LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
Reload this Page Is IPtables not working??BruteForce on 80
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
Page 1 of 3 1 23
  Search this Thread
Old 02-21-2009, 03:08 AM   #1
aq_mishu
Member
 
Registered: Sep 2005
Location: Bangladesh
Distribution: RH 7.2, 8, 9, Fedora
Posts: 217

Rep: Reputation: 30
Unhappy Is IPtables not working??BruteForce on 80

Guys!!
I'm experiencing severe BruteForce attack from the IP 92.48.127.153 on my port 80 for http.

I have set the iptables as follows...

Code:
iptables -A INPUT -i eth0 -s 92.48.127.153 -j REJECT
And finally did the
Code:
service iptables save
service iptables restart
And then the iptables nvl shows it...
Code:
    0     0 REJECT     all  --  eth0   *       92.48.127.153        0.0.0.0/0          reject-with icmp-port-unreachable
Now please help me... i want to get rid of this guy....
 
Old 02-21-2009, 03:16 AM   #2
JulianTosh
Member
 
Registered: Sep 2007
Location: Las Vegas, NV
Distribution: Fedora / CentOS
Posts: 674
Blog Entries: 3

Rep: Reputation: 90
use -j DROP instead
 
Old 02-21-2009, 03:24 AM   #3
aq_mishu
Member
 
Registered: Sep 2005
Location: Bangladesh
Distribution: RH 7.2, 8, 9, Fedora
Posts: 217

Original Poster
Rep: Reputation: 30
did so... nothing... still the guy can access... i can see the httpd logs realtime...
 
Old 02-21-2009, 03:33 AM   #4
aq_mishu
Member
 
Registered: Sep 2005
Location: Bangladesh
Distribution: RH 7.2, 8, 9, Fedora
Posts: 217

Original Poster
Rep: Reputation: 30
this is current..

0 0 DROP all -- eth0 * 92.48.127.153 202.53.171.50

but nothing... he still accessing... all i now can do is just unplug the cable...
 
Old 02-21-2009, 03:39 AM   #5
JulianTosh
Member
 
Registered: Sep 2007
Location: Las Vegas, NV
Distribution: Fedora / CentOS
Posts: 674
Blog Entries: 3

Rep: Reputation: 90
please post the output of

ifconfig -eth0

you might have your input/output src/dst mixed up.
 
Old 02-21-2009, 03:42 AM   #6
aq_mishu
Member
 
Registered: Sep 2005
Location: Bangladesh
Distribution: RH 7.2, 8, 9, Fedora
Posts: 217

Original Poster
Rep: Reputation: 30
ifconfig -eth0
eth0 Link encap:Ethernet HWaddr 00:50:BF:9C:ED:B7
inet addr:202.53.171.50 Bcast:202.53.171.55 Mask:255.255.255.248
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:564 errors:0 dropped:0 overruns:0 frame:0
TX packets:512 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
Interrupt:3 Base address:0x1c00

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:61 errors:0 dropped:0 overruns:0 frame:0
TX packets:61 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
 
Old 02-21-2009, 03:42 AM   #7
aq_mishu
Member
 
Registered: Sep 2005
Location: Bangladesh
Distribution: RH 7.2, 8, 9, Fedora
Posts: 217

Original Poster
Rep: Reputation: 30
iptables -nL
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 80,443,21,30
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW icmp type 8
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
DROP all -- 10.0.0.0/8 0.0.0.0/0
DROP all -- 172.16.0.0/12 0.0.0.0/0
DROP all -- 192.168.0.0/16 0.0.0.0/0
DROP all -- 220.177.248.174 0.0.0.0/0
DROP all -- 222.92.117.19 0.0.0.0/0
DROP all -- 92.48.127.153 202.53.171.50

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 25,80,443,21,30
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW icmp type 8
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

==============================

iptables -A INPUT -i eth0 -d 202.53.171.50 -s 92.48.127.153 -j DROP

was used
 
Old 02-21-2009, 03:50 AM   #8
JulianTosh
Member
 
Registered: Sep 2007
Location: Las Vegas, NV
Distribution: Fedora / CentOS
Posts: 674
Blog Entries: 3

Rep: Reputation: 90
Your default input policy is drop, but you have an accept everything in there:
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
 
Old 02-21-2009, 03:52 AM   #9
JulianTosh
Member
 
Registered: Sep 2007
Location: Las Vegas, NV
Distribution: Fedora / CentOS
Posts: 674
Blog Entries: 3

Rep: Reputation: 90
you can kill it with fire by finding the line number and deleting the rule

iptables -nL --line-numbers

and

iptables -D INPUT <rule number>
 
Old 02-21-2009, 03:57 AM   #10
JulianTosh
Member
 
Registered: Sep 2007
Location: Las Vegas, NV
Distribution: Fedora / CentOS
Posts: 674
Blog Entries: 3

Rep: Reputation: 90
further, with a default policy of drop, those drop rules are useless and can be deleted.

might want to check out your drop chain as well.
 
