Importing blocklists into iptables

win32sux · 04-03-2009, 03:20 PM

Quote:

Originally Posted by anomie

If you are only blacklisting for certain services, and can add extra criteria to the -j CHECK_IP rule, all the better. For example, if you are only blacklisting those addresses to tcp port 22 (ssh), then add the appropriate criteria to the rule

Excellent point, anomie. Thanks for posting that.

fruitwerks · 04-14-2009, 09:41 PM

I need to block all traffic from these and all is working well. I also run a transparent proxy. Is there a way to route port 80 request for these back to my webserver? This way it will give a 404 instead of taking the time to time-out.

win32sux · 04-14-2009, 11:04 PM

Quote:

Originally Posted by fruitwerks

I need to block all traffic from these and all is working well. I also run a transparent proxy. Is there a way to route port 80 request for these back to my webserver? This way it will give a 404 instead of taking the time to time-out.

Yes, you can DNAT the packets. It's much quicker to just switch from DROP to REJECT, though. Plus it's an application-neutral method, unlike an HTTP status code.

fruitwerks · 04-15-2009, 12:43 PM

ok, so you are suggesting to change all my drop statements to rejects? I think I had chosen drop for a specific reason... but I can't recall why it was so important. Using reject would cause a return ('fail') instead of a timeout?

Fun Stuff!

win32sux · 04-15-2009, 05:20 PM

Quote:

Originally Posted by fruitwerks

ok, so you are suggesting to change all my drop statements to rejects?

Only because you mentioned you didn't want these clients to need to wait for a timeout.

Quote:

I think I had chosen drop for a specific reason... but I can't recall why it was so important. Using reject would cause a return ('fail') instead of a timeout?

Usually people go with DROP instead of REJECT when they want to be stealthy.

From man iptables:

Code:

   REJECT
       This  is  used  to send back an error packet in response to the matched
       packet: otherwise it is equivalent to DROP so it is a terminating  TAR‐
       GET,  ending  rule  traversal.  This target is only valid in the INPUT,
       FORWARD and OUTPUT chains,  and  user-defined  chains  which  are  only
       called  from those chains.  The following option controls the nature of
       the error packet returned:

       --reject-with type
              The type given can be
               icmp-net-unreachable
               icmp-host-unreachable
               icmp-port-unreachable
               icmp-proto-unreachable
               icmp-net-prohibited
               icmp-host-prohibited or
               icmp-admin-prohibited (*)
              which return the appropriate ICMP error  message  (port-unreach‐
              able is the default).  The option tcp-reset can be used on rules
              which only match the TCP protocol: this causes a TCP RST  packet
              to  be  sent  back.   This  is  mainly useful for blocking ident
              (113/tcp) probes which frequently occur  when  sending  mail  to
              broken mail hosts (which won’t accept your mail otherwise).

       (*)  Using  icmp-admin-prohibited  with  kernels that do not support it
       will result in a plain DROP instead of REJECT