iptables problem with Debian 3.0r1 (Kernel 2.4.18)

markus1982 · 02-23-2003, 05:23 AM

I have a problem with a Debian 3.0r1 and iptables. For whatever reason everything seems to get dropped after a while (a ping works still though). Since I've been using that script on another box also with a customized kernel (2.4.20) and it works flawlessly there I think it could be a problem with the 2.4.18 kernel which has been shipped with the distro.

The firewall looks like that:

Quote:

#!/bin/sh
# =============================================================================
# netfilter based firewall built by Markus Welsch
# -----------------------------------------------------------------------------
# configuration based on
# http://timf.anansi-web.com/misc/iptables.html
# =============================================================================

COMPANY_FIREWALL_IP="xxx.xxx.xxx.xxx/32"
IPTABLES="/sbin/iptables"

LOOPBACK="lo"
EXTERNAL="eth0"

LOG_LEVEL="info"
# -----------------------------------------------------------------------------
echo

echo "Loading appropiate modules ..."
# -------------------------------------------------------------------
# -------------------------------------------------------------------

echo "Removing current rulesets ..."
# -------------------------------------------------------------------
$IPTABLES -F
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -X
# -------------------------------------------------------------------

echo "Setting default policies ..."
# -------------------------------------------------------------------
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT DROP
# -------------------------------------------------------------------

echo
echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
echo "Setting up ALLOW_ICMP chain ..."
# -------------------------------------------------------------------
$IPTABLES -N ALLOW_ICMP
$IPTABLES -F ALLOW_ICMP

# ----------------------------------------------------------
# DESTINATION UNREACHABLE
# ----------------------------------------------------------
$IPTABLES -A ALLOW_ICMP -p icmp --icmp-type destination-unreachable -j ACCEPT
# ----------------------------------------------------------

# ----------------------------------------------------------
# ECHO REPLY (PONG)
# ----------------------------------------------------------
$IPTABLES -A ALLOW_ICMP -p icmp --icmp-type echo-reply -j ACCEPT
# ----------------------------------------------------------

# ----------------------------------------------------------
# ECHO REQUEST (PING)
# ----------------------------------------------------------
$IPTABLES -A ALLOW_ICMP -p icmp -s $COMPANY_NETWORK --icmp-type echo-request -j ACCEPT
# ----------------------------------------------------------

# ----------------------------------------------------------
# HOST UNREACHABLE
# ----------------------------------------------------------
$IPTABLES -A ALLOW_ICMP -p icmp --icmp-type host-unreachable -j ACCEPT
# ----------------------------------------------------------

# ----------------------------------------------------------
# TTL EXCEEDED (TRACEROUTE)
# ----------------------------------------------------------
$IPTABLES -A ALLOW_ICMP -p icmp --icmp-type time-exceeded -j ACCEPT
# ----------------------------------------------------------
# -------------------------------------------------------------------

echo "Setting up CHECK_DENIED_PORTS chain ... "
# -------------------------------------------------------------------
$IPTABLES -N CHECK_DENIED_PORTS
$IPTABLES -F CHECK_DENIED_PORTS

# ----------------------------------------------------------
# OS fingerprinting
# ----------------------------------------------------------
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 0 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "OS fingerprinting:"
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 0 -j DROP
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 0 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "OS fingerprinting:"
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 0 -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# tcpmux scanning
# ----------------------------------------------------------
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 1 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "tcpmux scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 1 -j DROP
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 1 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "tcpmux scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 1 -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# sscan
# ----------------------------------------------------------
$IPTABLES -A CHECK_DENIED_PORTS -p tcp -m multiport --sports 1,2,3,4,5 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "sscan:"
$IPTABLES -A CHECK_DENIED_PORTS -p tcp -m multiport --sports 1,2,3,4,5 -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# sysstat scan
# ----------------------------------------------------------
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 11 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "sysstat scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 11 -j DROP
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 11 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "sysstat scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 11 -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# finger scan
# ----------------------------------------------------------
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 79 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "finger scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 79 -j DROP
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 79 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "finger scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 79 -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# linuxconf scan
# ----------------------------------------------------------
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 98 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "linuxconf scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 98 -j DROP
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 98 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "linuxconf scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 98 -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# sunrpc scan
# ----------------------------------------------------------
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 111 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "sunrpc scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 111 -j DROP
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 111 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "sunrpc scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 111 -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# mountd scan
# ----------------------------------------------------------
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 635 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "mountd scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 635 -j DROP
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 635 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "mountd scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 635 -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# socks scan
# ----------------------------------------------------------
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 1080 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "socks scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 1080 -j DROP
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 1080 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "socks scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 1080 -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# squid scan
# ----------------------------------------------------------
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 3128 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "squid scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p tcp --dport 3128 -j DROP
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 3128 -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "squid scan:"
$IPTABLES -A CHECK_DENIED_PORTS -p udp --dport 3128 -j DROP
# ----------------------------------------------------------
# -------------------------------------------------------------------