Old 02-21-2009, 04:00 AM   #11
aq_mishu
Member
 
Registered: Sep 2005
Location: Bangladesh
Distribution: RH 7.2, 8, 9, Fedora
Posts: 217

Original Poster
Rep: Reputation: 30
did not understand...
iptables -nL
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 80,443,21,30
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW icmp type 8
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
DROP all -- 10.0.0.0/8 0.0.0.0/0
DROP all -- 172.16.0.0/12 0.0.0.0/0
DROP all -- 192.168.0.0/16 0.0.0.0/0
DROP all -- 220.177.248.174 0.0.0.0/0
DROP all -- 222.92.117.19 0.0.0.0/0
DROP all -- 92.48.127.153 202.53.171.50

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 25,80,443,21,30
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW icmp type 8
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
====================================
Now how to work line-numbers?? I already have made a reboot after the iptables rules. I think the firewall is not working as it was supposed to work...
 
Old 02-21-2009, 04:02 AM   #12
aq_mishu
Member
 
Registered: Sep 2005
Location: Bangladesh
Distribution: RH 7.2, 8, 9, Fedora
Posts: 217

Original Poster
Rep: Reputation: 30
iptables -nL
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 80,443,21,30
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW icmp type 8
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
DROP all -- 10.0.0.0/8 0.0.0.0/0
DROP all -- 172.16.0.0/12 0.0.0.0/0
DROP all -- 192.168.0.0/16 0.0.0.0/0
DROP all -- 220.177.248.174 0.0.0.0/0
DROP all -- 222.92.117.19 0.0.0.0/0
DROP all -- 92.48.127.153 202.53.171.50

Chain FORWARD (policy ACCEPT)
target prot opt source destination
============================================
Now what?? Actually i think its not working or may b understanding prob....
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 25,80,443,21,30
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW icmp type 8
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
 
Old 02-21-2009, 04:03 AM   #13
aq_mishu
Member
 
Registered: Sep 2005
Location: Bangladesh
Distribution: RH 7.2, 8, 9, Fedora
Posts: 217

Original Poster
Rep: Reputation: 30
iptables -nL
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 80,443,21,30
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW icmp type 8
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
DROP all -- 10.0.0.0/8 0.0.0.0/0
DROP all -- 172.16.0.0/12 0.0.0.0/0
DROP all -- 192.168.0.0/16 0.0.0.0/0
DROP all -- 220.177.248.174 0.0.0.0/0
DROP all -- 222.92.117.19 0.0.0.0/0
DROP all -- 92.48.127.153 202.53.171.50

Chain FORWARD (policy ACCEPT)
target prot opt source destination
============================================
Now what?? Actually i think its not working or may b understanding prob....
 
Old 02-21-2009, 04:09 AM   #14
aq_mishu
Member
 
Registered: Sep 2005
Location: Bangladesh
Distribution: RH 7.2, 8, 9, Fedora
Posts: 217

Original Poster
Rep: Reputation: 30
iptables -nL
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 80,443,21,30
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW icmp type 8
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
DROP all -- 10.0.0.0/8 0.0.0.0/0
DROP all -- 172.16.0.0/12 0.0.0.0/0
DROP all -- 192.168.0.0/16 0.0.0.0/0
DROP all -- 220.177.248.174 0.0.0.0/0
DROP all -- 222.92.117.19 0.0.0.0/0
DROP all -- 92.48.127.153 202.53.171.50

Chain FORWARD (policy ACCEPT)
target prot opt source destination
============================================
Now what?? Actually i think its not working or may b understanding prob....
 
Old 02-21-2009, 04:10 AM   #15
JulianTosh
Member
 
Registered: Sep 2007
Location: Las Vegas, NV
Distribution: Fedora / CentOS
Posts: 674
Blog Entries: 3

Rep: Reputation: 90
your drop statements are never firing because of the last "ACCEPT all -- 0.0.0.0/0 0.0.0.0/0". That allows everything regardless of protocol, address or state. you basically dont have a firewall at this point. Delete that line and you're good to go.

If you post your rules using "--line-numbers" I'll tell you exactly which one to get rid of...
Last edited by JulianTosh; 02-21-2009 at 04:12 AM.
 
  


Reply
Page 1 of 3 1 23



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
C/C++ Bruteforce, Dictionary Creation... Need a method Micah Programming 12 06-07-2006 10:28 AM
Compromised by SSH bruteforce MBH Linux - Security 3 09-16-2005 10:10 PM
Successful bruteforce attack? nixinbarrie Linux - Security 3 05-07-2005 02:07 PM
ssh bruteforce DoS branden_burger Linux - Security 10 03-29-2005 02:53 AM
bruteforce nautilus_1987 Linux - Software 6 09-02-2002 11:37 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 06:30 PM.

Contact Us - Advertising Info - Rules - Privacy - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration