Iptables (1.4)/firewall.sh
- !/bin/bash
- This is a generic version of the script I use to protect my servers.
- It's a bit more powerful, and a bit more intelligent. A lot of stuff,
- like the INVALID state, does not operate with quite the finesse that
- we were led to believe. Likewise, overly restricting traffic in
- general tends to throttle a lot of good - if malformed - traffic, for
- relatively little gain, and takes resources away from handling more
- serious issues. It is a bit larger, despite being more efficient.
- This script has undergone several revisions. I was originally
- tarpitting telnet attempts to port 25, for example, thus TARPORTS.
- I no longer do this for several reasons, but haven't bothered with
- fully purging the code yet.
-
- This script was developed by Vekseid, hosted at
- http://hexwiki.com/w/index.php?title=Iptables_%281.4%29/script&action=raw
- - vek@vekseid.com
- This script would not have been possible without Oskar Andreasson's
- IPTables Tutorial, found at:
- http://www.frozentux.net/iptables-tutorial/iptables-tutorial.html
- I additionally made use of a good amount of the information in Jan
- Engelhardt's "Detecting and deceiving network scans", found here:
- http://jengelh.medozas.de/documents/Chaostables.pdf
- Define variables to make for easy tuning.
- IPT - Location of the iptables binary
- SELFIPS - The server's allocated IP addresses
- WHITELIST - My own personal IPs, separated by spaces, CIDR style
- for address blocks e.g. 127.0.0.0/8
- TRUSTEDFACES - Interfaces we trust, typically lo but could also have
- e.g. eth1 in a two-server setup. Space separated
- BLACKLIST - Hated IPs. Functions as whitelist.
- SSHIP - IP address for SSH
- SAFEIPS - Won't tarpit on this IP/mask
- SERVIPS - Running SERVPORTS on this IP/mask
- SSHPORT - The port I have SSH set to. This does not provide
- much added security, but it makes logs less noisy.
- I reccoment picking a number and using it for all of
- your servers.
- TARPORTS - Ports we are going to tarpit when they get hit
- improperly. Default to 25 (SMTP) to trap spambots.
- SERVPORTS - Ports only open on the service IP
- OPENPORTS - Chosen ports to open on all IPs.
- UDPIPS - Space-separated list of IP addresses/masks to permit
- UDP on.
- UDPPORTS - Comma-separated list of ports to allow UDP.
- ALLOWPING - Whether or not to allow public pings. I often have to
- diagnose problems for my members so sure, why not : )
- USELOG - Whether to use the basic log. Nothing in these logs
- are fully reliable so I want to make them easy to
- disable.
export IPT=/sbin/iptables export SELFIPS="198.51.100.80/28 192.0.2.184/30 203.0.113.88" export WHITELIST="203.0.113.32/28 203.0.113.45" export TRUSTEDFACES="lo" export BLACKLIST="" export SSHIP="198.51.100.83" export SSHPORT=23728 export SAFEIPS="198.51.100.82 198.51.100.187" export SERVIPS="198.51.100.82" export TARPORTS=25 export SERVPORTS="587,993" export OPENPORTS="80,443,25565" export UDPIPS="" export UDPPORTS="" export ALLOWPING=1 export USELOG=1
- Ended up dropping this... IMO this is the responsibility of your
- host. Or if you are your own host, this is not done on your end
- machines.
- Retained solely to point out that people do this. However, keep in
- mind that each additional rule is more computing power for every
- connection.
- export DROPLIST="/etc/iptables/spamhausdrop.dat"
- The following are 'more advanced' variables.
- CONNREPORT - While the limit is initially far higher, we want to
- be reporting far before then, to see how many
- legitimate users a blanket cutoff may restrict in
- the event of an attack.
- CONNLIMIT - The connlimit match declaration - it declares how
- many tcp connections may exist for a given IP block.
- LOGLEVEL - Logging line for basic logging.
- LOGCON - Logs more serious incidents - connection flooding and
- so on, that we want more reliable data for.
export CONNREPORT="-m connlimit --connlimit-above 256 --connlimit-mask 24" export CONNLIMIT="-m connlimit --connlimit-above 512 --connlimit-mask 24" export LOGLEVEL="--log-level debug --log-ip-options" export LOGCON="--log-level debug --log-ip-options --log-tcp-sequence --log-tcp-options"
- The documentation on hashlimit could certainly use refinement. Worse,
- many examples might trick someone into using limit where a well-tuned
- hashlimit is really what they want - if they really want to take the
- performance hit at all.
- The following comes from reading the kernel module source, not the
- documentation : ) The man pages are not very helpful and the tutorial
- is extremely misleading on this match.
- Note that, this is from reading the source back in 2009. Things may
- have changed.
