Arch Linux

Biosko

Member

Registered: 2011-09-06

Posts: 6

FW hardening/tunning

Hello,
recently I tried to tune my iptables with help of internet but I can reproduce dropping of bad tcp packets with bad tcp flags.
I am trying to send flags by nmap or hping but it doesnt get blocked. Even I can do XMAS or other stuff, and still no log about this in /var/log/messages.
Can somebody help me to reproduce one of this bad packets? Or can somebody check if the chains are in right order or if there is any problem?
I will appreciate also if somebody will have any other hardening hint too.
Thank you

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]

-N bad_packets
-N bad_tcp_packets
-N icmp_packets
-N udp_inbound
-N udp_outbound
-N tcp_inbound
-N tcp_outbound

# Drop any invalid packet that could not be identified
-A bad_packets -p ALL -m state --state INVALID -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "Invalid packet: "
-A bad_packets -p ALL -m state --state INVALID -j DROP

# Then check the tcp packets for additional problems
-A bad_packets -p tcp -j bad_tcp_packets

# All good, so return
-A bad_packets -p ALL -j RETURN

# All tcp packets will traverse this chain.
-A bad_tcp_packets -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "New not syn: "
-A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
-A bad_tcp_packets -p tcp -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "TCP fragment: "
-A bad_tcp_packets -p tcp -f -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "ALL NONE Ss: "
-A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ALL ALL -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "ALL ALL Ss: "
-A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "ALL FIN,URG,PSH Ss: "
-A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "ALL SYN,RST,ACK,FIN,URG Ss: "
-A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
-A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "SYN,RST SYN,RST Ss: "
-A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "SYN,FIN SYN,FIN Ss: "
-A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
-A bad_tcp_packets -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "FIN,SYN,URG NONE Ss: "
-A bad_tcp_packets -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A bad_tcp_packets -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "FIN,SYN,RST ACK,URG Ss: "
-A bad_tcp_packets -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A bad_tcp_packets -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "FIN,SYN,RST PSH,URG Ss: "
-A bad_tcp_packets -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A bad_tcp_packets -p tcp --tcp-flags FIN,SYN FIN,SYN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "FIN,SYN FIN,SYN Ss: "
-A bad_tcp_packets -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A bad_tcp_packets -p tcp --tcp-flags FIN,RST FIN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "FIN,RST FIN,RST Ss: "
-A bad_tcp_packets -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
-A bad_tcp_packets -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "FIN,ACK FIN Ss: "
-A bad_tcp_packets -p tcp --tcp-flags FIN,ACK FIN -j DROP
-A bad_tcp_packets -p tcp --tcp-flags PSH,ACK PSH -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "PSH,ACK PSH Ss: "
-A bad_tcp_packets -p tcp --tcp-flags PSH,ACK PSH -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ACK,URG URG -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "ACK,URG URG Ss: "
-A bad_tcp_packets -p tcp --tcp-flags ACK,URG URG -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ACK,FIN FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "ACK,FIN FIN Ss: "
-A bad_tcp_packets -p tcp --tcp-flags ACK,FIN FIN -j DROP

# All good, so return
-A bad_tcp_packets -p tcp -j RETURN

# icmp_packets chain
# ICMP packets should fit in a Layer 2 frame, thus they should never be fragmented
-A icmp_packets --fragment -p ICMP -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "ICMP Fragment: "
-A icmp_packets --fragment -p ICMP -j DROP

# Echo to allow your system to be pinged.
-A icmp_packets -p ICMP --icmp-type 8 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "Ping detected: "
-A icmp_packets -p ICMP --icmp-type 8 -j ACCEPT

# Echo drop
#-A icmp_packets -p ICMP --icmp-type 8 -j DROP

# Time Exceeded
-A icmp_packets -p ICMP --icmp-type 11 -j ACCEPT

# Not matched, so return so it will be logged
-A icmp_packets -p ICMP -j RETURN

#udp_inbound chain
#udp windows drop
-A udp_inbound -p UDP --destination-port 137 -j DROP
-A udp_inbound -p UDP --destination-port 138 -j DROP

# Network Time Protocol (NTP) Server
#-A udp_inbound -p UDP --destination-port 123 -j ACCEPT

# Not matched, so return for logging
-A udp_inbound -p UDP -j RETURN

# udp_outbound chain
# No match, so ACCEPT
-A udp_outbound -p UDP -j ACCEPT

# tcp_inbound chain
# Services

# Email Server (SMTP)
-A tcp_inbound -p TCP --destination-port 25 -j ACCEPT
# HTTP
-A tcp_inbound -p TCP --destination-port 80 -j ACCEPT
# Email Server (POP3)
-A tcp_inbound -p TCP --destination-port 110 -j ACCEPT
# Email Server (IMAP4)
-A tcp_inbound -p TCP --destination-port 143 -j ACCEPT
# HTTPS (Secure Web Server)
-A tcp_inbound -p TCP --destination-port 443 -j ACCEPT
# Email Server (SMTPS)
-A tcp_inbound -p TCP --destination-port 465 -j ACCEPT
# Email Server (SMTP)
-A tcp_inbound -p TCP --destination-port 587 -j ACCEPT
# SSL Email Server (IMAP4S)
-A tcp_inbound -p TCP --destination-port 993 -j ACCEPT
# SSL Email Server (POP3S)
-A tcp_inbound -p TCP --destination-port 995 -j ACCEPT
# Zimbra admin (zimbra)
-A tcp_inbound -p TCP -s xx.xx.xx.xx --destination-port 7071 -j ACCEPT

