0

I recently had a server hosted on OVH, which I can access via SSH. On this server is installed a data collection tool (Cyber), on Linux and accessible from a Web interface.

This tool must be accessible only by my network in SSH and for the Web interface.

So I created the following tables:

     38531 5164K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
     195K 6576K ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
        9   432 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:6100:6200
        5   260 ACCEPT     tcp  --  *      *       xxx.xxx.xx.xx        0.0.0.0/0            tcp dpt:80
      336 17472 ACCEPT     tcp  --  *      *       xxx.xxx.xx.xx        0.0.0.0/0            tcp dpt:443
       10   580 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:xxxx (ssh)
    
    Chain FORWARD (policy DROP 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination         
    
    
    Chain OUTPUT (policy DROP 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination         
    2703K  188M ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
     215K   15M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
       21 12096 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:6100:6200
        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            xxx.xxx.xx.xx        tcp dpt:443
        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            xxx.xxx.xx.xx        tcp dpt:80
        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp spt:xxxx (ssh)

In "policy" ACCEPT, I added the different rules:

  • enable local loop

  • maintain established connections

  • allow ping

  • allow access to ports 6100 and 6200 because I believe OVH uses them for monitoring

  • allow https and http access for my network address (freebox)

  • allow SSH access through a new port

I then passed the Policy in DROP for the three rules, INPUT, OUTPUT, FORWARD (hoping that it had to be done like that, it was to avoid me being blocked)

Then, I researched on the internet how to avoid as much as possible certain attacks such as DDOS, flood etc.

I found these commands:

# Anti ddos

iptables -A INPUT -p tcp --syn -m limit --limit 2/s --limit-burst 30 -j ACCEPT

# Anti-scan

iptables -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 1/h -j ACCEPT
iptables -A INPUT -p tcp --tcp-flags ALL ALL -m limit --limit 1/h -j ACCEPT

# As for ICMP:

iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

First, do you think the created table is well done? Is there a problem with the order of the rules, a lack of optimization or security?

Then would the above rules work? I fully understand what they are for, but I'm still having trouble spotting all possible vulnerabilities and if it's annoying for the servers where a lot of http requests are made.

Also, I did not put anything in FORWARD, for me, there is no use for it but I may be wrong

Lynow
  • 1
  • 1
  • 2

1 Answers1

0
    ### 1: Drop invalid packets ###
/sbin/iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP

### 2: Drop TCP packets that are new and are not SYN ###
/sbin/iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP

### 3: Drop SYN packets with suspicious MSS value ###
/sbin/iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP

### 4: Block packets with bogus TCP flags ###
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

### 5: Block spoofed packets ###
/sbin/iptables -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 192.168.0.0/16 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 0.0.0.0/8 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP

### 6: Drop ICMP (you usually don't need this protocol) ###
/sbin/iptables -t mangle -A PREROUTING -p icmp -j DROP

### 7: Drop fragments in all chains ###
/sbin/iptables -t mangle -A PREROUTING -f -j DROP

### 8: Limit connections per source IP ###
/sbin/iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset

### 9: Limit RST packets ###
/sbin/iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP

### 10: Limit new TCP connections per second per source IP ###
/sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP

### 11: Use SYNPROXY on all ports (disables connection limiting rule) ###
#/sbin/iptables -t raw -A PREROUTING -p tcp -m tcp --syn -j CT --notrack
#/sbin/iptables -A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
#/sbin/iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

### SSH brute-force protection ###
/sbin/iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --set
/sbin/iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP

### Protection against port scanning ###
/sbin/iptables -N port-scanning
/sbin/iptables -A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN
/sbin/iptables -A port-scanning -j DROP

No offence, but Google gave me an answer within 2 seconds: https://gist.github.com/mattia-beta/bd5b1c68e3d51db933181d8a3dc0ba64

Ace
  • 478
  • 1
  • 6
  • Thanks for your reply, but that doesn't quite answer my questions. I wanted to see if my rules above looked secure and appropriate for my server type. I have already looked at multiple forums for iptables, indeed I find many different configurations, that's why I come here to clarify things, because there are never the same rules proposed! I don't want to copy and paste dozens of rules on the internet without really knowing if they are useful or not – Lynow Jul 15 '22 at 15:52
  • @Lynow That's hard to say what is appropriate because we don't know what services you will be running on there and what your threat vector is. But with firewalls the general consensus in the industry is to deny as much as possible and to only allow what is really needed. IPTable rules will only work if your ports are not already saturated. – Ace Jul 15 '22 at 16:23