- --hashlimit-htable-gcinterval is always set to three seconds in these
- examples, except for ping, but you may wish to slow this down if
- you find your system cpu usage getting high under heavy loads.
- Your load is going to be based loosely off of htable-size divided
- by gcinterval. The default is 1000 (one second).
- --hashlimit-htable-expire is an easy one to calculate - just pick the
- time when the hashlimit-upto/above will fill up your bucket, maybe
- add a bit extra, or less if you don't care about occasional
- overages. The default is 10000 (ten seconds).
- --hashlimit-htable-max to quote the current kernel source:
- /* FIXME: do something. question is what.. */
- It currently fires a kernel warning if the hash table is allowed
- to grow beyond this size. It defaults to 8 times the htable-size,
- and has a floor of htable-size if set to a low value.
- There's no actual limit, however. I'm not convinced that the
- hashlimit algorithm is all it could be >_>
- I set this to htable-size since if somehow eight thousand
- connections are open I rather want to be warned about it.
- --hashlimit-htable-size is the size of the hash index. A hash of
- log(htable-size) is computed for whatever was given in mode/mask.
- If two objects end up with the same hash, they get placed in a
- chain which is iteratively searched.
- DO NOT SET THIS LOW EXPECTING IT WILL THROTTLE A DDOS. In theory,
- that is what htable-max is for. But only in theory.
- It has a bit of a messy default:
- num_physpages * page_size / 16384, with a cap of 8192 and a minimum
- of 16. Pretty much anyone with 256mb+ of RAM is going to reach the
- cap.
- In addition to the basic memory for the table itself, you will
- allocate pointer_bytes * 2 * htable-size in bytes for the table.
- More memory gets allocated in other functions and I haven't fully
- gone through the source, but for an amd64 machine that means 16
- bytes per bucket.
- Since this is the size of the full index and I have RAM to spare, I
- set all of the tables to 8k. The main thing to worry about here is
- the garbage collection interval, since this means it's checking
- eight thousand -linked lists- every interval.
- --hashlimit-srcmask is probably best set to /29 for IPv4 in most
- situations where srcip is used for the mask. Not only does this
- help reduce collision rates, /29's are often the same family or
- local organization. It works fine to treat them in this manner.
- The default for this and dstmask is 32 for IPv4 and 128 for IPv6.
- If using IPv6, if you do not set this to at least as low as /64 you
- are insane.
- --hashlimit-mode is a fairly straightforward setting. I would suggest
- using separate hashes for different ports and destination ips for
- most scenarios.
- --hashlimit-burst defaults to five. This determines the maximum size
- of the bucket which gets filled by upto/above.
- HASHLOG - The hashlimit declaration for basic logging. It's rather
- heavily limited in order to keep us from flooding.
- HASHCON - Log mass connection attempts
- HASHSSH - Not needed with this current setup, it exists more to
- limit getting my auth log slammed than anything.
- HASHPING - Originally for pings, now for related/established ICMP
- messages in general. To permit ICMP traceroutes, we're
- fairly generous.
export HASHPING="-m hashlimit --hashlimit-upto 5/second --hashlimit-burst 20 --hashlimit-mode srcip --hashlimit-srcmask 29 --hashlimit-name icmp --hashlimit-htable-size 8192 --hashlimit-htable-max 8192 --hashlimit-htable-gcinterval 1000 --hashlimit-htable-expire 2000" export HASHSSH="-m hashlimit --hashlimit-upto 3/minute --hashlimit-burst 3 --hashlimit-mode srcip --hashlimit-srcmask 29 --hashlimit-name ssh --hashlimit-htable-size 8192 --hashlimit-htable-max 8192 --hashlimit-htable-gcinterval 3000 --hashlimit-htable-expire 60000" export HASHLOG="-m hashlimit --hashlimit-upto 2/minute --hashlimit-burst 240 --hashlimit-mode srcip --hashlimit-srcmask 24 --hashlimit-name log --hashlimit-htable-size 8192 --hashlimit-htable-max 8192 --hashlimit-htable-gcinterval 3000 --hashlimit-htable-expire 120000" export HASHCON="-m hashlimit --hashlimit-upto 2/minute --hashlimit-burst 240 --hashlimit-mode srcip --hashlimit-srcmask 24 --hashlimit-name con --hashlimit-htable-size 8192 --hashlimit-htable-max 8192 --hashlimit-htable-gcinterval 3000 --hashlimit-htable-expire 120000"
- Here we set some variables that are not 'user modified'.
export DROPTARGET=DROP
- For awhile I logged all dropped packets, thus the following, but it's
- all noise and no signal. I prefer to log actual incidents.
- if [ $USELOG -eq 1 ] ; then
- export DROPTARGET=DRP
- fi
- Flush current rules and reset policies.
