Iptables script, and closing ports on linux box

sarajevo · 12-25-2006, 01:13 AM

Hello,

I have iptables script as follows

iptables -F
iptables -t nat -F
iptables -t mangle -F

iptables -X
iptables -t nat -X
iptables -t mangle -X

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A INPUT -p icmp -j DROP
iptables -A INPUT -i eth0 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -p tcp --syn -j DROP
iptables -A INPUT -p udp -j DROP
iptables -A INPUT -j DROP
echo 0 > /proc/sys/net/ipv4/ip_forward

After running script, using nmap I scanned ports on my machine,

nmap my_ip_address and I got output like below

Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2006-12-25 09:05 CET
Interesting ports on eee.eee.ttt.ttt :
(The 1660 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
111/tcp open rpcbind
113/tcp open auth
656/tcp open unknown

Nmap finished: 1 IP address (1 host up) scanned in 0.267 seconds

I am askig all people out there does script part
iptables -A INPUT -p tcp --syn -j DROP
iptables -A INPUT -p udp -j DROP
iptables -A INPUT -j DROP
should drop all packets directed to my box, and how close 111, 113, 656 ports, I really do not need them.
How close some port using iptables?
Thanks in advance

Regards

win32sux · 12-25-2006, 03:49 AM

Quote:

Originally Posted by sarajevo

Hello,

I have iptables script as follows

iptables -F
iptables -t nat -F
iptables -t mangle -F

iptables -X
iptables -t nat -X
iptables -t mangle -X

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A INPUT -p icmp -j DROP
iptables -A INPUT -i eth0 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -p tcp --syn -j DROP
iptables -A INPUT -p udp -j DROP
iptables -A INPUT -j DROP
echo 0 > /proc/sys/net/ipv4/ip_forward

After running script, using nmap I scanned ports on my machine,

nmap my_ip_address and I got output like below

Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2006-12-25 09:05 CET
Interesting ports on eee.eee.ttt.ttt :
(The 1660 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
111/tcp open rpcbind
113/tcp open auth
656/tcp open unknown

Nmap finished: 1 IP address (1 host up) scanned in 0.267 seconds

I am askig all people out there does script part
iptables -A INPUT -p tcp --syn -j DROP
iptables -A INPUT -p udp -j DROP
iptables -A INPUT -j DROP
should drop all packets directed to my box, and how close 111, 113, 656 ports, I really do not need them.
How close some port using iptables?
Thanks in advance

Regards

try it like this:

Code:

iptables -F
iptables -F -t nat
iptables -F -t mangle

iptables -X
iptables -X -t nat
iptables -X -t mangle

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

echo 0 > /proc/sys/net/ipv4/ip_forward

do you still get those scan results??

BTW, you don't need any ACCEPT rules in your OUTPUT chain when you have its policy set to ACCEPT...

sarajevo · 12-25-2006, 07:00 AM

Quote:

Originally Posted by win32sux

try it like this:

Code:

iptables -F
iptables -F -t nat
iptables -F -t mangle

iptables -X
iptables -X -t nat
iptables -X -t mangle

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

echo 0 > /proc/sys/net/ipv4/ip_forward

do you still get those scan results??

BTW, you don't need any ACCEPT rules in your OUTPUT chain when you have its policy set to ACCEPT...

Hi,
using script above and running it I got nmap output as follows

Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2006-12-25 14:54 CET
Interesting ports on ttt.ddd.ddd.rrr
(The 1660 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
111/tcp open rpcbind
113/tcp open auth
656/tcp open unknown

Nmap finished: 1 IP address (1 host up) scanned in 0.321 seconds

what to to in order to block above mentioned ports using iptables
I read somewhere that
iptables -A INPUT -p tcp --syn -j DROP
iptables -A INPUT -p udp -j DROP
iptables -A INPUT -j DROP
will prevent some user to see what ports are open.
How close them, I know there are services listening on that ports and, I am trying to make these ports inaccessable using iptables tool.

Regards and thank you

win32sux · 12-25-2006, 05:59 PM

Quote:

Originally Posted by sarajevo

Hi,
using script above and running it I got nmap output as follows

Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2006-12-25 14:54 CET
Interesting ports on ttt.ddd.ddd.rrr
(The 1660 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
111/tcp open rpcbind
113/tcp open auth
656/tcp open unknown

Nmap finished: 1 IP address (1 host up) scanned in 0.321 seconds

what to to in order to block above mentioned ports using iptables
I read somewhere that
iptables -A INPUT -p tcp --syn -j DROP
iptables -A INPUT -p udp -j DROP
iptables -A INPUT -j DROP
will prevent some user to see what ports are open.
How close them, I know there are services listening on that ports and, I am trying to make these ports inaccessable using iptables tool.

Regards and thank you

the script i posted filters all your ports on all your interfaces... you don't need any of the three DROP rules you posted... something is definitely not right here... to confirm that the iptables rules are actually being applied, post the output of:

Code:

iptables -L -v -n

win32sux · 12-25-2006, 06:02 PM

wait a second...

Quote:

Originally Posted by sarajevo

Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2006-12-25 14:54 CET
Interesting ports on ttt.ddd.ddd.rrr
(The 1660 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
111/tcp open rpcbind
113/tcp open auth
656/tcp open unknown

Nmap finished: 1 IP address (1 host up) scanned in 0.321 seconds

0.3 seconds, huh?? judging by that amount of time i'm going to assume that you are scanning from the box itself... this is not what you wanna do in order to determine the state of your ports... to get a practical result you need to scan your box from another box... this will show you exactly what, for example, an attacker sees...

sarajevo · 12-26-2006, 01:19 AM

Quote:

Originally Posted by win32sux

wait a second...
0.3 seconds, huh?? judging by that amount of time i'm going to assume that you are scanning from the box itself... this is not what you wanna do in order to determine the state of your ports... to get a practical result you need to scan your box from another box... this will show you exactly what, for example, an attacker sees...

That is right.
Today later I will try scan from machineA to machineB and post result to this forum. I think sometimes before using
iptables -A INPUT -p tcp --syn -j DROP
I blocked everything directed to my box ( except regular traffic I allowed ).

I will post results today at 6 pm

Regards

sarajevo · 12-26-2006, 12:47 PM

@win32sux

your iptables script filter all ports, and that is what I looked for.

Using nmap I was able to discover MAC address of scanned host.

Now I am googlin to find out how using iptables prevent nmap to discover MAC address of scanned host.

Regards and thank you

win32sux · 12-27-2006, 05:06 AM

Quote:

Originally Posted by sarajevo

@win32sux

your iptables script filter all ports, and that is what I looked for.

Using nmap I was able to discover MAC address of scanned host.

Now I am googlin to find out how using iptables prevent nmap to discover MAC address of scanned host.

Regards and thank you

cool, glad to hear it worked well for you...

one thing: remember that MAC addresses will only be available to hosts on your LAN... it's part of the Ethernet standard... you don't need to be worried about hosts on the WAN since MAC addresses are non-routable...