\n– Limit 1 \/ s limit syn complicated by the number of times per second can be modified according to their needs
\nPrevent all forms of port scans
\n# Iptables-A FORWARD-p tcp – tcp-flags SYN, ACK, FIN, RST RST-m limit – limit 1 \/ s -j ACCEPT
\nPing flood attacks (Ping of Death)
\n# Iptables-A FORWARD-p icmp – icmp-type echo-request-m limit – limit 1 \/ s -j ACCEPT<\/p>\n

Linux IPTables: Incoming and Outgoing Rule Examples (SSH and HTTP)<\/strong><\/p>\n

# 2. Set default chain policies
\niptables -P INPUT DROP
\niptables -P FORWARD DROP
\niptables -P OUTPUT DROP<\/p>\n

# 3. Allow incoming SSH
\niptables -A INPUT -i eth0 -p tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
\niptables -A OUTPUT -o eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT<\/p>\n

# 4. Allow incoming HTTP
\niptables -A INPUT -i eth0 -p tcp –dport 80 -m state –state NEW,ESTABLISHED -j ACCEPT
\niptables -A OUTPUT -o eth0 -p tcp –sport 80 -m state –state ESTABLISHED -j ACCEPT<\/p>\n

# 5. Allow outgoing SSH
\niptables -A OUTPUT -o eth0 -p tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
\niptables -A INPUT -i eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT<\/p>\n

iptables -A INPUT -i eth0 -p tcp –dport 443 -m state –state NEW,ESTABLISHED -j ACCEPT
\niptables -A OUTPUT -o eth0 -p tcp –sport 443 -m state –state ESTABLISHED -j ACCEPT<\/p>\n

iptables -A INPUT -i eth0 -p tcp -m multiport –dports 22,80,443 -m state –state NEW,ESTABLISHED -j ACCEPT
\niptables -A OUTPUT -o eth0 -p tcp -m multiport –sports 22,80,443 -m state –state ESTABLISHED -j ACCEPT<\/p>\n

Load Balance Incoming Web Traffic iptables <\/strong> <\/p>\n

You can also load balance your incoming web traffic using iptables firewall rules.
\nThis uses the iptables nth extension. The following example load balances the HTTPS traffic to three different ip-address. For every 3th packet, it is load balanced to the appropriate server (using the counter 0).<\/p>\n

iptables -A PREROUTING -i eth0 -p tcp –dport 443 -m state –state NEW -m nth –counter 0 –every 3 –packet 0 -j DNAT –to-destination 192.168.1.101:443
\niptables -A PREROUTING -i eth0 -p tcp –dport 443 -m state –state NEW -m nth –counter 0 –every 3 –packet 1 -j DNAT –to-destination 192.168.1.102:443
\niptables -A PREROUTING -i eth0 -p tcp –dport 443 -m state –state NEW -m nth –counter 0 –every 3 –packet 2 -j DNAT –to-destination 192.168.1.103:443<\/p>\n

12. Allow Ping from Outside to Inside
\nThe following rules allow outside users to be able to ping your servers.<\/p>\n

iptables -A INPUT -p icmp –icmp-type echo-request -j ACCEPT
\niptables -A OUTPUT -p icmp –icmp-type echo-reply -j ACCEPT<\/p>\n

13. Allow Ping from Inside to Outside
\nThe following rules allow you to ping from inside to any of the outside servers.<\/p>\n

iptables -A OUTPUT -p icmp –icmp-type echo-request -j ACCEPT
\niptables -A INPUT -p icmp –icmp-type echo-reply -j ACCEPT<\/p>\n

14. Allow Loopback Access
\nYou should allow full loopback access on your servers. i.e access using 127.0.0.1<\/p>\n

iptables -A INPUT -i lo -j ACCEPT
\niptables -A OUTPUT -o lo -j ACCEPT<\/p>\n

16. Allow outbound DNS
\nThe following rules allow outgoing DNS connections.<\/p>\n

iptables -A OUTPUT -p udp -o eth0 –dport 53 -j ACCEPT
\niptables -A INPUT -p udp -i eth0 –sport 53 -j ACCEPT<\/p>\n

Allow Rsync From a Specific Network
\nThe following rules allows rsync only from a specific network.<\/p>\n

iptables -A INPUT -i eth0 -p tcp -s 192.168.101.0\/24 –dport 873 -m state –state NEW,ESTABLISHED -j ACCEPT
\niptables -A OUTPUT -o eth0 -p tcp –sport 873 -m state –state ESTABLISHED -j ACCEPT<\/p>\n

19. Allow MySQL connection only from a specific network
\nIf you are running MySQL, typically you don\u2019t want to allow direct connection from outside. In most cases, you might have web server running on the same server where the MySQL database runs.
\nHowever DBA and developers might need to login directly to the MySQL from their laptop and desktop using MySQL client. In those case, you might want to allow your internal network to talk to the MySQL directly as shown below.<\/p>\n

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0\/24 –dport 3306 -m state –state NEW,ESTABLISHED -j ACCEPT
\niptables -A OUTPUT -o eth0 -p tcp –sport 3306 -m state –state ESTABLISHED -j ACCEPT<\/p>\n

Prevent DoS Attack<\/strong><\/p>\n

The following iptables rule will help you prevent the Denial of Service (DoS) attack on your webserver.<\/p>\n

iptables -A INPUT -p tcp –dport 80 -m limit –limit 25\/minute –limit-burst 100 -j ACCEPT<\/p>\n

Force SYN packets check<\/strong><\/p>\n

Make sure NEW incoming tcp connections are SYN packets; otherwise we need to drop them:<\/p>\n

iptables -A INPUT -p tcp ! –syn -m state –state NEW -j DROP<\/p>\n

Force Fragments packets check<\/p>\n

Packets with incoming fragments drop them. This attack result into Linux server panic such data loss.<\/p>\n

iptables -A INPUT -f -j DROP<\/p>\n


\nXMAS packets<\/strong><\/p>\n

Incoming malformed XMAS packets drop them:<\/p>\n

iptables -A INPUT -p tcp –tcp-flags ALL ALL -j DROP<\/p>\n

Drop all NULL packets<\/p>\n

Incoming malformed NULL packets:<\/strong><\/p>\n

iptables -A INPIT -p tcp –tcp-flags ALL NONE -j DROP<\/p>\n","protected":false},"excerpt":{"rendered":"

Limiting Spam and Attacks Security – Training You can use a bridge to effectively limit spam and attacks by managing the IP Ranges per Country.The basis behind the thought here is that these IP Address Ranges probably do not need access to your network in any way, unless you are an International business. By blocking […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/201"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=201"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/201\/revisions"}],"predecessor-version":[{"id":202,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/201\/revisions\/202"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}