$IPT -F $IPT -X $IPT -t raw -F $IPT -t raw -X $IPT -P INPUT DROP $IPT -P FORWARD DROP $IPT -P OUTPUT ACCEPT
- Give the system some time to rest. Can be important if it's been
- tracking a lot.
sleep 3
- Interfaces we trust get a free pass. Don't even track, just accept.
for i in $TRUSTEDFACES do
$IPT -t raw -A PREROUTING -i $i -j NOTRACK $IPT -A INPUT -i $i -j ACCEPT
done
- Logging all dropped packets is 99.9% noise, but left in for debugging
- potential.
- if [ $USELOG -eq 1 ] ; then
##################################################################### # Log dropped packets. Only make the chain if logging is on. # This is only really useful to determine if you are under a serious # attack of some sort. ##################################################################### # $IPT -N DRP # $IPT -A DRP $HASHLOG -j LOG $LOGLEVEL --log-prefix "IPTables: Dropped: " # $IPT -A DRP -j DROP #####################################################################
- fi
- Accept from related connections, non-icmp established connections,
- related connections, and our chosen whitelist. Drop invalid sources
- and non-unicast packets/sources outright, as well as killing funny
- business.
- Iterate through whitelist entries
for i in $WHITELIST do
$IPT -A INPUT -p tcp -s $i -j ACCEPT
done
- Iterate through blacklist entries
for i in $BLACKLIST do
$IPT -A INPUT -s $i -j $DROPTARGET
done
- Iterate through Spamhaus DROP list, if we're using that.
- for i in $(cat $DROPLIST | grep -i SBL | cut -f 1 -d ';' )
- do
- $IPT -A INPUT -s $i -j DROP
- done
- Iterate through our own ips - drop spoofed entries.
for i in $SELFIPS do
$IPT -A INPUT -s $i -j $DROPTARGET
done
- I used to split out tcp traffic and rate limit that. It really only
- caught exceptionally bad ISPs with legitimate users and aggressive
- web spiders. DDOS attempts are best mitigated with connlimit and
- possibly checking for lots of very small packets.
- I've found that the INVALID state actually spends most of its time
- dropping legitimate traffic. I can't really recommend it. You can
- do just as well by being picky with what you accept for NEW
- connections.
- Somewhere along the line, pings make established connections now.
- Annoying, but only minor changes needed to segregate established
- ICMP traffic. For sure, permit related traffic.
$IPT -A INPUT -m state --state RELATED -j ACCEPT $IPT -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT $IPT -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT
- Drop garbage sources and destinations.
$IPT -A INPUT -m pkttype ! --pkt-type unicast -j $DROPTARGET $IPT -A INPUT -m addrtype ! --src-type UNICAST -j $DROPTARGET $IPT -A INPUT -m addrtype --dst-type BROADCAST -j $DROPTARGET
- TCPMESS is our version of the CHAOS target.
- The primary purpose of this is not even to deceive, but simply to
- increase the cost of portscanning. This is more of a nuisance than
- actual security.
$IPT -N TCPMESS
- $IPT -A TCPMESS -p tcp -m statistic --mode random --probability 0.03 -j DELUDE
$IPT -A TCPMESS -p tcp -m statistic --mode random --probability 0.0208 -j REJECT --reject-with tcp-reset $IPT -A TCPMESS -p tcp -m statistic --mode random --probability 0.0211 -j REJECT --reject-with host-unreach $IPT -A TCPMESS -j DROP
- New TCP Traffic going to valid ports gets sent here.
- Check connlimit, check new connection rates, log nonsense.
$IPT -N TCPIN $IPT -A TCPIN -m recent --update --seconds 900 --hitcount 1 --name flooders -j DROP $IPT -A TCPIN -p tcp $CONNREPORT $HASHCON -j LOG $LOGCON --log-prefix "Hackers: Many Connections: " $IPT -A TCPIN -p tcp $CONNLIMIT -m recent --set --name flooders $IPT -A TCPIN -p tcp $CONNLIMIT -j LOG $LOGCON --log-prefix "Hackers: Connection Overlimit: " $IPT -A TCPIN -p tcp $CONNLIMIT -j REJECT --reject-with tcp-reset $IPT -A TCPIN -p tcp --tcp-flags SYN,FIN,RST,PSH,URG SYN -j ACCEPT
- Sometimes we see new connections from legitimate peoples that
- somehow escaped proper connection tracking. These are most
- frequently ACK, followed by RST, followed distantly by ACK PSH.
$IPT -A TCPIN -p tcp --tcp-flags SYN,ACK,RST,URG ACK -j ACCEPT $IPT -A TCPIN -p tcp --tcp-flags SYN,FIN,RST,PSH,URG RST -j ACCEPT if [ $USELOG -eq 1 ] ; then
$IPT -A TCPIN $HASHLOG -j LOG $LOGLEVEL --log-prefix "IPTables: Invalid Connect: "
fi $IPT -A TCPIN -j DROP
- TCP traffic for our standard ports are not hindered for the purposes
- of automated blocking of general hijinks.