echo "Setting up CHECK_FLAGS chain ... "
# -------------------------------------------------------------------
$IPTABLES -N CHECK_FLAGS
$IPTABLES -F CHECK_FLAGS

# ----------------------------------------------------------
# stealth FIN scan
# ----------------------------------------------------------
$IPTABLES -A CHECK_FLAGS -p tcp --tcp-flags ALL FIN -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "Stealth FIN scan:"
$IPTABLES -A CHECK_FLAGS -p tcp --tcp-flags ALL FIN -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# stealth NULL scan
# ----------------------------------------------------------
$IPTABLES -A CHECK_FLAGS -p tcp --tcp-flags ALL NONE -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "Stealth NULL scan:"
$IPTABLES -A CHECK_FLAGS -p tcp --tcp-flags ALL NONE -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# stealth SYN/FIN scan (probably)
# ----------------------------------------------------------
$IPTABLES -A CHECK_FLAGS -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "SYN/FIN scan(?):"
$IPTABLES -A CHECK_FLAGS -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# stealth SYN/RST scan
# ----------------------------------------------------------
$IPTABLES -A CHECK_FLAGS -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "SYN/RST scan:"
$IPTABLES -A CHECK_FLAGS -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# stealth xmas-scan
# ----------------------------------------------------------
$IPTABLES -A CHECK_FLAGS -p tcp --tcp-flags ALL FIN,URG,PSH -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "Stealth XMAS scan:"
$IPTABLES -A CHECK_FLAGS -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# stealth xmas-all scan
# ----------------------------------------------------------
$IPTABLES -A CHECK_FLAGS -p tcp --tcp-flags ALL ALL -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "Stealth XMAS-ALL scan:"
$IPTABLES -A CHECK_FLAGS -p tcp --tcp-flags ALL ALL -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# stealth xmas-psh scan
# ----------------------------------------------------------
$IPTABLES -A CHECK_FLAGS -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -m limit --limit 5/minute -j LOG --log-level $LOG_LEVEL --log-prefix "Stealth XMAS-PSH scan:"
$IPTABLES -A CHECK_FLAGS -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
# ----------------------------------------------------------
# -------------------------------------------------------------------

echo "Setting up EGRESS_DST chain ..."
# -------------------------------------------------------------------
$IPTABLES -N EGRESS_DST
$IPTABLES -F EGRESS_DST

# ----------------------------------------------------------
# DROP all reserved private IP adresses
# ----------------------------------------------------------
# Class A Reserved
$IPTABLES -A EGRESS_DST -d 10.0.0.0/8 -j DROP

# Class B Reserved
$IPTABLES -A EGRESS_DST -d 172.16.0.0/12 -j DROP

# Class C Reserved
$IPTABLES -A EGRESS_DST -d 192.168.0.0/16 -j DROP

# Class D Reserved
$IPTABLES -A EGRESS_DST -d 224.0.0.0/4 -j DROP

# Class E Reserved
$IPTABLES -A EGRESS_DST -d 240.0.0.0/5 -j DROP
# ----------------------------------------------------------
# -------------------------------------------------------------------

echo "Setting up EGRESS_SRC chain ..."
# -------------------------------------------------------------------
$IPTABLES -N EGRESS_SRC
$IPTABLES -F EGRESS_SRC

# ----------------------------------------------------------
# DROP all reserved private IP adresses
# ----------------------------------------------------------
# Class A Reserved
$IPTABLES -A EGRESS_SRC -s 10.0.0.0/8 -j DROP