# Not matched, so return so it will be logged
-A tcp_inbound -p TCP -j RETURN

# tcp_outbound chain
# No match, so ACCEPT
-A tcp_outbound -p TCP -j ACCEPT

# INPUT Chain
# Allow all on localhost interface
-A INPUT -p ALL -i lo -j ACCEPT

# Drop bad packets
-A INPUT -p ALL -d 224.0.0.1 -j DROP
-A INPUT -p ALL -j bad_packets
-A INPUT -p ALL -i eth0 -s 10.0.0.0/8 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP spoof 10: "
-A INPUT -p ALL -i eth0 -s 10.0.0.0/8 -j DROP
-A INPUT -p ALL -i eth0 -s 172.16.0.0/12 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP spoof 172: "
-A INPUT -p ALL -i eth0 -s 172.16.0.0/12 -j DROP
-A INPUT -p ALL -i eth0 -s 192.168.0.0/16 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP spoof 192: "
-A INPUT -p ALL -i eth0 -s 192.168.0.0/16 -j DROP
-A INPUT -p ALL -i eth0 -s 224.0.0.0/4 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP spoof 224: "
-A INPUT -p ALL -i eth0 -s 224.0.0.0/4 -j DROP
#-A INPUT -p ALL -i eth0 -d 224.0.0.0/4 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP spoof 224: "
#-A INPUT -p ALL -i eth0 -d 224.0.0.0/4 -j DROP
-A INPUT -p ALL -i eth0 -s 240.0.0.0/5 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP spoof 240: "
-A INPUT -p ALL -i eth0 -s 240.0.0.0/5 -j DROP
#-A INPUT -p ALL -i eth0 -s 127.0.0.0/8 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP spoof 127: "
#-A INPUT -p ALL -i eth0 -s 127.0.0.0/8 -j DROP
-A INPUT -p ALL -i eth0 -d 127.0.0.0/8 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP spoof 127: "
-A INPUT -p ALL -i eth0 -d 127.0.0.0/8 -j DROP
-A INPUT -p ALL -i eth0 -s 169.254.0.0/16 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP spoof 169: "
-A INPUT -p ALL -i eth0 -s 169.254.0.0/16 -j DROP
#-A INPUT -p ALL -i eth0 -s 0.0.0.0/8 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP spoof 0: "
-A INPUT -p ALL -i eth0 -s 0.0.0.0/8 -j DROP
-A INPUT -p ALL -i eth0 -s 255.255.255.255/32 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP spoof 255: "
-A INPUT -p ALL -i eth0 -s 255.255.255.255/32 -j DROP
#-A INPUT -p ALL -i eth0 -d 255.255.255.255 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP spoof 255: "
#-A INPUT -p ALL -i eth0 -d 255.255.255.255 -j DROP
-A INPUT -p ALL -i eth0 -s 168.254.0.0/16 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP spoof 168: "
-A INPUT -p ALL -i eth0 -s 168.254.0.0/16 -j DROP
-A INPUT -p ALL -i eth0 -s 248.0.0.0/5 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP spoof 248: "
-A INPUT -p ALL -i eth0 -s 248.0.0.0/5 -j DROP

# Accept Established Connections
-A INPUT -p ALL -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Route the rest to the appropriate user chain
-A INPUT -p TCP -i eth0 -j tcp_inbound
-A INPUT -p UDP -i eth0 -j udp_inbound
-A INPUT -p ICMP -i eth0 -j icmp_packets

# Drop without logging broadcasts that get this far.
-A INPUT -m pkttype --pkt-type broadcast -j DROP

# Log packets that still don't match
-A INPUT -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "INPUT packet died: "

# OUTPUT Chain
# Invalid icmp packets need to be dropped to prevent a possible exploit
-A OUTPUT -m state -p icmp --state INVALID -j DROP

# Localhost
-A OUTPUT -p ALL -s 127.0.0.1 -j ACCEPT
-A OUTPUT -p ALL -o lo -j ACCEPT

# To internet
-A OUTPUT -p ALL -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Log packets that still don't match
-A OUTPUT -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "OUTPUT packet died: "

COMMIT

Strike0

Member

From: Germany

Registered: 2011-09-05

Posts: 1,491

Re: FW hardening/tunning

Have a look for the packet drops in "dmesg" instead. Also have a look here for a way to make your chains logging more transparent.