Hello all expert Linux Security administrator,

i have a noob question about iptables rules.

How to track the three way handshake and drop any new connection ?

DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/RST

What does this two rules mean ?

I also want to block any unset SYS and ACK tcp-flags.

I totally a newbie in networking and Linux.

This is all my rule and whether these all rules are safe enough?

Thanks for your help.

Your help is greatly appreciated by me and others.

Nothing beats really understanding the fundamentals of iptables. I found this to be about the best there is for learning the basics:

http://iptables-tutorial.frozentux.n...-tutorial.html

You'll be able to answer your own questions, with a little effort, which when it comes to iptables is well worth it.

Hello all, latest news from Peter_APIIT.

My system has been compromised. How i know the system is been compromised.

The iptables firewall rules has changed. My etc/sysconfig/iptables-config has been deleted.

Moreover, my state share object(State library) also been deleted.

How i can block my ISP hacked during netowrk initialization because i realised my ISP always hacked during the initialization of the connection.

I just don't understand how he can remove the files and gain root access to my pc.

I have afick, Bastille, File Integrity checker and AIDE installed.


I think i should beg for any helps.

Please help me. No internet no life.

I think i should format the pc but how can prevent this no happen next time ?

Please help.

A serious issue.

How can i restore to previous stage without fresh reinstall ?

I ahve downloaded the mkCDrec_v0.9.7.tar.gz
but i haven't backup my system.

I will get crazy if this happen once again.

Please don't come to MaLay*. The Internet ISP(Tm***) is pretty sucks here.

Wow. I definitely would do a fresh install, with the computer NOT connected to the internet.

And afterward I would boot the machine fully also disconnected, then connect the line and start network services. I suspect there's more than just iptables at play here. To my knowledge iptables rules are initialized before the interface. In any event get yourself a solid set of rules in place before connecting.

This recent tread (below) has a good, simple rule set. You can comment out (or delete) the rules that deal with services you do not use:

http://www.linuxquestions.org/questi...d.php?t=569202

(the last post has a well refined rule set)

BTW how do you connect? Dial up? DSL? And what distribution are you using? Most distributions allow you to select which partitions will be formatted during install, you can leave the /home directory intact and not lose much of your personalizations. (and all your documents should be in /home)

That tutorial I posted above really nailed the concepts for me. It's a lot of work, but well worth the peace of mind.

I have to admit I'm rather spoiled here, my home was one of the first
on the planet to have residential broadband. We were randomly selected as a test market many years ago. But I do sympathize with your plight, no doubt government has their hands in this business where you are at. (they pretty much do everywhere, but in different ways) Governments, for those who haven't been paying attention, are getting increasingly paranoid these days. They probably want to know what everybody is up to. I'd be interested to seeing the forensics of your "hacked" machine, deleting things from your machine is pretty extreme, a crime in my neck of the woods.

Anyway, best of luck, and be well,

cat

This is the output of tcpdump 06:23:41.294388 IP ns1.tm.net.my.domain > 192.168.1.34.32784: 13838- 0/13/0 (266)
where my ISP already enter to my pc.

My connection type is DSL. I using Fedora 7.

What difference between module conntrack and state. I have both rules but still cannot block them.

Thanks for your help.

Given the hostname of that server (ns1.tm...) that's very likely to be a nameserver for DNS resolution (you can check using nslookup or dig). In the future, if you see strange traffic like that, you can see what application/PID is involved using netstat -pantu and look for that corresponding port.

Could you explain further why you think your system has been hacked? I haven't seen anything you've posted so far that is conclusive evidence. It is normal for there to be traffic between your network and your ISP. Things like DNS resolution and DHCP are fairly commonly seen packets. Regarding the iptables-config modification, I believe Mandriva still uses msec which (depending on your security level) does a regular system check that will make modifications to various system files, in particular it will rollback modifications it believes are insecure and it will reload the iptables ruleset from a preset config file.

Could you explain how you are trying to block them? If the traffic is indeed DNS hostname resolution, then it's likely going to be in the RELATED state. You're requesting a webpage or whatever and the system needs to resolve the hostname, hence it makes a DNS request and the reply from your ISP would be RELATED.

The rules is in the post 1.

This website only accept ESTABLISHED, whereby i accept both RELATED,ESTABLISHED.

http://www.sns.ias.edu/~jns/wp/2006/...-it-work/?p=17

Which one is true.

My ISP always hacked during the initial connection.


Thanks for your help.

A billion thanks again.

This is my latest iptables rules but this still hacked by ISP. DO i need to remove the related.

As i know stateful firewall only applied to tcp protocol.

Please explain what you mean by this. It is very unlikely that your ISP is trying to break into your system.

message deleted

They have deleted all my rules before. That why i post this thread for help. I won;t simple saying that my iSP is ahcked me.

All /etc/sysconfig/iptables is deleted.

Do i need to remove the realted ?

A billion thank to you all.