# Class B Reserved
$IPTABLES -A EGRESS_SRC -s 172.16.0.0/12 -j DROP

# Class C Reserved
$IPTABLES -A EGRESS_SRC -s 192.168.0.0/16 -j DROP

# Class D Reserved
$IPTABLES -A EGRESS_SRC -s 224.0.0.0/4 -j DROP

# Class E Reserved
$IPTABLES -A EGRESS_SRC -s 240.0.0.0/5 -j DROP
# ----------------------------------------------------------
# -------------------------------------------------------------------

echo "Setting up KEEP_STATE chain ..."
# -------------------------------------------------------------------
$IPTABLES -N KEEP_STATE
$IPTABLES -F KEEP_STATE

$IPTABLES -A KEEP_STATE -m state --state INVALID -j DROP
$IPTABLES -A KEEP_STATE -m state --state RELATED,ESTABLISHED -j ACCEPT
# -------------------------------------------------------------------

echo "Setting up SERVICES chain ..."
# -------------------------------------------------------------------
$IPTABLES -N SERVICES
$IPTABLES -F SERVICES

# ----------------------------------------------------------
# FTP (21)
# ----------------------------------------------------------
$IPTABLES -A SERVICES -p tcp --dport 21 -j ACCEPT
# ----------------------------------------------------------

# ----------------------------------------------------------
# SSH (22)
# ----------------------------------------------------------
$IPTABLES -A SERVICES -p tcp --dport 22 -j ACCEPT
# ----------------------------------------------------------

# ----------------------------------------------------------
# HTTP (80)
# ----------------------------------------------------------
$IPTABLES -A SERVICES -p tcp --dport 80 -j ACCEPT
# ----------------------------------------------------------

# ----------------------------------------------------------
# AUTH (113)
# ----------------------------------------------------------
$IPTABLES -A SERVICES -p tcp --dport 113 -j REJECT --reject-with tcp-reset
# ----------------------------------------------------------

# ----------------------------------------------------------
# HTTPS (443)
# ----------------------------------------------------------
$IPTABLES -A SERVICES -p tcp --dport 443 -j ACCEPT
# ----------------------------------------------------------

# ----------------------------------------------------------
# MySQL (3306)
# ----------------------------------------------------------
# $IPTABLES -A SERVICES -p tcp -s xxx.xxx.xxx.xxx/32 --dport 3306 -j ACCEPT
# ----------------------------------------------------------

# -------------------------------------------------------------------

echo
echo "Setting up EXTERNAL_INPUT chain ..."
# -------------------------------------------------------------------
$IPTABLES -N EXTERNAL_INPUT
$IPTABLES -F EXTERNAL_INPUT

# ----------------------------------------------------------
# check if ICMP stuff is allowed
# ----------------------------------------------------------
$IPTABLES -A EXTERNAL_INPUT -i $EXTERNAL -p icmp -j ALLOW_ICMP
# ----------------------------------------------------------

# ----------------------------------------------------------
# block hosts / subnets
# ----------------------------------------------------------
# $IPTABLES -A EXTERNAL_INPUT -i $EXTERNAL -s 0.0.0.0/32 -j DROP
# ----------------------------------------------------------

# ----------------------------------------------------------
# check if connection is going to denied port
# ----------------------------------------------------------
$IPTABLES -A EXTERNAL_INPUT -i $EXTERNAL -p ! icmp -j CHECK_DENIED_PORTS
# ----------------------------------------------------------

# ----------------------------------------------------------
# check TCP packets for weird flags
# ----------------------------------------------------------
$IPTABLES -A EXTERNAL_INPUT -i $EXTERNAL -p tcp -j CHECK_FLAGS
# ----------------------------------------------------------

# ----------------------------------------------------------
# FULL ACCESS filtering ...
# ----------------------------------------------------------
$IPTABLES -A EXTERNAL_INPUT -i $EXTERNAL -s $COMPANY_FIREWALL_IP -j ACCEPT
# ----------------------------------------------------------

# ----------------------------------------------------------
# service-level-based filtering
# ----------------------------------------------------------
$IPTABLES -A EXTERNAL_INPUT -i $EXTERNAL -p ! icmp -j SERVICES
# ----------------------------------------------------------
# -------------------------------------------------------------------

echo "Setting up EXTERNAL_OUTPUT chain ..."
# -------------------------------------------------------------------
$IPTABLES -N EXTERNAL_OUTPUT
$IPTABLES -F EXTERNAL_OUTPUT