- We accept things on open ports, except for our secret (in this case,
- our SSH port), and we shut people poking around for a few hours.
- $TARPORTS still gets used here to drop spammers, regardless.
$IPT -A INPUT -p tcp -m multiport --dports $OPENPORTS -j TCPIN for i in $SERVIPS do
$IPT -A INPUT -p tcp -d $i -m multiport --dports $SERVPORTS -j TCPIN
done
- $IPT -A INPUT -p tcp ! -d $SAFEIP -m multiport --dports $TARPORTS -j TARPIT
for i in $SAFEIPS do
$IPT -A INPUT -p tcp -d $i -m multiport --dports $TARPORTS -j TCPIN
done $IPT -A INPUT -p tcp -m multiport --dports $TARPORTS -j DROP
$IPT -A INPUT -p tcp -m recent --update --seconds 3600 --hitcount 1 --name scanners -j TCPMESS $IPT -A INPUT -p tcp -d $SSHIP --dport $SSHPORT $HASHSSH -j ACCEPT $IPT -A INPUT -p tcp -d $SSHIP --dport $SSHPORT $HASHCON -j LOG $LOGCON --log-prefix "Hackers: SSH Flood: " $IPT -A INPUT -p tcp -m recent --set --name scanners $IPT -A INPUT -p tcp -d $SSHIP --dport $SSHPORT -j TCPMESS if [ $USELOG -eq 1 ] ; then
$IPT -A INPUT -p tcp $HASHLOG -j LOG $LOGLEVEL --log-prefix "IPTables: Scanner: "
fi $IPT -A INPUT -p tcp -j TCPMESS
- Overall ICMP Rules
if [ $ALLOWPING -eq 1 ] ; then
##################################################################### # ICMP Incoming Chain. This looks like it's blocking more than it # actually is - a lot of incoming ICMP messages are RELATED. ##################################################################### $IPT -N ICMP if [ $USELOG -eq 1 ] ; then $IPT -A ICMP -p icmp --fragment $HASHLOG -j LOG $LOGLEVEL --log-prefix "IPTables: ICMP Fragment: " fi $IPT -A ICMP -p icmp --fragment -j DROP $IPT -A ICMP -p icmp --icmp-type echo-request -j ACCEPT # These generally get through first via accepting RELATED # connections, this is simply to be certain. $IPT -A ICMP -p icmp --icmp-type 3 -j ACCEPT $IPT -A ICMP -p icmp --icmp-type 4 -j ACCEPT if [ $USELOG -eq 1 ] ; then $IPT -A ICMP -p icmp $HASHLOG -j LOG $LOGLEVEL --log-prefix "IPTables: ICMP Bad: " fi #####################################################################
##################################################################### # Allow icmp packets at the rate given in HASHPING. # You tend not to see ping floods these days, but it may be # interesting enough to log. ##################################################################### $IPT -A INPUT -p icmp -m state --state NEW,ESTABLISHED $HASHPING -j ICMP if [ $USELOG -eq 1 ] ; then $IPT -A INPUT -p icmp -m state --state NEW,ESTABLISHED $HASHLOG -j LOG $LOGLEVEL --log-prefix "IPTables: ICMP Flood: " fi $IPT -A INPUT -p icmp -j DROP #####################################################################
fi
- UDP Rules.
- Not running DNS, so, let's mess with scanners!
- Probability in the .03-.04 range is apparently ideal.
- If you are more concerned about confusing scans of your network as
- opposed to scans of a single IP, using proto-unreach liberally can
- confuse protocol scans.
- Note, this blocks standard traceroutes. ICMP traceroutes work,
- however, which Windows falls back on and *nix can use via the -I
- switch.
$IPT -N UDPFUN
- Logging this is mostly noise.
- if [ $USELOG -eq 1 ] ; then
- $IPT -A UDPFUN $HASHLOG -j LOG $LOGLEVEL --log-prefix "IPTables: UDP: "
- fi
$IPT -A UDPFUN -m statistic --mode random --probability 0.02 -j REJECT --reject-with proto-unreach $IPT -A UDPFUN -m statistic --mode random --probability 0.0202 -j REJECT --reject-with host-unreach $IPT -A UDPFUN -j DROP
- UDP rules -must- come after dropping spoofed addresses.
for i in $UDPIPS do
$IPT -A INPUT -p udp -d $i -m multiport --dports $UDPPORTS -j ACCEPT
done $IPT -A INPUT -p udp -j UDPFUN
- This script was developed by Vekseid at
- http://hexwiki.com/w/index.php?title=Iptables_%281.4%29/script&action=raw
- - vek@vekseid.com