# -----------------------------------------------------------
# CHECK TCP packets for weird flags
# -----------------------------------------------------------
$IPTABLES -A EXTERNAL_OUTPUT -p tcp -j CHECK_FLAGS
# -----------------------------------------------------------
# -------------------------------------------------------------------

echo "Setting up LO_INPUT chain ..."
# -------------------------------------------------------------------
$IPTABLES -N LO_INPUT
$IPTABLES -F LO_INPUT

$IPTABLES -A LO_INPUT -i $LOOPBACK -j ACCEPT
# -------------------------------------------------------------------

echo "Setting up LO_OUTPUT chain ..."
# -------------------------------------------------------------------
$IPTABLES -N LO_OUTPUT
$IPTABLES -F LO_OUTPUT

$IPTABLES -A LO_OUTPUT -o $LOOPBACK -j ACCEPT
# -------------------------------------------------------------------

echo
echo "Configuring INPUT chain ..."
# -------------------------------------------------------------------
$IPTABLES -A INPUT -i $LOOPBACK -j LO_INPUT
$IPTABLES -A INPUT -i $EXTERNAL -j EXTERNAL_INPUT
$IPTABLES -A INPUT -i $EXTERNAL -j KEEP_STATE
# -------------------------------------------------------------------

echo "Configuring OUTPUT chain ..."
# -------------------------------------------------------------------
$IPTABLES -A OUTPUT -o $LOOPBACK -j LO_OUTPUT
$IPTABLES -A OUTPUT -o $EXTERNAL -j EXTERNAL_OUTPUT
$IPTABLES -A OUTPUT -o $EXTERNAL -j KEEP_STATE
$IPTABLES -A OUTPUT -o $EXTERNAL -m state --state NEW -j ACCEPT
# -------------------------------------------------------------------
echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"

# =============================================================================

So if anybody experienced similar problems and/or is able to help out plz post here!

peter_robb · 02-25-2003, 03:04 PM

Do an ' iptables -nL --line-numbers ' & ' iptables -t nat -nL --line-numbers ' before and after the problem and see if something else is being added.
Pipe to a file if necessary, eg
iptables -nL --line-numbers > /etc/iptables.list.filter.before
iptables -t nat -nL --line-numbers > /etc/iptables.list.nat.before

These are much easier to read than a script...

markus1982 · 03-02-2003, 04:27 AM

Problem solved. Source of the problem was hardware malfunction!

Teukka · 08-21-2003, 05:07 AM

Hi!

just few questions:

1. I have just one machine to protect (2.4.21), IP-number is public
so propably I put that IP there

COMPANY_FIREWALL_IP="xxx.xxx.xxx.xxx/32"

And the mask would be like that?

2. The section

echo "Loading appropiate modules ..."
# -------------------------------------------------------------------
# -------------------------------------------------------------------

can I leave it like that? or is there some module that MUST load at that point?

3.

and the section below should accecpt
FTP, SSH, HTTP, AUTH and HTTPS, Drop "everything" else
right?

or did I mis something??

echo "Setting up SERVICES chain ..."
# -------------------------------------------------------------------
$IPTABLES -N SERVICES
$IPTABLES -F SERVICES

# ----------------------------------------------------------
# FTP (21)
# ----------------------------------------------------------
$IPTABLES -A SERVICES -p tcp --dport 21 -j ACCEPT
# ----------------------------------------------------------

# ----------------------------------------------------------
# SSH (22)
# ----------------------------------------------------------
$IPTABLES -A SERVICES -p tcp --dport 22 -j ACCEPT
# ----------------------------------------------------------

# ----------------------------------------------------------
# HTTP (80)
# ----------------------------------------------------------
$IPTABLES -A SERVICES -p tcp --dport 80 -j ACCEPT
# ----------------------------------------------------------

# ----------------------------------------------------------
# AUTH (113)
# ----------------------------------------------------------
$IPTABLES -A SERVICES -p tcp --dport 113 -j REJECT --reject-with tcp-reset
# ----------------------------------------------------------

# ----------------------------------------------------------
# HTTPS (443)
# ----------------------------------------------------------
$IPTABLES -A SERVICES -p tcp --dport 443 -j ACCEPT
# ----------------------------------------------------------

# ----------------------------------------------------------
# MySQL (3306)
# ----------------------------------------------------------
# $IPTABLES -A SERVICES -p tcp -s xxx.xxx.xxx.xxx/32 --dport 3306 -j ACCEPT
# ----------------------------------------------------------

# -------------------------------------------------------------------